mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 18:01:37 +00:00
shankar0123
3ede1b726f
scripts/ci-guards/cold-db-compose-smoke.sh — wipes the postgres
volume (docker compose down -v), brings the stack up cold, mints a
day-0 admin via /api/v1/auth/bootstrap, issues + renews + revokes a
test certificate, asserts the three audit rows exist, tears down.
Catches the bug class fixed by commit def4be9 (the 2026-05-09
migration 000045 broken INSERT that the warm-DB integration suite
missed). The 2026-04-30 migration regression class generally.
Tunables via environment:
- COLD_DB_SMOKE_STARTUP_TIMEOUT (default 300s/svc)
- COLD_DB_SMOKE_PROBE_TIMEOUT (default 180s)
- COLD_DB_SMOKE_SERVER_URL (default https://localhost:8443)
- COLD_DB_SMOKE_CACERT (default deploy/test/certs/ca.crt)
On failure: dumps `docker compose logs --tail 200` for postgres,
certctl-server, certctl-agent, certctl-tls-init so the CI failure is
actionable without a re-run.
Sandbox VERIFICATION: bash syntax-check (bash -n) passes. Full smoke
run NOT executed in the sandbox — no Docker available here. The
operator runs it from their workstation as the Phase 6 negative-test
ladder (introducing a broken migration; confirming the script fails
with the migration error in the dumped logs).
CI wiring (.github/workflows/ci.yml::cold-db-compose-smoke job)
lands in the next commit (Phase 5).
Audit-Closes: post-v2.1.0-anti-rot/item-6