Move CI provisioning from v1 workspaces to v2 clusters

[kesmit13]

Retargets the CI provisioning scripts and workflows from the v1
workspace-group flow at v2 clusters, which is what management.version
already defaults to.

Provisioning

resources/create_test_cluster.py is now a single manage_clusters() /
create_cluster() call. wait_on_active=True covers ACTIVE, then the
endpoint, then the firewall, which replaces both polling loops and a bare
time.sleep(10). --expires was parsed and then never used, so CI
clusters had no expiry at all; it is wired to expires_at now.
resources/drop_test_cluster.py takes a cluster ID and terminates it.

The admin password needs care. POST /v2/clusters accepts an
adminPassword and ignores it, generating its own, and PATCH does the
same, so the password can only be read off the create response and is
None after any refresh. That value cannot reach a consuming job: it has
to be masked, and the runner drops any output whose value matches a mask
-- "Skip output 'cluster-password' since it may contain secret" -- so
masking it and passing it between jobs are mutually exclusive.

So the generated password is traded for secrets.CLUSTER_PASSWORD over
SQL, once, while the script still holds it: ALTER USER 'admin'@'%' IDENTIFIED BY ... (SET PASSWORD wants a pre-hashed value and rejects a
literal with 1372: Password hash should be a 41-digit hexadecimal number). No password is reported at all after that, and every consuming
job reads the secret it already had. Keeping the credential a secret
rather than a job output is also why SINGLESTOREDB_URL interpolates it
raw: a percent-encoded copy is a different string from the mask, so
emitting one would put a live credential past the runner's masking. The
secret is maintainer-set, so keeping it alphanumeric is a cheaper
constraint than that; both consuming sites say so.

The ID, host, port and database name are reported as soon as
create_cluster() returns, before that password reset and before the SQL
load. Both can fail against a cluster that is already running and already
billing, and a teardown job with an empty cluster-id would send its
DELETE to /v2/clusters/ and leak it. The two shutdown steps refuse an
empty ID outright now.

secrets.CLUSTER_USER and vars.CLUSTER_PROJECT are gone. A cluster has
exactly one user, admin, and no route creates another, so the secret
could only ever hold that value; the project is named in the workflow so
the deployment target is visible next to the create call. Once this
merges, CLUSTER_USER can be deleted from repository settings.

A datetime bug this uncovered

expires_at read back as None on a cluster that demonstrably had an
expiry set. expiresAt is the one field the API returns in Go's
time.Time.String() format -- 2026-09-17 14:42:41.445984 +0000 UTC --
while every other timestamp is RFC 3339. to_datetime split on . to
pad the fraction, produced 445984 +0000 UTC, and parsing returned
None. Pre-existing, and it also left the expiry column blank in
SHOW CLUSTERS. Fixed with tests for both shapes.

Accepting that shape then exposed its zero value: an unset Go
time.Time renders as 0001-01-01 00:00:00 +0000 UTC, and only the
RFC 3339 spelling of that sentinel was recognized, so a resource that
does not expire reported an expiry in year 1. Both to_datetime and
to_datetime_strict now test the parsed value for January 1 of year 1,
which covers every spelling, and do it before the UTC shift, which can
fall below MINYEAR on a year-1 value.

Workflow linting

There was no linter over .github/workflows/, so nothing checked
expression syntax, needs.*.outputs.* references or the shell in run:
blocks. actionlint is now a pre-commit hook -- a pip wrapper, so no Go
toolchain or Docker -- and the 17 pre-existing findings it reported are
fixed: stale action majors, a step named after ${{ matrix.python-version }} in a job whose matrix only defines os, and
six unquoted $GITHUB_OUTPUT redirects.

Every action pin is also off the Node.js 20 runtime now. The first pass
bumped to checkout@v4 / setup-python@v5, which satisfied actionlint
but still declared node20; the pins are the lowest major of each action
that declares node24, read from action.yml at the tag. Verified by the
run annotations disappearing between 6c22959 and 8828326.

Verified

• pre-commit clean, including actionlint on all six workflows, on 3.9-3.13
• live create: ACTIVE in 5:54, test.sql loaded, expires_at exactly
  1h after created_at
• test_basics against that cluster: 30 passed, 2 skipped
• live teardown both ways: drop_test_cluster.py to TERMINATED in 2.8s,
  and the workflow's curl DELETE /v2/clusters/{id}?force=true returning
  200. No clusters leaked
• marker partition exact: 905 selected + 65 deselected = 970
• the zero-time sentinel in both shapes and both helpers, by unit test

Not verified

The reordered reporting block is not covered by a test, and the live
create above predates it. The publish.yml artifact-action bumps only
execute on a tag or release, so they land untested here.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes CI cluster lifecycle, credential handling, and release smoke paths against live cloud APIs; datetime parsing affects all management clients reading cluster expiry.

Overview
Retargets live CI from the deprecated v1 workspace-group API to v2 clusters, updating create_test_cluster.py and drop_test_cluster.py to use manage_clusters() / create_cluster() with project selection, cluster naming rules, expires_at, and an ALTER USER step so jobs can keep using a known CLUSTER_PASSWORD (the API ignores adminPassword). Workflows now connect as admin, tear down via DELETE /v2/clusters/{id}?force=true, and pass secrets through env vars where shell interpolation would leak them.

Fixes management timestamp parsing so expiresAt from GET /v2/clusters/{id} (Go time.Time.String() form) no longer becomes None; to_datetime normalizes RFC 3339 and Go shapes and returns naive UTC, with new unit tests.

Partitions deprecated v1 tests: PR/coverage runs use -m 'not management_v1'; coverage.yml adds a nightly management-v1-tests job for -m 'management_v1'. code-check.yml uses full git history (fetch-depth: 0) so change detection against origin/main works on PRs, stops swallowing git diff failures, and bumps Actions pins.

Adds actionlint to pre-commit and upgrades workflow actions (checkout/setup-python v7, artifacts, QEMU). Smoke tests add Python 3.14; docs build rewrites cluster.Stage links like workspace stage.

^{Reviewed by Cursor Bugbot for commit 1378da4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7a0f3ba. Configure here.}

[Copilot]

🟡 Changes recommended

Raw password URLs can fail for valid secrets, and setup failures can leave created clusters without a cleanup ID.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Retargets CI provisioning from v1 workspaces to v2 clusters, while improving timestamp parsing and workflow validation.

Changes:

• Adds v2 cluster creation, expiration, project selection, password setup, and teardown.
• Normalizes RFC 3339 and Go-formatted timestamps with regression tests.
• Updates workflows, action versions, test markers, documentation transforms, and actionlint integration.

File summaries

File	Description
resources/create_test_cluster.py	Creates and initializes v2 test clusters.
resources/drop_test_cluster.py	Terminates clusters by ID.
singlestoredb/management/utils.py	Normalizes management timestamps.
singlestoredb/tests/test_management_utils.py	Tests timestamp parsing behavior.
.github/workflows/smoke-test.yml	Runs v2 cluster smoke tests.
.github/workflows/publish.yml	Uses v2 clusters for wheel tests.
.github/workflows/coverage.yml	Separates v1 nightly coverage.
.github/workflows/code-check.yml	Improves change detection and test selection.
.github/workflows/pre-commit.yml	Updates workflow actions.
.github/workflows/fusion-docs.yml	Updates documentation workflow actions.
.pre-commit-config.yaml	Adds actionlint.
resources/build_docs.py	Normalizes cluster stage links.
singlestoredb/management/v2/cluster.py	Documents ignored admin-password updates.

Review details

Suppressed comments (1)

.github/workflows/smoke-test.yml:154

• The HTTPS matrix uses the same raw password interpolation as the MySQL matrix, so a secret containing +, @, /, ?, #, or % is not the password the client receives after URL parsing. Encode this userinfo component or supply the credential outside the URL rather than relying on an unenforced alphanumeric secret convention.

          SINGLESTOREDB_URL: "${{ matrix.driver }}://admin:${{ secrets.CLUSTER_PASSWORD }}@${{ needs.setup-database.outputs.cluster-host }}:443/${{ needs.setup-database.outputs.cluster-database }}?pure_python=${{ matrix.pure-python }}&buffered=${{ matrix.buffered }}"

• Files reviewed: 13/13 changed files
• Comments generated: 5
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.