test(golang): run the Go SDK rows and queries through EQL v4 in PostgreSQL by coderdan · Pull Request #1291 · cipherstash/stack

coderdan · 2026-10-19T13:48:51Z

Summary

The Go SDK (languages/golang/encrypt) is what the pilot customer runs. A Go program stores encrypted rows in EQL columns: EQL (Encrypt Query Language) is the SQL library we install into PostgreSQL as the eql_v4 schema, with one column type per EQL type and the operators that compare encrypted search terms. The program then finds those rows with queries the Go SDK derives.

Nothing in CI ran that path. This PR adds a Go test that does, for every EQL type the engine can produce, and a CI job that runs it against PostgreSQL 17 with the EQL v4 bundle built from this branch.

Stacked on #1290; the base will move to next when that merges.

Changes

languages/golang/encrypt/eql_postgres_test.go: TestEQLTypesRoundTripAndQueryInPostgres. It walks eql.Types, the table generated from the EQL catalog. For each producible type (32 on next) it declares a field of that type at run time through gensupport, then:
- stores four rows (low, middle, middle, high) in a column of the type's domain;
- runs every query the type's indexes answer through EQL's operators (=, <, <=, >, >=, @@) and asserts the exact rows found;
- checks that a type with no query for an operator gets EQL's own refusal ("operator < is not supported for …") rather than some other error;
- reads the rows back from PostgreSQL and decrypts them, since PostgreSQL re-serialises jsonb when it stores it.
A type whose plaintext kind or index has no case in the test fails rather than skipping, so a type the engine starts producing is either covered or loudly not.
If DATABASE_URL is set but eql_v4 isn't installed there, the test fails with "EQL v4 is not installed in DATABASE_URL" rather than skipping.
mise run go:test:postgres: builds the EQL v4 bundle from the tree (packages/eql, mise run build), installs it into EQL_TEST_DATABASE_URL, and runs both Go PostgreSQL tests. It fails if either one skips.
.github/workflows/tests-golang.yml:
- A new eql-postgres job runs after wasi-check. It uses the deterministic test guests that job already builds and checksums (the guests are the Rust engine compiled to WebAssembly), and runs the task above against a postgres:17 service.
- The existing bytea test (TestQueriesRunAgainstPostgres) moves there too. Its database now carries EQL, and wasi-check's plain Postgres service is gone.
- The workflow's path filters gain EQL's SQL sources and the codegen that writes the bundle, so a SQL change starts this job.
AGENTS.md: the CI summary names the new job and the local task.

Verification

Locally against a fresh postgres:17 container with the tree's v4 bundle: all 32 producible types pass, and TestQueriesRunAgainstPostgres passes alongside.
Mutation check: changing the expected rows for < failed exactly the 13 ordered types.
With DATABASE_URL pointing at a database without EQL, the test fails with the message above. With DATABASE_URL unset, it skips, as it will on the macOS and Windows jobs.
mise run go:test:postgres passed. With the plain deterministic guest not built, it failed on the skip, as intended.
go vet and golangci-lint (0 issues) are clean. pnpm run test:scripts passes (80 files, 1409 passed; this covers crates-ci.test.mjs for the new task's CI caller and the EQL workflow guards). actionlint is clean.
Not yet observed in a real Actions run.

Review notes

Not covered: eql_v4.between. The Go SDK can't derive an EQL range term yet: asking for a range on an EQL ordered field returns "the field's type does not answer the operator". So there is no Go query to run through between. When the SDK gains it, the test needs a case for the range index.
Not covered yet: block ORE. The …OrdOre types are not producible on next, so the test skips them through eql.Types. They'll be covered automatically once feat(eql)!: produce the block ORE EQL v4 types through ore-rs 6-bit block ORE #1280 makes them producible, with no change here.
Each type gets its own temporary table on one connection, so the run is about one second.

https://claude.ai/code/session_01XQN1QpaWVDGjHEg39KEJF3

changeset-bot · 2026-10-19T13:49:03Z

⚠️ No Changeset found

Latest commit: 8f2c8f8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-10-19T13:49:28Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI; Enforced overrides: Organization
Review profile: CHILL
Plan: Advanced
Run ID: 79202c8b-7014-428b-89d6-6178b491b9ce

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-19T13:50:50Z

Mutation testing (cargo-mutants, `--in-diff`, stack-auth + stack-encrypt)

No mutants were generated for the changed lines.

chatgpt-codex-connector · 2026-10-19T21:14:22Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T21:22:14.791697Z	`9d8769f`	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-19T21:16:59.061792Z	`9d8769f`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

freshtonic

Approved. This is a real round-trip and query test. It checks the exact rows for =, <, <=, >, >= and @@. It checks EQL's own refusal for operators that a type does not answer. It also checks decryption after the jsonb round trip through PostgreSQL.

What I checked

In the eql-postgres CI log, all 32 types and TestQueriesRunAgainstPostgres show --- PASS. Nothing skipped.
EQL is installed from the tree (mise -C packages/eql run build, then cipherstash-encrypt-v4.sql). It does not come from a registry pin.
The new path filters cover the #MISE sources of tasks/build.sh.
The test skips only when DATABASE_URL is not set. It fails when eql_v4 is missing. The CI task turns a skip into a failure. The job gets no CS_* secrets.

There are two small hardening points inline. Neither one blocks the merge.

…tgreSQL Nothing in CI ran the path a Go program takes: rows the Go SDK stores in EQL columns, found by queries the Go SDK derives, through EQL's operators. encrypt/postgres_test.go stores terms in bytea columns with no EQL, and the Rust encryption suite runs EQL in PostgreSQL but derives its own queries, so a change that put Go and the SQL out of step failed nowhere (#1289). TestEQLTypesRoundTripAndQueryInPostgres walks eql.Types, the table generated from the EQL catalog, and for every type the engine produces declares a field of it at run time through gensupport, stores four rows in a column of its domain, and runs each query its indexes answer (=, <, <=, >, >= and @@) through the operand domain, asserting the exact rows. A type with no query for an operator must be refused with EQL's own error. The rows are read back from PostgreSQL, which stores jsonb re-serialised, and opened. A type whose plaintext or index the test has no case for fails rather than skipping, so a type the engine starts producing is covered or loudly not. With DATABASE_URL set and no eql_v4 schema it fails: a skip reads the same as a pass. CI runs it in a new eql-postgres job in tests-golang.yml, after wasi-check and on its guests, against postgres:17 with the bundle `mise run build` writes from the tree, through the new `mise run go:test:postgres` task (also the local entry point, against EQL_TEST_DATABASE_URL). The task fails if either PostgreSQL test skips. The existing bytea test moves there with it, since its database now carries EQL. The workflow's filters gain EQL's SQL sources and the codegen that writes the bundle. `eql_v4.between` is not covered: the Go SDK derives no EQL range term yet (Range on an EQL ordered field is refused by the engine), so there is no Go query to run through it. Closes #1289 Claude-Session: https://claude.ai/code/session_01XQN1QpaWVDGjHEg39KEJF3

next now produces the ten block ORE types (IntegerOrdOre, TextSearchOre and the rest), and the test fails on an index it has no query for, as it is meant to. ore_block answers lt, lte, gt and gte, as ore and ope do. All 49 producible types pass against PostgreSQL 17. Claude-Session: https://claude.ai/code/session_01XQN1QpaWVDGjHEg39KEJF3

…ad back short From review. go test -run with a pattern that matches nothing prints "no tests to run" and PASS, so a renamed test left the job green: the task now requires each test's own --- PASS line. The test also checks rows.Err() after reading the stored rows back, and that it opened as many rows as it stored, so a short read or decrypt cannot check fewer rows and pass. Claude-Session: https://claude.ai/code/session_01XQN1QpaWVDGjHEg39KEJF3

Optional fields are what #1298 is for, and nothing ran a stored nil through EQL in PostgreSQL. Each type now gets a fifth row with no value, stored as the engine requires for it. A type of fixed width with no index or equality alone stores a sealed null (17 types): its c must be as long as a value's, EqNull must find it and only it, and IS NULL must find nothing. Text and every ordered or match type store SQL NULL (32 types): IS NULL finds it, and no value query does. The nil row opens as nil. Breaking the length check and the EqNull check on purpose fails all 17 and all 8 types they cover. Claude-Session: https://claude.ai/code/session_01XQN1QpaWVDGjHEg39KEJF3

coderdan · 2026-10-23T13:11:36Z

Follow-up filed: #1343, random-value order tests through PostgreSQL. The fixed values here can miss a comparator that is wrong only for some inputs.

coderdan marked this pull request as ready for review October 19, 2026 21:14

coderdan requested a review from a team as a code owner October 19, 2026 21:14

freshtonic approved these changes Oct 23, 2026

View reviewed changes

Comment thread mise.toml

Comment thread languages/golang/encrypt/eql_postgres_test.go Outdated

coderdan force-pushed the ci/path-filter-precision branch from 039a665 to 02e49dc Compare October 23, 2026 12:39

coderdan added 2 commits October 23, 2026 23:40

coderdan force-pushed the ci/go-eql-postgres branch from 9d8769f to 0986a92 Compare October 23, 2026 12:43

Base automatically changed from ci/path-filter-precision to next October 23, 2026 12:53

coderdan added 2 commits October 23, 2026 23:53

coderdan mentioned this pull request Oct 23, 2026

Go EQL v4 PostgreSQL test: check order with random values, not four fixed ones #1343

Open

coderdan merged commit 5d1791c into next Oct 23, 2026
48 checks passed

coderdan deleted the ci/go-eql-postgres branch October 23, 2026 13:24

coderdan mentioned this pull request Oct 23, 2026

test(golang): check EQL v4 order with random values in PostgreSQL #1344

Open

Navigation Menu

Repository navigation

test(golang): run the Go SDK rows and queries through EQL v4 in PostgreSQL - #1291

test(golang): run the Go SDK rows and queries through EQL v4 in PostgreSQL#1291
coderdan merged 4 commits into
nextfrom
ci/go-eql-postgres

coderdan commented Oct 19, 2026

Uh oh!

changeset-bot Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading

Review skipped

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

freshtonic left a comment

Uh oh!

Uh oh!

Uh oh!

coderdan commented Oct 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

coderdan commented Oct 19, 2026

Summary

Changes

Verification

Related

Review notes

Uh oh!

changeset-bot Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Oct 19, 2026

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

freshtonic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

coderdan commented Oct 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot Bot commented Oct 19, 2026 •

edited

Loading

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading

Mutation testing (cargo-mutants, `--in-diff`, stack-auth + stack-encrypt)

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading