From e1e072265df1b48076b8ab5735157c6a91c23081 Mon Sep 17 00:00:00 2001
From: jnasbyupgrade <jnasby@upgrade.com>
Date: Tue, 21 Jul 2026 17:48:09 -0500
Subject: [PATCH] ci: add a dedicated pg_tle test job

There was no CI coverage for cat_tools' pgxntool-generated pg_tle
(Trusted Language Extensions) deployment path, so a regression there
(e.g. in the generated registration SQL) could ship unnoticed. This
adds a pg-tle-test job that builds pg_tle from source, registers
cat_tools with it via `make run-pgtle`, and verifies the extension
installs and works correctly with no filesystem control file present
-- i.e. purely through pg_tle's database-backed registration.

The job always runs on its own freshly-started cluster, never shared
with the other jobs in this workflow: pg_tle requires
shared_preload_libraries and mixing pg_tle/non-pg_tle extension
installs on one cluster can misbehave.

The matrix covers PG 12-18, matching pg_tle 1.5.2's supported range
per pgxntool/pgtle_versions.md (PG10/11 predate pg_tle support).

This intentionally stops at a smoke test rather than running the full
pg_regress/pgTap suite through pg_tle: pg_regress always creates its
test database from the pristine template0, so any pre-registration
done in another database (e.g. postgres or template1) is invisible to
it. Routing the full suite through pg_tle would require adding
registration SQL into test/install/*.sql, which runs inside every
job's pg_regress invocation (not just this one) and would need
conditional logic to avoid affecting the other, non-pg_tle jobs --
more invasive than this task calls for.
---
 .github/workflows/ci.yml | 61 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 60 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5b622c5..0273086 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -312,6 +312,65 @@ jobs:
         if: matrix.pg != '10'
         run: bin/test_existing update-scenario cat_tools_update 0.2.2
 
+  pg-tle-test:
+    needs: [changes]
+    if: needs.changes.outputs.docs_only != 'true'
+    strategy:
+      matrix:
+        # 1.5.2 is what AWS RDS for PostgreSQL 17 currently ships (RDS PG17.7+,
+        # our primary deployment target -- see
+        # https://docs.aws.amazon.com/AmazonRDS/latest/PostgreSQLReleaseNotes/postgresql-versions.html).
+        # It also supports PostgreSQL 12-18 (see pgxntool/pgtle_versions.md);
+        # PG10/11 are excluded because pg_tle doesn't support them.
+        pg: [18, 17, 16, 15, 14, 13, 12]
+    name: 🧩 pg_tle ${{ matrix.pg }}
+    runs-on: ubuntu-latest
+    container: pgxn/pgxn-tools
+    env:
+      PGTLE_VERSION: "1.5.2"
+    steps:
+      # A dedicated cluster, never shared with the other jobs in this
+      # workflow: pg_tle requires shared_preload_libraries and mixing
+      # pg_tle/non-pg_tle extension installs on one cluster can misbehave.
+      - name: Start PostgreSQL ${{ matrix.pg }}
+        run: pg-start ${{ matrix.pg }}
+      - name: Check out the repo
+        uses: actions/checkout@v6
+      - name: Install rsync
+        run: apt-get install -y rsync
+      - name: Build and install pg_tle ${{ env.PGTLE_VERSION }}
+        # flex/bison/libkrb5-dev aren't in the pgxn-tools image; pg_tle's build
+        # needs them (guc-file.l, and clientauth.c includes gssapi.h).
+        run: |
+          apt-get install -y flex bison libkrb5-dev
+          git clone --branch v${{ env.PGTLE_VERSION }} --depth 1 https://github.com/aws/pg_tle.git /tmp/pg_tle
+          make -C /tmp/pg_tle install
+      - name: Enable pg_tle and restart PostgreSQL ${{ matrix.pg }}
+        run: |
+          echo "shared_preload_libraries = 'pg_tle'" >> /etc/postgresql/${{ matrix.pg }}/test/postgresql.conf
+          pg_ctlcluster ${{ matrix.pg }} test restart
+          pg_isready -t 30
+      - name: Create pg_tle extension
+        run: psql -c "CREATE EXTENSION pg_tle"
+      - name: Register cat_tools with pg_tle
+        run: make run-pgtle
+      - name: Install cat_tools purely via pg_tle (no filesystem install)
+        # cat_tools is never `make install`ed in this job, so a successful
+        # CREATE EXTENSION here can only be resolving through pg_tle's
+        # registration, not a control file on disk.
+        run: |
+          test ! -e /usr/share/postgresql/${{ matrix.pg }}/extension/cat_tools.control
+          psql -c "CREATE EXTENSION cat_tools"
+      - name: Verify cat_tools works when deployed via pg_tle
+        run: |
+          INSTALLED=$(psql -tAc "SELECT extversion FROM pg_extension WHERE extname = 'cat_tools'")
+          EXPECTED=$(make -s print-PGXNVERSION 2>/dev/null | sed -n 's/.*set to "\(.*\)"$/\1/p')
+          echo "installed=$INSTALLED expected=$EXPECTED"
+          if [ -z "$INSTALLED" ] || [ -z "$EXPECTED" ] || [ "$INSTALLED" != "$EXPECTED" ]; then
+            echo "FAIL: installed='$INSTALLED' expected='$EXPECTED'"; exit 1
+          fi
+          psql -v ON_ERROR_STOP=1 -c "SELECT relname FROM cat_tools.pg_class_v LIMIT 1" > /dev/null
+
   # A single stable check name for use as a required status check in branch
   # protection rules. Matrix jobs produce check names like "🐘 PostgreSQL 14"
   # which would all need to be listed individually and updated whenever the
@@ -319,7 +378,7 @@ jobs:
   # the heavy jobs gated off by the `changes` job on a docs-only push), and
   # fails if any failed or were cancelled.
   all-checks-passed:
-    needs: [changes, test, pg-upgrade-test, extension-update-test]
+    needs: [changes, test, pg-upgrade-test, extension-update-test, pg-tle-test]
     if: always()
     runs-on: ubuntu-latest
     steps: