Skip to content

Sync pgxntool to 2.3.0 - #32

Merged
jnasbyupgrade merged 3 commits into
masterfrom
sync-pgxntool-2.3.0
Aug 5, 2026
Merged

Sync pgxntool to 2.3.0#32
jnasbyupgrade merged 3 commits into
masterfrom
sync-pgxntool-2.3.0

Conversation

@jnasbyupgrade

Copy link
Copy Markdown
Collaborator

Summary

Why this matters for this repo specifically

Two real bugs are fixed in 2.3.0 that are directly relevant to work stacked on top of this branch:

  • Issue #83 ("Fix installcheck running before install"): adds an explicit installcheck: install dependency edge in base.mk. This is the same root cause independently found and filed as Postgres-Extensions/pgxntool-test#62 -- check-stale-expected: installcheck's early edge could resolve installcheck before install ever ran on a genuinely fresh system. Confirmed present: grep -n "installcheck: install" pgxntool/base.mk -> line 326.
  • Issue #48 (DATA wildcard, sql/*--*--*.sql -> sql/*--*.sql): fixes historical single-version install files silently dropping out of make install's DATA list once they're no longer the current version. Doesn't bite test_factory today (only one version, 0.5.0, has ever shipped), but would silently break TEST_LOAD_SOURCE=update testing (added by advanced-testing/foundation, stacked above this branch) the instant a second version ships -- make install would quietly stop installing the old version's SQL file, and an update test would have nothing to CREATE EXTENSION VERSION 'old' from. Worth calling out explicitly since it's not obvious from the pgxntool changelog alone that this repo has any exposure to it yet.

Verification

  • make builds cleanly.
  • make test passes (3/3) on PG17, from a machine where the extension had never been installed before.
  • make verify-results passes cleanly.
  • make pgxntool-version reports 2.3.0.

Test plan

  • make
  • make test on a machine with no prior install
  • make verify-results
  • CI (this PR)

Recreated from #31 (fork-headed) as an upstream-branch PR so it can be part of a formal GitHub stack (gh stack link), which refuses fork PRs. Same content/commits, same CI results.

a6d3287 Release 2.3.0 (#89)
1a7ee20 CLAUDE.md: fix pre-existing documentation-accuracy errors (#88)
35fd187 Fix DATA wildcard skipping historical full-install version scripts (#48) (#80)
f9ce2a2 Fix installcheck running before install; make test now fails on regressions (#83)
3ceb930 Rename PGTLE_VERSION to PGXNTOOL_PGTLE_VERSION (#85)
2de8429 claude-code-review.yml: add missing --comment flag (#84)
957bdf6 Restrict @claude mention trigger to a trusted account (#82)
b67064b Release 2.2.0 (#77)
d949d6d Fix stale README/CLAUDE.md docs; rename internal-only test shim (#76)
6d7822c ci: grant actions:write so bun cache save succeeds (#75)
2738f59 README.asc: fix stale docs, document undocumented API surface (#74)
d1d3bee Add make pgxntool-version to print the embedded pgxntool version (#73)
493a0f8 Fix parallel-build SQL corruption, remote hardcoding, and add safety checks (#61)
3b0e3de Fix make pgtle PGTLE_VERSION=X being silently ignored (#66)
21b35ef ci: skip paired-test-PR requirement for doc-only PRs (#71)
55efd03 Rename EXTENSION_VERSION_FILES to EXTENSION__CURRENT_VERSION__FILES (#69)
9d0a856 Fix pgtle.sh rejecting non-numeric version aliases like 'stable' (#57) (#63)
9c2f75f Docs: versioned SQL file tracking tradeoffs and update-testing pattern (#60)
c38cf2a ci: never check out fork PR head in claude-code-review pull_request_target job (#70)
aab8f2b pgtle_versions.md: fix wrong uninstall_extension() version claim (#59)
e2c9174 README.asc: make tag creates a git tag, not a branch (#58)
eb84bc6 Stamp 2.1.0
9fbe6f4 Fix results ordering, control file whitespace, ENABLE_* override, debug levels (#31)
88bb4f2 Add Claude Code GitHub Actions workflows (#41)
af5bbbb ci: pass repo owners to run-tests.yml for fork-account matching (#40)
c7928af Fix repo-root guard to work inside a git worktree (#39)
b062fca ci: point reusable test workflow at @master
b6cdbfd Add CI workflows and multi-session PR guard (#33)
1ba0987 Stamp 2.0.3
1931cbe Fix pgxntool-sync remote and make it runnable without make (#37)
8176304 Stamp 2.0.2
3e142ab Fix parse_control_file: remove comments before stripping quotes (#27)
cacc301 Stamp 2.0.1
bf1db6b Fix bash 3.2 / Linux compatibility issues (#26)
62d0fcb Fix broken ifeq for --load-language=plpgsql on PG < 13 (#24)
121f0b3 Stamp 2.0.0
ad3ca7e Remove .source support; add test/install, test/build, and verify-results (#18)
c010cf8 Fix bash 3.2 compatibility (#23)
abeb9d3 Remove .source file support from pg_regress integration (#22)
08c1879 Stamp 1.1.2
6e0dad2 Fix double --dbname bug that defeated unique test database names
639756c Stamp 1.1.1
6ba3176 Fix pg_tle exception handler and empty upgrade files (#15)
3b8cb2a Stamp 1.1.0
550a901 Remove commit.md (maintained in pgxntool-test)
d73ca93 Add unique test database names to prevent conflicts (#13)
9b344be Add update-setup-files.sh for 3-way merging after pgxntool-sync (#12)
ab7f6e2 Stamp 1.0.0
3a571ba Add pg_tle support and modernize test infrastructure (#11)
b96ea6d Add support for Claude code; build and doc improvements (#9)
e9c24de Fix pg_regress on versions > 12 (#5)
REVERT: bed3604 Fix pg_regress on versions > 12 (#5) (#6)

git-subtree-dir: pgxntool
git-subtree-split: a6d3287e879c45aa0c9a32c6f9513312396c8915
…release

# Conflicts:
#	pgxntool/CLAUDE.md
#	pgxntool/HISTORY.asc
#	pgxntool/README.asc
#	pgxntool/README.html
#	pgxntool/base.mk
@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 331a6595-0581-4f59-b081-4ffec936c352

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

jnasbyupgrade added a commit to jnasbyupgrade/test_factory that referenced this pull request Aug 5, 2026
…orkflows

claude-code-review.yml's "Check out PR head" step has been failing on every
fork-headed PR all session ("Refusing to check out fork pull request code
from a 'pull_request_target' workflow") -- actions/checkout v4.4.0+
(backported to every floating major tag, including the @v4 this workflow
was pinned to) added a default-on refusal to check out a fork PR's head
under pull_request_target, requiring an explicit opt-in
(allow-unsafe-pr-checkout: true). This had been treated as a pre-existing,
unrelated failure; it is not -- it's a real, fixable gap.

Safe to opt in here specifically because both halves of the required
two-layer defense already hold: the job's trust gate
(head.repo.owner.login == 'jnasbyupgrade') restricts this to PRs from the
trusted fork only, and the checked-out code is read-only from there on
(persist-credentials: false, fed only to the review action, never built or
executed). Added allow-unsafe-pr-checkout: true, and strengthened the
trust-gate's own comment to a loud, unmissable warning -- once this flag is
set, that condition is the entire security boundary between an arbitrary
external fork and this job's secrets + a checked-out copy of that fork's
code, so a future edit that loosens it must not be able to do so quietly.

Also bumped actions/checkout@v4 -> @v7 on both claude-code-review.yml and
claude.yml (the Node.js-20-deprecation-warning fix requested for these two
files specifically; claude.yml doesn't need allow-unsafe-pr-checkout since
its checkout step never targets a fork's PR head at all -- it's triggered
by issue_comment/pull_request_review*, not pull_request_target, and checks
out the plain default ref).

Verification note (structural limitation, not a gap in this PR): this PR's
OWN claude-review check cannot demonstrate this fix -- pull_request_target
always runs the workflow file from the PR's base branch, never the PR's own
copy, and separately, all of PRs Postgres-Extensions#32-35 are upstream-headed (not
jnasbyupgrade-fork-headed), so the trust gate itself evaluates false and the
job shows "skipping" regardless of this fix. Real verification only happens
on a subsequent fork-headed PR (the normal PR pattern for this repo) whose
base branch already includes this commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@jnasbyupgrade
jnasbyupgrade marked this pull request as ready for review August 5, 2026 23:13
@jnasbyupgrade
jnasbyupgrade merged commit 72ee082 into master Aug 5, 2026
31 checks passed
@jnasbyupgrade
jnasbyupgrade deleted the sync-pgxntool-2.3.0 branch August 5, 2026 23:13
jnasbyupgrade added a commit that referenced this pull request Aug 5, 2026
…orkflows

claude-code-review.yml's "Check out PR head" step has been failing on every
fork-headed PR all session ("Refusing to check out fork pull request code
from a 'pull_request_target' workflow") -- actions/checkout v4.4.0+
(backported to every floating major tag, including the @v4 this workflow
was pinned to) added a default-on refusal to check out a fork PR's head
under pull_request_target, requiring an explicit opt-in
(allow-unsafe-pr-checkout: true). This had been treated as a pre-existing,
unrelated failure; it is not -- it's a real, fixable gap.

Safe to opt in here specifically because both halves of the required
two-layer defense already hold: the job's trust gate
(head.repo.owner.login == 'jnasbyupgrade') restricts this to PRs from the
trusted fork only, and the checked-out code is read-only from there on
(persist-credentials: false, fed only to the review action, never built or
executed). Added allow-unsafe-pr-checkout: true, and strengthened the
trust-gate's own comment to a loud, unmissable warning -- once this flag is
set, that condition is the entire security boundary between an arbitrary
external fork and this job's secrets + a checked-out copy of that fork's
code, so a future edit that loosens it must not be able to do so quietly.

Also bumped actions/checkout@v4 -> @v7 on both claude-code-review.yml and
claude.yml (the Node.js-20-deprecation-warning fix requested for these two
files specifically; claude.yml doesn't need allow-unsafe-pr-checkout since
its checkout step never targets a fork's PR head at all -- it's triggered
by issue_comment/pull_request_review*, not pull_request_target, and checks
out the plain default ref).

Verification note (structural limitation, not a gap in this PR): this PR's
OWN claude-review check cannot demonstrate this fix -- pull_request_target
always runs the workflow file from the PR's base branch, never the PR's own
copy, and separately, all of PRs #32-35 are upstream-headed (not
jnasbyupgrade-fork-headed), so the trust gate itself evaluates false and the
job shows "skipping" regardless of this fix. Real verification only happens
on a subsequent fork-headed PR (the normal PR pattern for this repo) whose
base branch already includes this commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant