Skip to content

test(conformance): take the schema fingerprint from @akalforge/pg-conformance - #196

Merged
jasdeepkhalsa merged 1 commit into
masterfrom
claude/shared-fingerprint
Aug 25, 2026
Merged

jasdeepkhalsa merged 1 commit into
masterfrom
claude/shared-fingerprint

Conversation

@jasdeepkhalsa

Copy link
Copy Markdown
Member

Four separate definitions of "are these schemas the same?" had accumulated across this project and SupaForge, and they had drifted. This is the last of the four still carrying its own.

Depends on @akalforge/pg-conformance@~0.0.1.

What the shared query adds

The one it replaces could not see any of this:

  • view and materialised view bodies
  • routine bodies (it compared signatures only)
  • trigger definitions
  • identity sequence options
  • per-column generated / storage / compression / collation
  • constraint validity and deferrability
  • inheritance, and comments

That blind spot is not theoretical here. The identity-options bug fixed in #195 sat in the baseline as thirteen separate wrong_output entries precisely because the fingerprint could not see sequence options and so mis-attributed one root cause across many patterns.

Conformance still exits 0 on PostgreSQL 17 with the same 15 passes and 5 known unmodelled kinds, so the extra strength costs nothing today.

Better mismatch reports

Reporting used to inspect only $fp['columns'], so a difference in a view body or a partition bound printed schema mismatch with nothing to point at. The fingerprint is now one entry per line, so the report names what actually differs:

expected: view public.v SELECT id FROM t WHERE id > 0;
actual:   view public.v SELECT id FROM t WHERE id < 0;

A silent failure guarded against

getSchemaFingerprint treats a missing fingerprint column as a fault rather than as "no differences". An empty fingerprint would make every comparison succeed, and a fully green run would be indistinguishable from a correct one.

Why npm and not Composer

The package ships a PHP accessor, so composer.json is untouched and no registry credentials are involved — the conformance job runs npm ci and requires the file by path. DBDiff uses node for nothing else, so package.json is explicitly test-only tooling.

Pinned ~0.0.1, not ^0.0.1: under semver a caret on a 0.0.z version permits no updates at all, and npm install silently rewrites a tilde to a caret via its default save-prefix.

Verification

Run against live PostgreSQL 17, and the full suite re-run because the harness is shared rather than Postgres-only:

suite result
Unit 749 tests
MySQL 17 tests
Postgres 47 tests
SQLite 16 tests (1 skipped)
PG conformance exit 0 — 15 pass, 5 known

🤖 Generated with Claude Code

…formance

Four separate definitions of "are these schemas the same?" had accumulated
across this project and SupaForge, and they had drifted. One of them called
two schemas identical when a view's predicate had been inverted, a function
body had been replaced, or a trigger had moved from AFTER INSERT to BEFORE
UPDATE. This was the last of the four still carrying its own.

The shared query is stronger than the one it replaces. It adds view and
materialised view bodies, routine bodies, trigger definitions, identity
sequence options, per-column generated/storage/compression/collation,
constraint validity and deferrability, inheritance and comments — none of
which this harness could previously see. Conformance still exits 0 on
PostgreSQL 17 with the same 15 passes and 5 known unmodelled kinds, so the
extra coverage costs nothing today and closes the gap that let the identity
bug sit in the baseline as thirteen separate "wrong output" entries.

Mismatch reporting improves as a side effect. It used to inspect only
$fp['columns'], so a difference in a view body or a partition bound printed
"schema mismatch" with nothing to point at. The fingerprint is now one entry
per line, so the report names the objects that actually differ.

getSchemaFingerprint treats a missing `fingerprint` column as a fault rather
than as "no differences": an empty fingerprint would make every comparison
succeed, and the failure would look exactly like a clean run.

The package is consumed from npm rather than Composer. It ships a PHP
accessor, so composer.json is untouched and no registry credentials are
needed — the conformance job runs `npm ci` and requires the file by path.
Pinned ~0.0.1, because a caret on a 0.0.z version permits no updates at all
and npm silently rewrites a tilde to a caret on install.

Verified on live PostgreSQL 17, and the full suite re-run because the harness
is shared: Unit 749, MySQL 17, Postgres 47, SQLite 16.

Co-Authored-By: Claude <noreply@anthropic.com>
@github-actions github-actions Bot added bug dependencies Pull requests that update a dependency file mysql Related to Mysql php Pull requests that update php code postgres Related to Postgres sqlite Related to Sqlite labels Aug 25, 2026
@sonarqubecloud

Copy link
Copy Markdown

@jasdeepkhalsa
jasdeepkhalsa merged commit 3fa0196 into master Aug 25, 2026
71 checks passed
jasdeepkhalsa added a commit that referenced this pull request Aug 31, 2026
Closes the loop on the shared conformance data introduced in #196.

## Why this is needed

`npm ci` installs **strictly from the lockfile** and ignores the range
in `package.json`. So the shared package auto-publishing patches, plus
`~0.0.1` here, achieves nothing on its own — the release succeeds and
reaches nobody. Something has to move the lockfile, and dropping `npm
ci` would trade reproducible installs for it.

## Dependabot, not Renovate

Renovate needs a GitHub App installed against the org. Dependabot is
already available and does the same job here. **Allow auto-merge** also
had to be enabled on the repo — that is a permission that lets a PR be
*marked* merge-on-green, not a behaviour that merges anything by itself.

## Scoped twice, deliberately

`dependabot.yml` allows only `@akalforge/pg-conformance` — the sole npm
dependency in what is otherwise a Composer project — and the workflow
independently refuses anything else that reaches it.

Only **patch** updates auto-merge. A minor or major means the
fingerprint changed shape, which is exactly when a human should look.

## Nothing merges blind

`--auto` waits for every required check, including the conformance
matrix across PostgreSQL 16, 17 and 18. An update that broke this
harness leaves the PR open and red rather than landing — and the
upstream package already tests itself against PostgreSQL 14–18 before
publishing, so a bad patch has to get past both.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug dependencies Pull requests that update a dependency file mysql Related to Mysql php Pull requests that update php code postgres Related to Postgres sqlite Related to Sqlite

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant