fix: remove hard-coded default Postgres credentials from config (#501)

## Summary

- Removes default `ogx` values for `POSTGRES_DB`, `POSTGRES_USER`, and
`POSTGRES_PASSWORD` from `build/build.yaml` so the distributed config
ships with empty defaults, forcing operators to supply credentials
explicitly (CWE-798)
- Adds `postgres_user`, `postgres_password`, `postgres_db` inputs
(defaulting to `ogx`) to the `setup-postgres` and `setup-server` CI
actions so existing tests continue using the same credentials
- Parameterizes hard-coded `psql -U ogx -d ogx` calls in
`tests/smoke.sh` to use shell variable expansion with `ogx` fallback
defaults

## Test plan

- [ ] `pre-commit run --all-files` passes (verified locally)
- [ ] CI smoke tests pass (setup-postgres and setup-server actions
supply `ogx` via input defaults)
- [ ] CI integration tests pass (smoke.sh shell defaults fall back to
`ogx`)
- [ ] Deployers who relied on image defaults will now need to explicitly
set `POSTGRES_DB`, `POSTGRES_USER`, and `POSTGRES_PASSWORD` env vars

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: derekhiggins

.github/actions/setup-postgres/action.yml

@@ -1,24 +1,40 @@
 name: Setup PostgreSQL
 description: Start PostgreSQL for ogx
+
+inputs:
+  postgres_user:
+    description: 'PostgreSQL user'
+    default: 'ogx'
+  postgres_password:
+    description: 'PostgreSQL password'
+    default: 'ogx'
+  postgres_db:
+    description: 'PostgreSQL database name'
+    default: 'ogx'
+
 runs:
   using: "composite"
   steps:
     - name: Start PostgreSQL
       shell: bash
+      env:
+        PG_USER: ${{ inputs.postgres_user }}
+        PG_PASSWORD: ${{ inputs.postgres_password }}
+        PG_DB: ${{ inputs.postgres_db }}
       run: |
         docker run -d \
           --name postgres \
           --net=host \
-          -e POSTGRES_USER=ogx \
-          -e POSTGRES_PASSWORD=ogx \
-          -e POSTGRES_DB=ogx \
+          -e "POSTGRES_USER=${PG_USER}" \
+          -e "POSTGRES_PASSWORD=${PG_PASSWORD}" \
+          -e "POSTGRES_DB=${PG_DB}" \
           pgvector/pgvector:pg17
 
         # Wait for PostgreSQL to be ready
         echo "Waiting for PostgreSQL to be ready..."
         postgres_ready=false
         for i in {1..30}; do
-          if docker exec postgres pg_isready -U ogx -d ogx; then
+          if docker exec postgres pg_isready -U "${PG_USER}" -d "${PG_DB}"; then
             echo "PostgreSQL is ready!"
             postgres_ready=true
             break
@@ -36,7 +52,7 @@ runs:
         # pg_isready returns true before the database is fully initialized, so retry.
         echo "Enabling pgvector extension..."
         for i in {1..10}; do
-          if docker exec postgres psql -U ogx -d ogx -c "CREATE EXTENSION IF NOT EXISTS vector;" 2>/dev/null; then
+          if docker exec postgres psql -U "${PG_USER}" -d "${PG_DB}" -c "CREATE EXTENSION IF NOT EXISTS vector;" 2>/dev/null; then
             echo "pgvector extension enabled"
             break
           fi

.github/actions/setup-server/action.yml

@@ -16,6 +16,15 @@ inputs:
     description: 'Volume mounts for docker run (one host:container:mode per line)'
     required: false
     default: ''
+  postgres_user:
+    description: 'PostgreSQL user'
+    default: 'ogx'
+  postgres_password:
+    description: 'PostgreSQL password'
+    default: 'ogx'
+  postgres_db:
+    description: 'PostgreSQL database name'
+    default: 'ogx'
 
 runs:
   using: "composite"
@@ -27,22 +36,25 @@ runs:
         IMAGE_TAG: ${{ inputs.image_tag }}
         INPUT_EXTRA_ENV: ${{ inputs.extra_env }}
         INPUT_VOLUMES: ${{ inputs.volumes }}
+        PG_USER: ${{ inputs.postgres_user }}
+        PG_PASSWORD: ${{ inputs.postgres_password }}
+        PG_DB: ${{ inputs.postgres_db }}
       run: |
         docker pull "$IMAGE_NAME:$IMAGE_TAG"
 
         docker_args=(
           -d --net=host --name ogx
           --env "POSTGRES_HOST=localhost"
           --env "POSTGRES_PORT=5432"
-          --env "POSTGRES_DB=ogx"
-          --env "POSTGRES_USER=ogx"
-          --env "POSTGRES_PASSWORD=ogx"
+          --env "POSTGRES_DB=${PG_DB}"
+          --env "POSTGRES_USER=${PG_USER}"
+          --env "POSTGRES_PASSWORD=${PG_PASSWORD}"
           --env "ENABLE_PGVECTOR=1"
           --env "PGVECTOR_HOST=localhost"
           --env "PGVECTOR_PORT=5432"
-          --env "PGVECTOR_DB=ogx"
-          --env "PGVECTOR_USER=ogx"
-          --env "PGVECTOR_PASSWORD=ogx"
+          --env "PGVECTOR_DB=${PG_DB}"
+          --env "PGVECTOR_USER=${PG_USER}"
+          --env "PGVECTOR_PASSWORD=${PG_PASSWORD}"
           --env "TRUSTYAI_LMEVAL_USE_K8S=False"
         )
 

Containerfile

@@ -221,17 +221,17 @@ storage:
       type: kv_postgres
       host: ${env.POSTGRES_HOST:=localhost}
       port: ${env.POSTGRES_PORT:=5432}
-      db: ${env.POSTGRES_DB:=ogx}
-      user: ${env.POSTGRES_USER:=ogx}
-      password: ${env.POSTGRES_PASSWORD:=ogx}
+      db: ${env.POSTGRES_DB:=}
+      user: ${env.POSTGRES_USER:=}
+      password: ${env.POSTGRES_PASSWORD:=}
       table_name: ${env.POSTGRES_TABLE_NAME:=ogx_kvstore}
     sql_default:
       type: sql_postgres
       host: ${env.POSTGRES_HOST:=localhost}
       port: ${env.POSTGRES_PORT:=5432}
-      db: ${env.POSTGRES_DB:=ogx}
-      user: ${env.POSTGRES_USER:=ogx}
-      password: ${env.POSTGRES_PASSWORD:=ogx}
+      db: ${env.POSTGRES_DB:=}
+      user: ${env.POSTGRES_USER:=}
+      password: ${env.POSTGRES_PASSWORD:=}
   stores:
     metadata:
       backend: kv_default

build/build.yaml

@@ -175,7 +175,7 @@ function test_postgres_tables_exist {
 
   # Retry for up to 10 seconds for tables to be created
   for i in {1..10}; do
-    tables=$(docker exec postgres psql -U ogx -d ogx -t -c "SELECT tablename FROM pg_tables WHERE schemaname = 'public';" 2>/dev/null | tr -d ' ' | tr '\n' ' ')
+    tables=$(docker exec postgres psql -U "${POSTGRES_USER:-ogx}" -d "${POSTGRES_DB:-ogx}" -t -c "SELECT tablename FROM pg_tables WHERE schemaname = 'public';" 2>/dev/null | tr -d ' ' | tr '\n' ' ')
     all_found=true
     for table in "${expected_tables[@]}"; do
       if ! echo "$tables" | grep -q "$table"; then
@@ -195,7 +195,7 @@ function test_postgres_tables_exist {
   echo "===> PostgreSQL tables not created after 10s :("
   echo "Expected tables: ${expected_tables[*]}"
   echo "Available tables: $tables"
-  docker exec postgres psql -U ogx -d ogx -c "\dt" || true
+  docker exec postgres psql -U "${POSTGRES_USER:-ogx}" -d "${POSTGRES_DB:-ogx}" -c "\dt" || true
   return 1
 }
 
@@ -205,7 +205,7 @@ function test_postgres_populated {
   # Check that chat_completions table has data (retry for up to 10 seconds)
   echo "Waiting for inference_store table to be populated..."
   for i in {1..10}; do
-    inference_count=$(docker exec postgres psql -U ogx -d ogx -t -c "SELECT COUNT(*) FROM inference_store;" 2>/dev/null | tr -d ' ')
+    inference_count=$(docker exec postgres psql -U "${POSTGRES_USER:-ogx}" -d "${POSTGRES_DB:-ogx}" -t -c "SELECT COUNT(*) FROM inference_store;" 2>/dev/null | tr -d ' ')
     if [ -n "$inference_count" ] && [ "$inference_count" -gt 0 ]; then
       echo "===> inference_store table has $inference_count record(s)"
       break
@@ -216,9 +216,9 @@ function test_postgres_populated {
   if [ -z "$inference_count" ] || [ "$inference_count" -eq 0 ]; then
     echo "===> PostgreSQL inference_store table is empty or doesn't exist after 10s :("
     echo "Tables in database:"
-    docker exec postgres psql -U ogx -d ogx -c "\dt" || true
+    docker exec postgres psql -U "${POSTGRES_USER:-ogx}" -d "${POSTGRES_DB:-ogx}" -c "\dt" || true
     echo "inference_store table contents:"
-    docker exec postgres psql -U ogx -d ogx -t -c "SELECT COUNT(*) FROM inference_store;" || true
+    docker exec postgres psql -U "${POSTGRES_USER:-ogx}" -d "${POSTGRES_DB:-ogx}" -t -c "SELECT COUNT(*) FROM inference_store;" || true
     return 1
   fi