fix(db): Resolve the execution table through search_path in the revision guard by bupd · Pull Request #929 · container-registry/harbor-next

bupd · 2026-09-16T07:10:41Z

Follow-up to #924, which merged before the cubic bot's review comment on it was addressed. The finding is valid, so it is fixed here rather than on the merged branch.

What broke

The guard #924 added tests information_schema against current_schema(), which is only the first entry in search_path. If a connection's search_path puts another schema first and execution lives in a later one, the guard reads false while the unqualified ALTER TABLE execution below it resolves to that later table. The widening is skipped silently and execution.revision stays integer.

What changed

Resolve the relation with to_regclass and read its type from pg_attribute, so the guard and the ALTER always agree on which table they mean. to_regclass returns NULL when no execution table is reachable, which leaves the guard false exactly as before.

How it was verified

Both predicates run against the same two-schema setup, search_path = first_schema, later_schema with execution in the later one:

 OLD guard sees: | f     <- skips the widening
 NEW guard sees: | t     <- widens correctly

Applying the block twice in that layout lands on bigint both times, so the guard stays idempotent:

 after 1st: | bigint
 after 2nd: | bigint

go test -tags db ./migration/ -run TestAuthoritativeSchemaAgainstPostgreSQL passes.

coderabbitai · 2026-09-16T07:10:49Z

Warning

Review limit reached

Next included review available in 30 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 67752fcb-97cb-4bec-87e1-60304b4a9647

📥 Commits

Reviewing files that changed from the base of the PR and between 4f01b71 and 8e01e5e.

📒 Files selected for processing (2)

make/migrations/postgresql/harbor_next.sql
src/migration/authoritative_db_test.go

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-16T07:12:40Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

github-actions · 2026-09-16T07:12:48Z

This change may need patch-release backports. Comment with one of these commands to open a cherry-pick PR:

/backport v2.15

Copilot

🟡 Changes recommended

Add coverage for search_path = first_schema, later_schema with execution only in the later schema.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Fixes the PostgreSQL revision guard so execution resolves consistently through search_path.

Changes:

Uses to_regclass and pg_attribute for relation/type detection.
Preserves idempotent widening to bigint.

File summaries

File	Summary
`make/migrations/postgresql/harbor_next.sql`	Corrects relation resolution; a moderate finding remains that the two-schema regression scenario lacks test coverage.

Review details

Files reviewed: 1/1 changed files
Comments generated: 1
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

cubic-dev-ai

All reported issues were addressed across 1 file

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="make/migrations/postgresql/harbor_next.sql">

<violation number="1" location="make/migrations/postgresql/harbor_next.sql:164">
P3: The new domain-preserving guard branch is untested. Add cases for a domain over `bigint`, which must remain unchanged, and a domain over `integer`, which must widen without losing the intended behavior.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai · 2026-09-16T07:30:41Z

+          AND a.attname = 'revision'
+          AND a.attnum > 0
+          AND NOT a.attisdropped
+          AND CASE WHEN t.typtype = 'd' THEN t.typbasetype ELSE a.atttypid END


P3: The new domain-preserving guard branch is untested. Add cases for a domain over bigint, which must remain unchanged, and a domain over integer, which must widen without losing the intended behavior.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At make/migrations/postgresql/harbor_next.sql, line 164: <comment>The new domain-preserving guard branch is untested. Add cases for a domain over `bigint`, which must remain unchanged, and a domain over `integer`, which must widen without losing the intended behavior.</comment> <file context> @@ -143,14 +143,26 @@ BEGIN AND a.attnum > 0 AND NOT a.attisdropped - AND a.atttypid <> 'bigint'::regtype + AND CASE WHEN t.typtype = 'd' THEN t.typbasetype ELSE a.atttypid END + <> 'bigint'::regtype ) THEN </file context>

…ion guard The guard added in #924 tested information_schema against current_schema(), which is only the first entry in search_path. On a connection whose search_path puts another schema first, an execution table in a later schema makes the predicate false while the unqualified ALTER below it resolves to that same later table, so the widening is skipped without a word and execution.revision silently stays integer. Resolve the relation with to_regclass and read its type from pg_attribute, so the guard and the ALTER always agree on which table they are talking about. to_regclass returns NULL when no execution relation is reachable, which leaves the guard false as before. Two narrower cases came out of review. to_regclass resolves any relation, so the guard is restricted to tables by relkind: an index named execution earlier in search_path would otherwise match a pg_attribute row and send ALTER TABLE at something it cannot alter, failing the whole file. And the column type is compared after resolving a domain to its base, so a column already typed as a domain over bigint keeps the domain and its CHECK constraints instead of having them stripped by the ALTER. Covered by two tests against a real Postgres: execution in a schema that is not first in search_path is widened and its rows preserved on two consecutive applies, and a non-table relation of that name leaves the apply clean rather than aborting it. Reported by the review bots on #924 and on this PR. Signed-off-by: Prasanth Baskar <prasanth@8gears.com>

bupd · 2026-09-16T07:40:41Z

/backport v2.15

github-actions · 2026-09-16T07:45:09Z

Backport to release-2.15 has conflicts. Please cherry-pick b6a9fa0f68307a055eba52b1bb817f66aa0b888d manually.

…ion guard (backport #929) The guard backported in #910 tested information_schema against current_schema(), which is only the first entry in search_path. On a connection whose search_path puts another schema first, an execution table in a later schema makes the predicate false while the unqualified ALTER below it resolves to that same later table, so the widening is skipped without a word and execution.revision silently stays integer. Resolve the relation with to_regclass and read its type from pg_attribute, so the guard and the ALTER always agree on which table they are talking about. to_regclass returns NULL when no execution relation is reachable, which leaves the guard false as before. Two narrower cases came with it. to_regclass resolves any relation, so the guard is restricted to tables by relkind: an index named execution earlier in search_path would otherwise match a pg_attribute row and send ALTER TABLE at something it cannot alter, failing the whole file. And the column type is compared after resolving a domain to its base, so a column already typed as a domain over bigint keeps the domain and its CHECK constraints instead of having them stripped by the ALTER. Covered by two tests against a real Postgres: execution in a schema that is not first in search_path is widened and its rows preserved on two consecutive applies, and a non-table relation of that name leaves the apply clean rather than aborting it. Signed-off-by: Prasanth Baskar <prasanth@8gears.com>

github-actions · 2026-09-16T08:21:44Z

Preview images for this PR are available in 8gears.container-registry.com/8gcr-pr with tag pr-929, built from 8e01e5e:

8gears.container-registry.com/8gcr-pr/harbor-core:pr-929
8gears.container-registry.com/8gcr-pr/harbor-jobservice:pr-929
8gears.container-registry.com/8gcr-pr/harbor-registryctl:pr-929
8gears.container-registry.com/8gcr-pr/harbor-exporter:pr-929
8gears.container-registry.com/8gcr-pr/harbor-portal:pr-929
8gears.container-registry.com/8gcr-pr/harbor-registry:pr-929
8gears.container-registry.com/8gcr-pr/trivy-adapter:pr-929

Verify a preview image:

cosign verify \
  --certificate-identity-regexp="https://github.com/container-registry/harbor-next/.github/workflows/pr-ci.yml@.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr-pr/harbor-core:pr-929

Verify the SBOM attestation:

cosign verify-attestation \
  --certificate-identity-regexp="https://github.com/container-registry/harbor-next/.github/workflows/pr-ci.yml@.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  --type spdxjson \
  8gears.container-registry.com/8gcr-pr/harbor-core:pr-929

…ion guard (backport #929) (#933) Signed-off-by: Prasanth Baskar <prasanth@8gears.com>

Copilot AI lite review requested due to automatic review settings September 16, 2026 07:10

Copilot started reviewing on behalf of bupd September 16, 2026 07:13 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Comment thread make/migrations/postgresql/harbor_next.sql

cubic-dev-ai Bot reviewed Sep 16, 2026

View reviewed changes

Comment thread make/migrations/postgresql/harbor_next.sql Outdated

Comment thread make/migrations/postgresql/harbor_next.sql

Comment thread make/migrations/postgresql/harbor_next.sql

bupd force-pushed the fix/execution-revision-guard-search-path branch from be13377 to e03143b Compare September 16, 2026 07:26

github-actions Bot added the tests label Sep 16, 2026

cubic-dev-ai Bot reviewed Sep 16, 2026

View reviewed changes

bupd force-pushed the fix/execution-revision-guard-search-path branch from e03143b to 8e01e5e Compare September 16, 2026 07:39

bupd merged commit b6a9fa0 into main Sep 16, 2026
16 checks passed

bupd deleted the fix/execution-revision-guard-search-path branch September 16, 2026 07:40

github-actions Bot mentioned this pull request Sep 16, 2026

chore: release 2.16.0 #268

Open

This was referenced Sep 16, 2026

fix(db): Resolve the execution table through search_path in the revision guard (backport #929) #933

Merged

fix(db): Widen execution.revision to bigint (backport #924) #910

Merged

bupd added a commit that referenced this pull request Sep 16, 2026

fix(db): Resolve the execution table through search_path in the revis…

6b05f65

…ion guard (backport #929) (#933) Signed-off-by: Prasanth Baskar <prasanth@8gears.com>

github-actions Bot mentioned this pull request Sep 16, 2026

chore: release 2.15.10 #934

Open

Navigation Menu

fix(db): Resolve the execution table through search_path in the revision guard - #929

fix(db): Resolve the execution table through search_path in the revision guard#929
bupd merged 1 commit into
mainfrom
fix/execution-revision-guard-search-path

bupd commented Sep 16, 2026

Uh oh!

coderabbitai Bot commented Sep 16, 2026 •

edited

Loading

Review limit reached

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot Sep 16, 2026

Uh oh!

Uh oh!

bupd commented Sep 16, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

bupd commented Sep 16, 2026

What broke

What changed

How it was verified

Uh oh!

coderabbitai Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

github-actions Bot commented Sep 16, 2026

Dependency Review

Scanned Files

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Sep 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bupd commented Sep 16, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Sep 16, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading