From c3114046a50feb40419cfccdbef204fb1a2874e1 Mon Sep 17 00:00:00 2001 From: Utkarash Singh Date: Tue, 8 Sep 2026 17:18:01 +0100 Subject: [PATCH 1/4] ci: run tests on main and pass the Postgres version through The push trigger targeted `master`, but the default branch is `main`, so tests only ran on pull requests and never after a merge. The matrix version was exported as PG_VERSION, while docker-compose reads SUPABASE_VERSION and the Dockerfile declares ARG SUPABASE_VERSION, so every run built against the hardcoded 15.1.1.13 image no matter what the matrix said. Use SUPABASE_VERSION throughout, refresh the pinned image, and add 17 to the matrix. --- .github/workflows/test.yml | 8 ++++---- dockerfiles/Dockerfile | 2 +- dockerfiles/docker-compose.yml | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 8ab9aee..7ea0fe4 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,21 +1,21 @@ name: tests on: pull_request: - push: { branches: master } + push: { branches: main } jobs: test: name: Run tests strategy: matrix: - postgres: ["15.1.1.13"] + postgres: ["15.14.1.169", "17.6.1.169"] runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v3 - name: Build docker images - run: PG_VERSION=${{ matrix.postgres }} docker compose -f dockerfiles/docker-compose.yml build + run: SUPABASE_VERSION=${{ matrix.postgres }} docker compose -f dockerfiles/docker-compose.yml build - name: Run tests - run: PG_VERSION=${{ matrix.postgres }} docker compose -f dockerfiles/docker-compose.yml run test + run: SUPABASE_VERSION=${{ matrix.postgres }} docker compose -f dockerfiles/docker-compose.yml run test diff --git a/dockerfiles/Dockerfile b/dockerfiles/Dockerfile index 5156078..a88154c 100644 --- a/dockerfiles/Dockerfile +++ b/dockerfiles/Dockerfile @@ -1,4 +1,4 @@ -ARG SUPABASE_VERSION=15.1.1.13 +ARG SUPABASE_VERSION=15.14.1.169 FROM supabase/postgres:${SUPABASE_VERSION} WORKDIR /home/splinter diff --git a/dockerfiles/docker-compose.yml b/dockerfiles/docker-compose.yml index 99b2535..47c7278 100644 --- a/dockerfiles/docker-compose.yml +++ b/dockerfiles/docker-compose.yml @@ -7,7 +7,7 @@ services: context: .. dockerfile: ./dockerfiles/Dockerfile args: - PG_VERSION: ${SUPABASE_VERSION:-15.1.1.13} + SUPABASE_VERSION: ${SUPABASE_VERSION:-15.14.1.169} healthcheck: test: pg_isready -U postgres -h localhost interval: 5s From afa538dec0df77b058eaf97c90df124fe1b29dfe Mon Sep 17 00:00:00 2001 From: Utkarash Singh Date: Tue, 8 Sep 2026 17:35:13 +0100 Subject: [PATCH 2/4] fix: extract lint categories without spanning earlier arrays The categories regex used a lazy `.*?` under DOTALL, so in a lint with an earlier `array[...]` the capture ran across it to the trailing `as categories` and returned the whole span as garbage categories. This hit 0023/0024/0025, whose SECURITY category came out as junk and then dropped them from category-filtered Advisor runs. Match a single `array[...]` with `[^\]]*` so the capture can't leave its own array. --- bin/compile_json.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/bin/compile_json.py b/bin/compile_json.py index 2ad885c..cb2d29d 100644 --- a/bin/compile_json.py +++ b/bin/compile_json.py @@ -32,9 +32,7 @@ import compile # noqa: E402 (bin/compile.py; import after sys.path setup) NAME_RE = re.compile(r"'([a-z0-9_]+)'\s+as\s+name", re.IGNORECASE) -CATEGORIES_RE = re.compile( - r"array\[(.*?)\]\s+as\s+categories", re.IGNORECASE | re.DOTALL -) +CATEGORIES_RE = re.compile(r"array\[([^\]]*)\]\s+as\s+categories", re.IGNORECASE) def extract_name(stem: str, query: str) -> str: From eeeb8cc2f2bd29e942538c3b343c2049c6391df6 Mon Sep 17 00:00:00 2001 From: Utkarash Singh Date: Tue, 8 Sep 2026 17:42:24 +0100 Subject: [PATCH 3/4] ci: keep the matrix on 15 for now 17 exposes a pre-existing version-pinned assertion in the 0022 test (amcheck default is 1.4 on 17, the expected output pins 1.3). Track adding 17 with that test fix separately. --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7ea0fe4..0757cf1 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -8,7 +8,7 @@ jobs: name: Run tests strategy: matrix: - postgres: ["15.14.1.169", "17.6.1.169"] + postgres: ["15.14.1.169"] runs-on: ubuntu-latest steps: - name: Checkout code From e51d0850658656b4aa85d98b8414b07730b3130b Mon Sep 17 00:00:00 2001 From: Utkarash Singh Date: Tue, 8 Sep 2026 17:56:15 +0100 Subject: [PATCH 4/4] test: make 0022 version-agnostic and re-enable the 17 matrix job The 0022 test pinned amcheck's available version (1.3), which differs on 17 (1.4) and was the only failure when 17 was in the matrix. Drop the version- dependent columns from the assertion and add 17 back. --- .github/workflows/test.yml | 2 +- .../0022_extension_versions_outdated.out | 16 ++++++++-------- test/sql/0022_extension_versions_outdated.sql | 10 +++++----- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 0757cf1..7ea0fe4 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -8,7 +8,7 @@ jobs: name: Run tests strategy: matrix: - postgres: ["15.14.1.169"] + postgres: ["15.14.1.169", "17.6.1.169"] runs-on: ubuntu-latest steps: - name: Checkout code diff --git a/test/expected/0022_extension_versions_outdated.out b/test/expected/0022_extension_versions_outdated.out index 25f5fda..2f06dfb 100644 --- a/test/expected/0022_extension_versions_outdated.out +++ b/test/expected/0022_extension_versions_outdated.out @@ -15,8 +15,8 @@ begin; 1 (1 row) - -- Test that the query returns proper column structure - -- This will help ensure the lint is properly formed + -- Verify the stable columns. The available (default) version is excluded + -- so the test doesn't depend on the amcheck version in the running image. select name, title, @@ -24,14 +24,14 @@ begin; facing, categories, description, - detail, remediation, - metadata, - cache_key + cache_key, + metadata - 'default_version' as metadata, + detail like 'Extension `amcheck` is using version `1.0`%' as detail_reports_installed_version from lint."0022_extension_versions_outdated"; - name | title | level | facing | categories | description | detail | remediation | metadata | cache_key ------------------------------+-----------------------------+-------+----------+------------+--------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------+----------------------------------------- - extension_versions_outdated | Extension Versions Outdated | WARN | EXTERNAL | {SECURITY} | Detects extensions that are not using the default (recommended) version. | Extension `amcheck` is using version `1.0` but version `1.3` is available. Using outdated extension versions may expose the database to security vulnerabilities. | https://supabase.com/docs/guides/database/database-linter?lint=0022_extension_versions_outdated | {"extension_name": "amcheck", "default_version": "1.3", "installed_version": "1.0"} | extension_versions_outdated_amcheck_1.0 + name | title | level | facing | categories | description | remediation | cache_key | metadata | detail_reports_installed_version +-----------------------------+-----------------------------+-------+----------+------------+--------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------+-----------------------------------------+-----------------------------------------------------------+---------------------------------- + extension_versions_outdated | Extension Versions Outdated | WARN | EXTERNAL | {SECURITY} | Detects extensions that are not using the default (recommended) version. | https://supabase.com/docs/guides/database/database-linter?lint=0022_extension_versions_outdated | extension_versions_outdated_amcheck_1.0 | {"extension_name": "amcheck", "installed_version": "1.0"} | t (1 row) drop extension amcheck; diff --git a/test/sql/0022_extension_versions_outdated.sql b/test/sql/0022_extension_versions_outdated.sql index cd394d5..34154f4 100644 --- a/test/sql/0022_extension_versions_outdated.sql +++ b/test/sql/0022_extension_versions_outdated.sql @@ -10,8 +10,8 @@ begin; count(*) as total_outdated_extensions from lint."0022_extension_versions_outdated"; - -- Test that the query returns proper column structure - -- This will help ensure the lint is properly formed + -- Verify the stable columns. The available (default) version is excluded + -- so the test doesn't depend on the amcheck version in the running image. select name, title, @@ -19,10 +19,10 @@ begin; facing, categories, description, - detail, remediation, - metadata, - cache_key + cache_key, + metadata - 'default_version' as metadata, + detail like 'Extension `amcheck` is using version `1.0`%' as detail_reports_installed_version from lint."0022_extension_versions_outdated"; drop extension amcheck;