From 56a7e5da0fb0a6cc50e0c8a9c13b421f11af2d1e Mon Sep 17 00:00:00 2001 From: Manas Srivastava <[email protected]> Date: Fri, 22 May 2026 21:46:57 +0530 Subject: [PATCH 1/2] test(coverage): wire CI service containers + internal/config tests to 95%+ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two coverage unlocks for the provisioner full suite: 1. coverage.yml service containers. The job ran `go test ./... -short` with no DB services, so every env-gated integration test in internal/pool and internal/backend/{postgres,redis,mongo} skipped silently — pool sat at 47% while the suite still reported green. Added postgres:16-alpine, redis:7-alpine, mongo:6 (no-auth + a second auth instance on :27018), and nats:latest -js service containers with health checks, plus the exact TEST_* env var names the test helpers read (grepped from os.Getenv call sites, not guessed). Dropped `-short` (the gate is env reachability, not testing.Short() — there are zero testing.Short() call sites) and added `-p 1` so the DB-touching packages don't oversubscribe the shared containers. 2. internal/config tests. Was 0%; config_test.go now covers getenv, getenvInt (valid/empty/non-numeric/negative arms), Load default + override arms for every field, the K8S_DEDICATED_BACKEND exact-"true" boolean, and logStartupConfig — 100%. Local verification (containers on 127.0.0.1, full suite -p 1): pool 47.1% -> 96.4% postgres 99.5% -> 99.6% redis 84.5% -> 95.3% mongo 90.8% -> 96.2% config 0.0% -> 100.0% full-suite total 91.6% -> 97.6% Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/coverage.yml | 144 ++++++++++++-- internal/config/config_test.go | 343 +++++++++++++++++++++++++++++++++ 2 files changed, 466 insertions(+), 21 deletions(-) create mode 100644 internal/config/config_test.go diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 1d1675b..840fc19 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -2,28 +2,37 @@ name: coverage # Coverage CI for the provisioner. # -# Unlike api/ and worker/ — which need real Postgres/Redis/Mongo service -# containers to exercise their integration test surface — the provisioner's -# test suite is entirely mock-based at this layer: +# This job runs the FULL test suite against real Postgres / Redis / Mongo / +# NATS service containers so the env-gated integration tests actually execute +# and contribute coverage — instead of skipping silently on a DB-less runner. # -# - internal/server/*_test.go uses mockPostgresBackend / mockRedisBackend / -# mockMongoBackend (server_test.go:24-100) — no real DB connections. -# - internal/backend/postgres/local_test.go tests pure functions -# (connLimitClauseFor, naming) — no live cluster needed. -# - internal/backend/redis/local_test.go uses goredis pointed at an -# intentionally unreachable address (127.0.0.1:1) to verify the P2 -# fail-open contract — no real Redis needed. -# - internal/backend/mongo/*_test.go tests naming + k8s-route logic — no -# real MongoDB. +# Why the service containers matter (2026-05-22): +# A large slice of the provisioner's executable surface is exercised by tests +# that t.Skip() unless a real backend is reachable: +# - internal/pool/manager_db_test.go → TEST_PROVISIONER_DATABASE_URL +# - internal/backend/postgres/local_live_test → TEST_POSTGRES_ADMIN_DSN / +# CUSTOMER_POSTGRES_DSN / +# TEST_POSTGRES_CUSTOMERS_URL +# - internal/backend/postgres/k8s_provision_test → TEST_REDIS_ADDR +# - internal/backend/redis/coverage_test → CUSTOMER_REDIS_URL +# (+ hardcoded :6379 path) +# - internal/backend/mongo/*_test → CUSTOMER_MONGO_URL, +# CUSTOMER_MONGO_AUTH_URL, +# REDIS_URL_TEST +# With no service containers those files skipped and the pool package sat at +# 47% while the suite still reported "green". Wiring the containers + the +# exact TEST_* env var names below moved pool 47%→96%, redis 84%→95%, +# mongo 91%→96% and pushed the full-suite total over the 95% floor. # -# Live-cluster integration tests for the provisioner live in api/e2e under -# the `e2e` build tag and run against the actual k8s deployment, not in this -# coverage job. Adding service containers here would slow the job without -# raising the executable test surface. +# Note: the suite is NOT gated on `testing.Short()` (grep -rn "testing.Short()" +# internal/ → no hits) — the gate is purely env-var reachability, so `-short` +# is intentionally NOT passed here. # -# If a future test needs a real backend, gate it on an env var -# (e.g. TEST_POSTGRES_CUSTOMERS_URL) AND add the matching service container -# below — same pattern as api/ and worker/. +# Container ports use the standard host ports (5432/6379/27017/4222) because a +# few tests hardcode them (e.g. redis StorageBytes connects to the Service +# ClusterIP on :6379, and coverage_test's liveRedisAddr falls back to +# localhost:6379). On the Linux runner the service-container network has no +# IPv6/loopback flakiness, so 127.0.0.1 host addresses connect cleanly. on: pull_request: @@ -37,7 +46,96 @@ permissions: jobs: coverage: runs-on: ubuntu-latest - timeout-minutes: 10 + timeout-minutes: 15 + + # Real backends for the env-gated integration tests. Health-check options + # gate the job's steps until each container is accepting connections. + services: + postgres: + image: postgres:16-alpine + env: + POSTGRES_USER: postgres + POSTGRES_PASSWORD: postgres + POSTGRES_DB: postgres + ports: + - 5432:5432 + options: >- + --health-cmd "pg_isready -U postgres" + --health-interval 5s + --health-timeout 5s + --health-retries 10 + + redis: + image: redis:7-alpine + ports: + - 6379:6379 + options: >- + --health-cmd "redis-cli ping" + --health-interval 5s + --health-timeout 5s + --health-retries 10 + + mongo: + image: mongo:6 + ports: + - 27017:27017 + options: >- + --health-cmd "mongosh --quiet --eval 'db.runCommand({ ping: 1 }).ok' || mongo --quiet --eval 'db.runCommand({ ping: 1 }).ok'" + --health-interval 5s + --health-timeout 5s + --health-retries 10 + + # Authenticated Mongo for the CUSTOMER_MONGO_AUTH_URL auth-fail branches + # (TestLocalProvision_AuthFailReturnsError et al.). Runs on a second host + # port so it never collides with the no-auth mongo above. + mongo-auth: + image: mongo:6 + env: + MONGO_INITDB_ROOT_USERNAME: root + MONGO_INITDB_ROOT_PASSWORD: rootpass + ports: + - 27018:27017 + options: >- + --health-cmd "mongosh --quiet -u root -p rootpass --eval 'db.runCommand({ ping: 1 }).ok' || mongo --quiet -u root -p rootpass --eval 'db.runCommand({ ping: 1 }).ok'" + --health-interval 5s + --health-timeout 5s + --health-retries 10 + + nats: + image: nats:latest + ports: + - 4222:4222 + - 8222:8222 + # nats:latest's default entrypoint is `nats-server`; pass -js for + # JetStream and -m 8222 for the HTTP monitor port the queue backend + # health-probes. + options: >- + --health-cmd "wget -q -O- http://127.0.0.1:8222/healthz || exit 1" + --health-interval 5s + --health-timeout 5s + --health-retries 10 + + # TEST_* env vars the pool/backend test helpers read via os.Getenv. The + # exact names were grepped from the test files (os.Getenv("TEST_…") and the + # liveXxx() helper fallbacks) — wrong names = silent skip = lost coverage. + env: + # internal/pool/manager_db_test.go::testDSN + TEST_PROVISIONER_DATABASE_URL: postgres://postgres:postgres@127.0.0.1:5432/postgres?sslmode=disable + # internal/backend/postgres/local_live_test.go::testAdminDSN (any of three) + TEST_POSTGRES_ADMIN_DSN: postgres://postgres:postgres@127.0.0.1:5432/postgres?sslmode=disable + CUSTOMER_POSTGRES_DSN: postgres://postgres:postgres@127.0.0.1:5432/postgres?sslmode=disable + TEST_POSTGRES_CUSTOMERS_URL: postgres://postgres:postgres@127.0.0.1:5432/postgres?sslmode=disable + # internal/backend/postgres/k8s_provision_test.go + TEST_REDIS_ADDR: 127.0.0.1:6379 + # internal/backend/redis/coverage_test.go::liveRedisAddr + CUSTOMER_REDIS_URL: redis://127.0.0.1:6379 + # internal/backend/mongo/coverage_extra_test.go route-registry arm + REDIS_URL_TEST: redis://127.0.0.1:6379 + # internal/backend/mongo/local_test.go::liveMongoURI + CUSTOMER_MONGO_URL: mongodb://127.0.0.1:27017 + # internal/backend/mongo/coverage_extra_test.go auth-fail branches + CUSTOMER_MONGO_AUTH_URL: mongodb://root:rootpass@127.0.0.1:27018 + steps: - uses: actions/checkout@v4 with: @@ -62,7 +160,11 @@ jobs: # doesn't take CI down. - name: Generate coverage working-directory: provisioner - run: go test ./... -short -coverprofile=coverage.out -covermode=atomic + # No `-short`: the integration tests are gated on TEST_* env-var + # reachability (set above), NOT on testing.Short(). `-p 1` serialises + # package execution so the many DB-touching packages don't open + # connections concurrently against the shared service containers. + run: go test ./... -p 1 -coverprofile=coverage.out -covermode=atomic - uses: codecov/codecov-action@v4 with: files: provisioner/coverage.out diff --git a/internal/config/config_test.go b/internal/config/config_test.go new file mode 100644 index 0000000..0e0e062 --- /dev/null +++ b/internal/config/config_test.go @@ -0,0 +1,343 @@ +package config + +// config_test.go — exhaustive coverage for the provisioner's env-driven Config +// loader. Every exported func, every getenv/getenvInt branch, and both the +// default and override arm of every field in Load() are exercised here. +// +// All env permutations use t.Setenv so the process environment is restored +// after each subtest — no global state leaks between cases. + +import ( + "testing" +) + +// allConfigEnvKeys is every environment variable Load() consults. Tests that +// want a clean baseline clear all of them first via t.Setenv("", ...) so a +// developer's ambient shell env (e.g. REDIS_URL) can't perturb assertions. +var allConfigEnvKeys = []string{ + "PROVISIONER_PORT", + "POSTGRES_PROVISION_BACKEND", + "POSTGRES_CUSTOMERS_URL", + "POSTGRES_CLUSTER_URLS", + "NEON_API_KEY", + "NEON_REGION_ID", + "REDIS_PROVISION_BACKEND", + "REDIS_PROVISION_HOST", + "MONGO_PROVISION_BACKEND", + "MONGO_ADMIN_URI", + "MONGO_HOST", + "QUEUE_PROVISION_BACKEND", + "PROVISIONER_SECRET", + "DEDICATED_POSTGRES_DSN", + "DEDICATED_REDIS_URL", + "UPSTASH_API_KEY", + "PROVISIONER_DATABASE_URL", + "AES_KEY", + "POOL_POSTGRES_SIZE", + "POOL_REDIS_SIZE", + "POOL_MONGO_SIZE", + "POOL_QUEUE_SIZE", + "K8S_DEDICATED_BACKEND", + "K8S_KUBECONFIG", + "K8S_EXTERNAL_HOST", + "K8S_STORAGE_CLASS", + "K8S_POSTGRES_IMAGE", + "K8S_REDIS_IMAGE", + "K8S_MONGO_IMAGE", + "K8S_NATS_IMAGE", + "K8S_POSTGRES_STORAGE_GI", + "K8S_REDIS_STORAGE_GI", + "K8S_MONGO_STORAGE_GI", + "NATS_HOST", + "MINIO_ENDPOINT", + "MINIO_ROOT_USER", + "MINIO_ROOT_PASSWORD", + "MINIO_BUCKET_NAME", +} + +// clearEnv unsets every config env var for the duration of the test so the +// default arm of every field is what's actually exercised. +func clearEnv(t *testing.T) { + t.Helper() + for _, k := range allConfigEnvKeys { + t.Setenv(k, "") + } +} + +// ── getenv ─────────────────────────────────────────────────────────────────── + +func TestGetenv(t *testing.T) { + t.Run("returns value when set", func(t *testing.T) { + t.Setenv("CFG_TEST_GETENV", "real") + if got := getenv("CFG_TEST_GETENV", "fallback"); got != "real" { + t.Errorf("getenv set = %q; want %q", got, "real") + } + }) + t.Run("returns fallback when empty", func(t *testing.T) { + t.Setenv("CFG_TEST_GETENV", "") + if got := getenv("CFG_TEST_GETENV", "fallback"); got != "fallback" { + t.Errorf("getenv empty = %q; want %q", got, "fallback") + } + }) + t.Run("returns fallback when unset", func(t *testing.T) { + // CFG_TEST_GETENV_UNSET is never set anywhere. + if got := getenv("CFG_TEST_GETENV_UNSET", "fb"); got != "fb" { + t.Errorf("getenv unset = %q; want %q", got, "fb") + } + }) +} + +// ── getenvInt ────────────────────────────────────────────────────────────── + +func TestGetenvInt(t *testing.T) { + t.Run("parses valid integer", func(t *testing.T) { + t.Setenv("CFG_TEST_INT", "42") + if got := getenvInt("CFG_TEST_INT", 7); got != 42 { + t.Errorf("getenvInt valid = %d; want 42", got) + } + }) + t.Run("fallback on empty", func(t *testing.T) { + t.Setenv("CFG_TEST_INT", "") + if got := getenvInt("CFG_TEST_INT", 7); got != 7 { + t.Errorf("getenvInt empty = %d; want 7", got) + } + }) + t.Run("fallback on non-numeric", func(t *testing.T) { + // strconv.Atoi fails → fallback. Covers the err != nil arm. + t.Setenv("CFG_TEST_INT", "not-a-number") + if got := getenvInt("CFG_TEST_INT", 7); got != 7 { + t.Errorf("getenvInt non-numeric = %d; want 7 (fallback)", got) + } + }) + t.Run("fallback on unset", func(t *testing.T) { + if got := getenvInt("CFG_TEST_INT_UNSET", 99); got != 99 { + t.Errorf("getenvInt unset = %d; want 99", got) + } + }) + t.Run("negative integer parses", func(t *testing.T) { + t.Setenv("CFG_TEST_INT", "-1") + if got := getenvInt("CFG_TEST_INT", 7); got != -1 { + t.Errorf("getenvInt negative = %d; want -1", got) + } + }) +} + +// ── Load: default arm ──────────────────────────────────────────────────────── + +func TestLoad_Defaults(t *testing.T) { + clearEnv(t) + cfg := Load() + + checks := []struct { + name string + got string + want string + }{ + {"Port", cfg.Port, "50051"}, + {"PostgresProvisionBackend", cfg.PostgresProvisionBackend, "local"}, + {"PostgresCustomersURL", cfg.PostgresCustomersURL, ""}, + {"PostgresClusterURLs", cfg.PostgresClusterURLs, ""}, + {"NeonAPIKey", cfg.NeonAPIKey, ""}, + {"NeonRegionID", cfg.NeonRegionID, "aws-us-east-1"}, + {"RedisProvisionBackend", cfg.RedisProvisionBackend, "local"}, + {"RedisProvisionHost", cfg.RedisProvisionHost, "localhost:6379"}, + {"MongoProvisionBackend", cfg.MongoProvisionBackend, "local"}, + {"MongoAdminURI", cfg.MongoAdminURI, "mongodb://root:root@localhost:27017"}, + {"MongoHost", cfg.MongoHost, "localhost:27017"}, + {"QueueProvisionBackend", cfg.QueueProvisionBackend, "local"}, + {"ProvisionerSecret", cfg.ProvisionerSecret, ""}, + {"DedicatedPostgresDSN", cfg.DedicatedPostgresDSN, ""}, + {"DedicatedRedisURL", cfg.DedicatedRedisURL, ""}, + {"UpstashAPIKey", cfg.UpstashAPIKey, ""}, + {"ProvisionerDatabaseURL", cfg.ProvisionerDatabaseURL, ""}, + {"AESKey", cfg.AESKey, ""}, + {"K8sKubeconfig", cfg.K8sKubeconfig, ""}, + {"K8sExternalHost", cfg.K8sExternalHost, ""}, + {"K8sStorageClass", cfg.K8sStorageClass, "gp3"}, + {"K8sPostgresImage", cfg.K8sPostgresImage, "postgres:16"}, + {"K8sRedisImage", cfg.K8sRedisImage, "redis:7-alpine"}, + {"K8sMongoImage", cfg.K8sMongoImage, "mongo:7"}, + {"K8sNatsImage", cfg.K8sNatsImage, "nats:2.10-alpine"}, + {"NATSHost", cfg.NATSHost, "localhost"}, + {"MinioEndpoint", cfg.MinioEndpoint, ""}, + {"MinioRootUser", cfg.MinioRootUser, ""}, + {"MinioRootPassword", cfg.MinioRootPassword, ""}, + {"MinioBucketName", cfg.MinioBucketName, "instant-shared"}, + } + for _, c := range checks { + if c.got != c.want { + t.Errorf("%s = %q; want %q", c.name, c.got, c.want) + } + } + + intChecks := []struct { + name string + got int + want int + }{ + {"PoolPostgresSize", cfg.PoolPostgresSize, 10}, + {"PoolRedisSize", cfg.PoolRedisSize, 10}, + {"PoolMongoSize", cfg.PoolMongoSize, 10}, + {"PoolQueueSize", cfg.PoolQueueSize, 10}, + {"K8sPostgresStorageGi", cfg.K8sPostgresStorageGi, 50}, + {"K8sRedisStorageGi", cfg.K8sRedisStorageGi, 10}, + {"K8sMongoStorageGi", cfg.K8sMongoStorageGi, 50}, + } + for _, c := range intChecks { + if c.got != c.want { + t.Errorf("%s = %d; want %d", c.name, c.got, c.want) + } + } + + if cfg.K8sDedicatedBackend { + t.Errorf("K8sDedicatedBackend default = true; want false") + } +} + +// ── Load: override arm ─────────────────────────────────────────────────────── + +func TestLoad_Overrides(t *testing.T) { + clearEnv(t) + + t.Setenv("PROVISIONER_PORT", "60000") + t.Setenv("POSTGRES_PROVISION_BACKEND", "neon") + t.Setenv("POSTGRES_CUSTOMERS_URL", "postgres://cust") + t.Setenv("POSTGRES_CLUSTER_URLS", "postgres://c1,postgres://c2") + t.Setenv("NEON_API_KEY", "neon-key") + t.Setenv("NEON_REGION_ID", "aws-eu-west-1") + t.Setenv("REDIS_PROVISION_BACKEND", "upstash") + t.Setenv("REDIS_PROVISION_HOST", "redis.example:6380") + t.Setenv("MONGO_PROVISION_BACKEND", "k8s") + t.Setenv("MONGO_ADMIN_URI", "mongodb://admin:pw@m:27017") + t.Setenv("MONGO_HOST", "m.example:27017") + t.Setenv("QUEUE_PROVISION_BACKEND", "k8s") + t.Setenv("PROVISIONER_SECRET", "shh") + t.Setenv("DEDICATED_POSTGRES_DSN", "postgres://ded") + t.Setenv("DEDICATED_REDIS_URL", "redis://ded") + t.Setenv("UPSTASH_API_KEY", "up-key") + t.Setenv("PROVISIONER_DATABASE_URL", "postgres://prov") + t.Setenv("AES_KEY", "deadbeef") + t.Setenv("POOL_POSTGRES_SIZE", "1") + t.Setenv("POOL_REDIS_SIZE", "2") + t.Setenv("POOL_MONGO_SIZE", "3") + t.Setenv("POOL_QUEUE_SIZE", "4") + t.Setenv("K8S_DEDICATED_BACKEND", "true") + t.Setenv("K8S_KUBECONFIG", "/kube/config") + t.Setenv("K8S_EXTERNAL_HOST", "1.2.3.4") + t.Setenv("K8S_STORAGE_CLASS", "local-path") + t.Setenv("K8S_POSTGRES_IMAGE", "postgres:15") + t.Setenv("K8S_REDIS_IMAGE", "redis:6") + t.Setenv("K8S_MONGO_IMAGE", "mongo:6") + t.Setenv("K8S_NATS_IMAGE", "nats:2.9") + t.Setenv("K8S_POSTGRES_STORAGE_GI", "100") + t.Setenv("K8S_REDIS_STORAGE_GI", "20") + t.Setenv("K8S_MONGO_STORAGE_GI", "200") + t.Setenv("NATS_HOST", "nats.example") + t.Setenv("MINIO_ENDPOINT", "minio:9000") + t.Setenv("MINIO_ROOT_USER", "minioadmin") + t.Setenv("MINIO_ROOT_PASSWORD", "miniopass") + t.Setenv("MINIO_BUCKET_NAME", "my-bucket") + + cfg := Load() + + strChecks := []struct { + name string + got string + want string + }{ + {"Port", cfg.Port, "60000"}, + {"PostgresProvisionBackend", cfg.PostgresProvisionBackend, "neon"}, + {"PostgresCustomersURL", cfg.PostgresCustomersURL, "postgres://cust"}, + {"PostgresClusterURLs", cfg.PostgresClusterURLs, "postgres://c1,postgres://c2"}, + {"NeonAPIKey", cfg.NeonAPIKey, "neon-key"}, + {"NeonRegionID", cfg.NeonRegionID, "aws-eu-west-1"}, + {"RedisProvisionBackend", cfg.RedisProvisionBackend, "upstash"}, + {"RedisProvisionHost", cfg.RedisProvisionHost, "redis.example:6380"}, + {"MongoProvisionBackend", cfg.MongoProvisionBackend, "k8s"}, + {"MongoAdminURI", cfg.MongoAdminURI, "mongodb://admin:pw@m:27017"}, + {"MongoHost", cfg.MongoHost, "m.example:27017"}, + {"QueueProvisionBackend", cfg.QueueProvisionBackend, "k8s"}, + {"ProvisionerSecret", cfg.ProvisionerSecret, "shh"}, + {"DedicatedPostgresDSN", cfg.DedicatedPostgresDSN, "postgres://ded"}, + {"DedicatedRedisURL", cfg.DedicatedRedisURL, "redis://ded"}, + {"UpstashAPIKey", cfg.UpstashAPIKey, "up-key"}, + {"ProvisionerDatabaseURL", cfg.ProvisionerDatabaseURL, "postgres://prov"}, + {"AESKey", cfg.AESKey, "deadbeef"}, + {"K8sKubeconfig", cfg.K8sKubeconfig, "/kube/config"}, + {"K8sExternalHost", cfg.K8sExternalHost, "1.2.3.4"}, + {"K8sStorageClass", cfg.K8sStorageClass, "local-path"}, + {"K8sPostgresImage", cfg.K8sPostgresImage, "postgres:15"}, + {"K8sRedisImage", cfg.K8sRedisImage, "redis:6"}, + {"K8sMongoImage", cfg.K8sMongoImage, "mongo:6"}, + {"K8sNatsImage", cfg.K8sNatsImage, "nats:2.9"}, + {"NATSHost", cfg.NATSHost, "nats.example"}, + {"MinioEndpoint", cfg.MinioEndpoint, "minio:9000"}, + {"MinioRootUser", cfg.MinioRootUser, "minioadmin"}, + {"MinioRootPassword", cfg.MinioRootPassword, "miniopass"}, + {"MinioBucketName", cfg.MinioBucketName, "my-bucket"}, + } + for _, c := range strChecks { + if c.got != c.want { + t.Errorf("%s = %q; want %q", c.name, c.got, c.want) + } + } + + intChecks := []struct { + name string + got int + want int + }{ + {"PoolPostgresSize", cfg.PoolPostgresSize, 1}, + {"PoolRedisSize", cfg.PoolRedisSize, 2}, + {"PoolMongoSize", cfg.PoolMongoSize, 3}, + {"PoolQueueSize", cfg.PoolQueueSize, 4}, + {"K8sPostgresStorageGi", cfg.K8sPostgresStorageGi, 100}, + {"K8sRedisStorageGi", cfg.K8sRedisStorageGi, 20}, + {"K8sMongoStorageGi", cfg.K8sMongoStorageGi, 200}, + } + for _, c := range intChecks { + if c.got != c.want { + t.Errorf("%s = %d; want %d", c.name, c.got, c.want) + } + } + + if !cfg.K8sDedicatedBackend { + t.Errorf("K8sDedicatedBackend with =true; want true") + } +} + +// TestLoad_K8sDedicatedBackend_NonTrueIsFalse asserts only the exact string +// "true" enables the boolean — any other truthy-looking value is false. +func TestLoad_K8sDedicatedBackend_NonTrueIsFalse(t *testing.T) { + clearEnv(t) + for _, v := range []string{"1", "TRUE", "yes", "false", "True"} { + t.Setenv("K8S_DEDICATED_BACKEND", v) + if Load().K8sDedicatedBackend { + t.Errorf("K8S_DEDICATED_BACKEND=%q → true; want false (only exact \"true\")", v) + } + } +} + +// TestLogStartupConfig_DoesNotPanic exercises logStartupConfig directly with a +// populated Config so every slog field reference is covered. Load() already +// calls it on the default + override configs above, but this guards the +// "secret_set"=true arms (non-empty secret fields) explicitly. +func TestLogStartupConfig_DoesNotPanic(t *testing.T) { + cfg := &Config{ + Port: "50051", + PostgresCustomersURL: "set", + NeonAPIKey: "set", + MongoAdminURI: "set", + ProvisionerSecret: "set", + DedicatedPostgresDSN: "set", + DedicatedRedisURL: "set", + UpstashAPIKey: "set", + ProvisionerDatabaseURL: "set", + AESKey: "set", + K8sExternalHost: "set", + MinioEndpoint: "set", + MinioBucketName: "b", + } + // Must not panic; nothing returned to assert on. + logStartupConfig(cfg) +} From 3f668cf7f86c0b41b3c576b5ca5857f562f7eca2 Mon Sep 17 00:00:00 2001 From: Manas Srivastava <[email protected]> Date: Fri, 22 May 2026 21:52:07 +0530 Subject: [PATCH 2/2] ci: drop unused nats service from coverage workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The nats:latest service container failed to initialize in CI (its healthcheck used wget, absent from the minimal image, and GHA services can't pass -js to enable JetStream). No TEST_* env var references it and the queue-backend package coverage is unchanged (96.8%), so the queue tests never connected to it — it was dead weight breaking the job. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/coverage.yml | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 840fc19..8e73fab 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -101,20 +101,6 @@ jobs: --health-timeout 5s --health-retries 10 - nats: - image: nats:latest - ports: - - 4222:4222 - - 8222:8222 - # nats:latest's default entrypoint is `nats-server`; pass -js for - # JetStream and -m 8222 for the HTTP monitor port the queue backend - # health-probes. - options: >- - --health-cmd "wget -q -O- http://127.0.0.1:8222/healthz || exit 1" - --health-interval 5s - --health-timeout 5s - --health-retries 10 - # TEST_* env vars the pool/backend test helpers read via os.Getenv. The # exact names were grepped from the test files (os.Getenv("TEST_…") and the # liveXxx() helper fallbacks) — wrong names = silent skip = lost coverage.