Gate postgrest-db changes with BATS integration CI and pre-push image CVE scan

[Copilot]

postgrest-tandem image publishing had no runtime verification of init/auth/security SQL and no vulnerability gate before push. This PR adds integration coverage for bootstrap/auth/JWT privilege boundaries, enforces it in CI for postgrest-tandem/**, and documents local execution.

• Integration coverage for init/auth/JWT/security

  • Added postgrest-tandem/tests/ BATS suite:
    • test_init.bats: role flags/membership, schema bootstrap, required extensions.
    • test_jwt_secret.bats: singleton secret, pre_config() propagation, rotation + updated_at advancement.
    • test_auth.bats: bcrypt hashing, JWT claims/expiry window, invalid password path, role/password constraints, password re-hash on update.
    • test_api.bats: api.login success/failure as anon.
    • test_security.bats: revocation boundaries for auth.sign_jwt, auth.login, postgrest.rotate_jwt_secret, table read restrictions, and SECURITY DEFINER ownership checks.
  • Added shared harness test_helper.bash (container lifecycle, psql helpers, fixture user seed, JWT payload decode).

• New CI gate for postgrest-db

  • Added .github/workflows/ci-test-postgrest-db.yml.
  • Trigger scope: pull_request + push to main with paths: postgrest-tandem/**.
  • build job builds image locally and uploads tar artifact.
  • integration-test job downloads/loads image, installs bats + bats-support + bats-assert + postgresql-client + jq, then runs bats postgrest-tandem/tests/.
  • Added explicit minimal token permissions (contents: read).

• Publish workflow hardening

  • Updated .github/workflows/publish-postgrest-db.yml to build/load image for scan before push.
  • Added Trivy image scan gate (HIGH,CRITICAL, fail on findings) before registry push.

• Developer docs

  • Updated postgrest-tandem/image/README.md with a Local integration tests (BATS) section covering prerequisites and local commands.

Example workflow gate:

jobs:
  integration-test:
    needs: build
    steps:
      - uses: actions/download-artifact@v4
      - run: docker load -i /tmp/postgrest-db-ci.tar
      - run: sudo apt-get install -y bats bats-support bats-assert postgresql-client jq
      - run: TEST_IMAGE=local/postgrest-db:ci bats postgrest-tandem/tests/

[marcvolkert]

@copilot: update README.md so that developers know how to test locally

[marcvolkert]

@copilot: make the test suite run with podman as well

[Copilot]

@copilot: make the test suite run with podman as well

Done in eabef55. The BATS harness now supports both runtimes via CONTAINER_RUNTIME (defaults to docker; set CONTAINER_RUNTIME=podman), and README local test instructions now include the podman flow.

[Copilot]

Pull request overview

This PR adds an integration-test and vulnerability-scan gate around the postgrest-tandem “postgrest-db” image so changes to bootstrap/auth/JWT/security SQL are verified before publish, and publishes are blocked on HIGH/CRITICAL CVEs.

Changes:

• Added a BATS integration suite (postgrest-tandem/tests/) with a shared helper to validate JWT secret behavior, auth/login flows, and privilege boundaries via psql.
• Added a new GitHub Actions workflow to build the image and run the BATS suite on PRs/pushes affecting postgrest-tandem/**.
• Hardened the publish workflow by scanning the built image with Trivy (fail on HIGH/CRITICAL) before pushing, and documented local test execution.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
postgrest-tandem/tests/test_helper.bash	Adds container/psql harness utilities and JWT payload decode helper for the BATS suite.
postgrest-tandem/tests/01_jwt_secret.bats	Validates JWT secret singleton, pre_config() propagation, and rotation semantics.
postgrest-tandem/tests/02_auth.bats	Validates bcrypt hashing, login JWT claims/expiry, invalid password handling, and password constraints.
postgrest-tandem/tests/03_security.bats	Validates privilege boundaries around signing/rotation/login and SECURITY DEFINER ownership.
postgrest-tandem/image/README.md	Documents prerequisites and commands for running the BATS integration suite locally.
postgrest-tandem/image/initdb/03-auth.sql	Tightens password storage by enforcing bcrypt format and adding explicit length validation before hashing.
.github/workflows/ci-test-postgrest-db.yml	New CI workflow to build the image artifact and run the BATS integration suite.
.github/workflows/publish-postgrest-db.yml	Adds a Trivy scan gate before pushing the image to GHCR.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[marcvolkert]

lgtm