chores(x2a): run local tests against PostgreSQL

[mareklibra]

This change adds yarn test:pg script to run our unit tests against both the SQLite and PostgreSQL locally, aligned with the CI.

[rhdh-qodo-merge]

Review Summary by Qodo

Enable local PostgreSQL testing with testcontainers

✨ Enhancement

Walkthroughs

Description

• Add PostgreSQL testing capability to local development workflow
• Create yarn test:pg and yarn test:all:pg scripts with CI=true flag
• Add PostgreSQL container startup script for testcontainers support
• Document PostgreSQL testing setup and Podman configuration

Diagram

flowchart LR
  A["yarn test:pg<br/>CI=true"] --> B["testcontainers<br/>enabled"]
  B --> C["postgres:18<br/>container"]
  C --> D["SQLite + PostgreSQL<br/>tests"]
  E["start-test-postgres.sh<br/>script"] --> F["Manual container<br/>management"]
  G["README documentation"] --> H["User guidance<br/>& setup"]

Loading

File Changes

1. workspaces/x2a/scripts/start-test-postgres.sh ✨ Enhancement +42/-0

PostgreSQL container startup script

• New bash script to start disposable PostgreSQL 18 container for local testing
• Detects and uses either Docker or Podman runtime automatically
• Configurable port via X2A_TEST_POSTGRES_PORT environment variable
• Waits for PostgreSQL to accept connections before returning connection string

workspaces/x2a/scripts/start-test-postgres.sh

---

2. workspaces/x2a/README.md 📝 Documentation +31/-1

Document PostgreSQL testing setup and commands

• Add new "Running Tests with PostgreSQL" section explaining testcontainers approach
• Document yarn test:pg and yarn test:all:pg commands for SQLite + PostgreSQL testing
• Provide Fedora/RHEL Podman socket configuration instructions
• Update command list to clarify yarn test runs SQLite only

workspaces/x2a/README.md

---

3. workspaces/x2a/package.json ✨ Enhancement +3/-1

Add PostgreSQL test scripts with CI flag

• Add test:pg script that sets CI=true to enable testcontainers
• Add test:all:pg script combining linting, formatting, coverage with PostgreSQL
• Update chores script to use test:all:pg instead of test:all
• Update lint:all reference in chores to lint:all:pg

workspaces/x2a/package.json

---

View more (1)

4. workspaces/x2a/plugins/x2a-backend/package.json ✨ Enhancement +2/-0

Add PostgreSQL test scripts to backend plugin

• Add test:pg script with CI=true flag for PostgreSQL testcontainers
• Add test:all:pg script with coverage and PostgreSQL support
• Preserve existing NODE_OPTIONS='--experimental-vm-modules' configuration

workspaces/x2a/plugins/x2a-backend/package.json

---

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (3) 📘 Rule violations (0) 📎 Requirement gaps (0)

1. Broken chores lint script 🐞 Bug ≡ Correctness

Description

workspaces/x2a/package.json updates chores to run yarn lint:all:pg --fix, but no lint:all:pg
script exists in that workspace. yarn chores will fail immediately with an unknown script error.

Code

workspaces/x2a/package.json[31]

+    "chores": "yarn prettier:fix && yarn lint:all:pg --fix && yarn tsc:full && yarn build:api-reports && yarn test:all:pg",

Evidence

The chores script references lint:all:pg, while the scripts section defines only lint and
lint:all (no lint:all:pg).

workspaces/x2a/package.json[26-32]
workspaces/x2a/package.json[27-31]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`yarn chores` calls a non-existent script (`lint:all:pg`), so the command will fail.

### Issue Context
The workspace defines `lint` and `lint:all`, but not `lint:all:pg`.

### Fix Focus Areas
- workspaces/x2a/package.json[26-32]

### Suggested fix
Update `chores` to call an existing lint script (likely `yarn lint:all --fix`), or add a `lint:all:pg` script if you truly need a separate lint target.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. No readiness failure exit 🐞 Bug ☼ Reliability

Description

start-test-postgres.sh retries pg_isready for 30 seconds but never fails if Postgres still isn’t
ready at the end of the loop. The script still prints the export command, leading to confusing
downstream test failures against a non-ready database.

Code

workspaces/x2a/scripts/start-test-postgres.sh[R33-42]

+  >&2 echo "Waiting for PostgreSQL to accept connections …"
+  for _ in $(seq 1 30); do
+    if "$runtime" exec "$CONTAINER_NAME" pg_isready -U postgres &>/dev/null; then
+      break
+    fi
+    sleep 1
+  done
+fi
+
+echo "export BACKSTAGE_TEST_DATABASE_POSTGRES18_CONNECTION_STRING=\"postgresql://postgres:${POSTGRES_PASSWORD}@localhost:${HOST_PORT}/postgres\""

Evidence

The loop breaks on success but has no check/exit path after retries; the script proceeds to output
the connection-string export regardless. This matters because tests are explicitly set up to run
against POSTGRES_18 when it’s supported.

workspaces/x2a/scripts/start-test-postgres.sh[33-42]
workspaces/x2a/plugins/x2a-backend/src/testUtils/testHelpers.ts[39-49]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The script waits for Postgres readiness but doesn’t fail if readiness never happens, so it can report success while the DB is unusable.

### Issue Context
`set -e` doesn’t help here because the retry loop completes normally after 30 iterations.

### Fix Focus Areas
- workspaces/x2a/scripts/start-test-postgres.sh[33-42]

### Suggested fix
Track readiness with a flag and `exit 1` if Postgres never becomes ready, e.g.:
- set `ready=false`
- set `ready=true` when `pg_isready` succeeds
- after the loop, if not ready: print an error to stderr, optionally stop the container you started, and exit non-zero.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Unsafe eval export output 🐞 Bug ⛨ Security

Description

start-test-postgres.sh recommends eval "$(...)" and emits a shell command that interpolates
env-derived values (notably X2A_TEST_POSTGRES_PORT). If that env var contains shell metacharacters
(e.g., 5433; rm -rf ~), those can be executed when the output is eval’d.

Code

workspaces/x2a/scripts/start-test-postgres.sh[R4-42]

+# Usage:
+#   eval "$(./scripts/start-test-postgres.sh)"
+#   yarn test          # now runs against the external PostgreSQL instance
+#
+# The container is removed automatically when stopped:
+#   podman stop x2a-test-postgres   # or: docker stop x2a-test-postgres
+
+set -euo pipefail
+
+CONTAINER_NAME="x2a-test-postgres"
+POSTGRES_PASSWORD="testpassword"
+HOST_PORT="${X2A_TEST_POSTGRES_PORT:-5433}"
+IMAGE="${BACKSTAGE_TEST_DOCKER_REGISTRY:-}postgres:18"
+
+runtime="docker"
+if command -v podman &>/dev/null && ! command -v docker &>/dev/null; then
+  runtime="podman"
+fi
+
+if "$runtime" ps --format '{{.Names}}' 2>/dev/null | grep -qx "$CONTAINER_NAME"; then
+  >&2 echo "Container '$CONTAINER_NAME' is already running on port $HOST_PORT."
+else
+  >&2 echo "Starting PostgreSQL 18 container '$CONTAINER_NAME' on port $HOST_PORT …"
+  "$runtime" run -d --rm \
+    --name "$CONTAINER_NAME" \
+    -e POSTGRES_PASSWORD="$POSTGRES_PASSWORD" \
+    -p "${HOST_PORT}:5432" \
+    "$IMAGE" >/dev/null
+
+  >&2 echo "Waiting for PostgreSQL to accept connections …"
+  for _ in $(seq 1 30); do
+    if "$runtime" exec "$CONTAINER_NAME" pg_isready -U postgres &>/dev/null; then
+      break
+    fi
+    sleep 1
+  done
+fi
+
+echo "export BACKSTAGE_TEST_DATABASE_POSTGRES18_CONNECTION_STRING=\"postgresql://postgres:${POSTGRES_PASSWORD}@localhost:${HOST_PORT}/postgres\""

Evidence

The script explicitly documents eval "$(...)" usage and constructs an export ... line by
interpolating HOST_PORT (derived from X2A_TEST_POSTGRES_PORT) directly into the emitted shell
snippet.

workspaces/x2a/scripts/start-test-postgres.sh[4-7]
workspaces/x2a/scripts/start-test-postgres.sh[15-16]
workspaces/x2a/scripts/start-test-postgres.sh[42-42]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The script’s recommended usage relies on `eval`, but the emitted command is built from environment-derived values without validation/escaping.

### Issue Context
Even though this is a local-dev helper, it’s easy to harden at low cost:
- validate `HOST_PORT` is numeric
- print shell-escaped exports rather than embedding untrusted text in an `eval` string

### Fix Focus Areas
- workspaces/x2a/scripts/start-test-postgres.sh[4-7]
- workspaces/x2a/scripts/start-test-postgres.sh[15-16]
- workspaces/x2a/scripts/start-test-postgres.sh[42-42]

### Suggested fix
Option A (keep eval, but harden):
- Validate port: `[[ "$HOST_PORT" =~ ^[0-9]+$ ]] || { echo "Invalid port" >&2; exit 1; }`
- Build the connection string in a variable and print with shell-escaping:
 - `conn="postgresql://..."`
 - `printf 'export BACKSTAGE_TEST_DATABASE_POSTGRES18_CONNECTION_STRING=%q\n' "$conn"`

Option B (avoid eval):
- Change docs to recommend sourcing: `source scripts/start-test-postgres.sh` and have the script perform the `export` directly when sourced.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[rhdh-gh-app]

Missing Changesets

The following package(s) are changed by this PR but do not have a changeset:

• @red-hat-developer-hub/backstage-plugin-x2a-backend

See CONTRIBUTING.md for more information about how to add changesets.

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@red-hat-developer-hub/backstage-plugin-x2a-backend	workspaces/x2a/plugins/x2a-backend	none	v1.2.0

[rhdh-qodo-merge]

1. Broken chores lint script 🐞 Bug ≡ Correctness

workspaces/x2a/package.json updates chores to run yarn lint:all:pg --fix, but no lint:all:pg
script exists in that workspace. yarn chores will fail immediately with an unknown script error.

Agent Prompt

### Issue description
`yarn chores` calls a non-existent script (`lint:all:pg`), so the command will fail.

### Issue Context
The workspace defines `lint` and `lint:all`, but not `lint:all:pg`.

### Fix Focus Areas
- workspaces/x2a/package.json[26-32]

### Suggested fix
Update `chores` to call an existing lint script (likely `yarn lint:all --fix`), or add a `lint:all:pg` script if you truly need a separate lint target.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud