Skip to content

fix(db): Resolve the execution table through search_path in the revision guard (backport #929) - #933

Merged
bupd merged 1 commit into
release-2.15from
backport/pr-929-to-release-2.15
Sep 16, 2026
Merged

bupd merged 1 commit into
release-2.15from
backport/pr-929-to-release-2.15

Conversation

@bupd

@bupd bupd commented Sep 16, 2026

Copy link
Copy Markdown
Member

Manual backport of #929 to release-2.15. A clean cherry-pick did not apply, because release-2.15 had no execution.revision block at all when this was cut.

Order is already settled: #910 merged first, so this is now a pure delta on top of it — it changes the guard #910 introduced and adds the regression tests. Nothing here duplicates #910.

What broke

The guard #910 brought over tests information_schema against current_schema(), which is only the first entry in search_path. If a connection's search_path puts another schema first and execution lives in a later one, the guard reads false while the unqualified ALTER TABLE execution below it resolves to that later table. The widening is skipped silently and execution.revision stays integer.

What changed

Resolve the relation with to_regclass and read its type from pg_attribute, so the guard and the ALTER always agree on which table they mean. Two narrower cases came with it:

  • relkind keeps the guard on tables. to_regclass resolves any relation, so an index named execution earlier in search_path would otherwise match a pg_attribute row and send ALTER TABLE at something it cannot alter — aborting the whole file.
  • Domain resolution. The type is compared after resolving a domain to its base, so a column already typed as a domain over bigint keeps the domain and its CHECK constraints instead of having them stripped.

How it was verified

Against a release-2.15 database built by its own numbered migrations, not a fixture. Seeded revision=99, then applied harbor_next.sql twice the way core does on start:

before → execution.revision = integer
pass 1 → bigint, row revision=99
pass 2 → bigint, row revision=99

The widening fires, the existing value survives it, and the repeat is a no-op.

Two regression tests ported from #929, both green on this branch — one putting execution in a schema that is not first in search_path, one with a non-table relation of that name shadowing it:

--- PASS: TestAuthoritativeSchemaAgainstPostgreSQL
--- PASS: TestExecutionRevisionGuardResolvesThroughSearchPath
--- PASS: TestExecutionRevisionGuardIgnoresNonTableRelations

Schema rules respected: no new numbered migration, the change stays in the idempotent harbor_next.sql.

Note on the first run

The first push here showed only lint/DCO/bot checks, which looked like a missing DB lane. It was not: that head conflicted with release-2.15, and a conflicted PR has no merge ref for pull_request workflows to build, so everything needing one was skipped. The rebase onto the merged #910 resolved the conflict and the full set (Test, Build, Go Lint, Vulnerability Check, preview images) now runs.

@coderabbitai

coderabbitai Bot commented Sep 16, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 72729836-1829-4542-af60-2df7a580aa33

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 2 files

Re-trigger cubic

…ion guard (backport #929)

The guard backported in #910 tested information_schema against
current_schema(), which is only the first entry in search_path. On a
connection whose search_path puts another schema first, an execution
table in a later schema makes the predicate false while the unqualified
ALTER below it resolves to that same later table, so the widening is
skipped without a word and execution.revision silently stays integer.

Resolve the relation with to_regclass and read its type from
pg_attribute, so the guard and the ALTER always agree on which table
they are talking about. to_regclass returns NULL when no execution
relation is reachable, which leaves the guard false as before.

Two narrower cases came with it. to_regclass resolves any relation, so
the guard is restricted to tables by relkind: an index named execution
earlier in search_path would otherwise match a pg_attribute row and send
ALTER TABLE at something it cannot alter, failing the whole file. And
the column type is compared after resolving a domain to its base, so a
column already typed as a domain over bigint keeps the domain and its
CHECK constraints instead of having them stripped by the ALTER.

Covered by two tests against a real Postgres: execution in a schema that
is not first in search_path is widened and its rows preserved on two
consecutive applies, and a non-table relation of that name leaves the
apply clean rather than aborting it.

Signed-off-by: Prasanth Baskar <prasanth@8gears.com>
@bupd
bupd force-pushed the backport/pr-929-to-release-2.15 branch from 823ea25 to b042b85 Compare September 16, 2026 08:03
@bupd
bupd merged commit 6b05f65 into release-2.15 Sep 16, 2026
35 checks passed
@bupd
bupd deleted the backport/pr-929-to-release-2.15 branch September 16, 2026 08:26
@github-actions

Copy link
Copy Markdown
Contributor

Preview images for this PR are available in 8gears.container-registry.com/8gcr-pr with tag pr-933.

  • 8gears.container-registry.com/8gcr-pr/harbor-core:pr-933
  • 8gears.container-registry.com/8gcr-pr/harbor-jobservice:pr-933
  • 8gears.container-registry.com/8gcr-pr/harbor-registryctl:pr-933
  • 8gears.container-registry.com/8gcr-pr/harbor-exporter:pr-933
  • 8gears.container-registry.com/8gcr-pr/harbor-portal:pr-933
  • 8gears.container-registry.com/8gcr-pr/harbor-registry:pr-933
  • 8gears.container-registry.com/8gcr-pr/trivy-adapter:pr-933

Verify a preview image:

cosign verify \
  --certificate-identity-regexp="https://github.com/container-registry/harbor-next/.github/workflows/pr-ci.yml@.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr-pr/harbor-core:pr-933

Verify SBOM attestation:

cosign verify-attestation \
  --certificate-identity-regexp="https://github.com/container-registry/harbor-next/.github/workflows/pr-ci.yml@.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  --type spdxjson \
  8gears.container-registry.com/8gcr-pr/harbor-core:pr-933

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant