Two bugs exposed by the integration suite:
1. (production) pins.origins is NOT NULL DEFAULT '{}', but pgx
serialises a Go nil []string as SQL NULL — so every Create/Replace
whose caller omitted origins (an optional field per the IPFS
Pinning Service spec) was 500ing on the NOT NULL constraint. The
openapi/pin-service paths pass origins through verbatim, so any
client POST without "origins" hit this. Normalise nil -> []string{}
at the store boundary in both pinStore.Create and pinStore.Replace.
2. (test I introduced last commit) SET LOCAL does not accept bound
parameters; the RLS integration test was getting a 42601 syntax
error. Switch to SELECT set_config('anchorage.org_id', $1, true),
which is parameterisable and keeps the value out of the SQL string.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
pgxpool has no Tx type; pool.Begin(ctx) returns pgx.Tx. The callback
signature in txWithOrg/mustCountPins was typed as pgxpool.Tx, which
failed to build under the integration tag.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- ids: TestIDsAreTimeOrdered asserted strict lexicographic ordering of
back-to-back UUIDv7s, but the sub-ms tail is random and not required
to be monotonic. Sleep between samples so each ID lands in a distinct
millisecond — the property that actually gives Postgres index
locality on (org_id, id desc).
- go.mod/go.sum: run go mod tidy. keyfunc/v3, prometheus/client_golang
and testcontainers-go/modules/postgres are imported directly and
should not be marked // indirect; also drops stale sum entries.
- gofmt -w across 12 files flagged by the lint job.
- security.yml: pin govulncheck to v1.2.0. @latest triggers a proxy
lookup every run, which is the step that hung for 16m on the Gitea
runner.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three workflows modeled on kanrisha + Vortex:
* test.yml — on push/PR to main: build + vet + unit tests (-race), a
gated integration job that runs go test -tags=integration ./test/...
(testcontainers spins up Postgres 17 itself; runner must expose the
docker socket), and a lint job (go mod tidy + gofmt check).
* security.yml — govulncheck on push to main plus a weekly Monday
06:00 UTC cron so fresh CVEs surface without a code change.
* release.yml — on v* tag push only: goreleaser v2 with
GORELEASER_FORCE_TOKEN=gitea + GITEA_SERVER_URL, plus a docker
login step so the built image can push to Gitea's registry.
All three pin Go 1.26 (go.mod says 1.26.2). Release job requires the
TOKEN_GITEA repo secret (scope: packages + code:write).
