proxysql

Commit Graph

Author	SHA1	Message	Date
Rene Cannao	c06ee510a0	Merge origin/v3.0 into fix/pgsql-unix-socket Conflict in test/infra/control/start-proxysql-isolated.bash: this branch added the PGSQL_SOCKET_MOUNT block, v3.0 (via #5843) added the GCOV_PREFIX_STRIP=2 fix. Both blocks are independent and preserved as-is in the merged file.	2 weeks ago
René Cannaò	34ad16d19b	Merge pull request #5843 from sysown/v3.0_fix_coverage-gcov-prefix-strip fix(ci): coverage — GCOV_PREFIX_STRIP=2 + /opt/proxysql mount in test-runner	2 weeks ago
Rene Cannao	3118bb08a3	ci: add CI-pgsql-socket-g1 shim for the Unix-socket regression test Thin caller workflow that delegates to a reusable workflow on the GH-Actions branch (ci-pgsql-socket-g1.yml). The reusable carries the actual build/test logic; this shim exists so PRs to v3.0 that touch the pgsql-socket infra get the same CI treatment as legacy-g1 et al. The reusable workflow file is added in a separate PR against the GH-Actions branch and must be merged first -- this shim is a no-op until then.	3 weeks ago
Rene Cannao	ed0010e8fa	test(tap): fix setup-infras.bash and pgsql-unix_socket-t after local run Differences from the initial commit surfaced when running the test locally against docker-pgsql16-single: setup-infras.bash: - Use the PgSQL admin port 6132 instead of the MySQL admin port 6032. ProxySQL exposes both; 6132 is the one psql can drive. - Add a 'monitor' pgsql_user (default pgsql-monitor_username) so the monitor can authenticate and increment connect_check_OK. - Shorten pgsql-monitor_connect_interval to 1000ms and persist via LOAD/SAVE so the test sees a counter tick within a few seconds. Split into separate docker exec calls because the pgsql admin parser mis-handles 'value; <next-stmt>' by applying the value text to the next variable. pgsql-unix_socket-t.cpp: - Drop the SET pgsql-monitor_connect_interval from the test body; the setup hook already handles it (and trying to set it from the test with a semicolon-mangled multi-statement clobbered every monitor variable with '1000', including the username). - Use the real monitor counter names: PgSQL_Monitor_connect_check_OK and PgSQL_Monitor_connect_check_ERR (not PgSQL_Monitor_Connections_OK/ERR, which don't exist).	3 weeks ago
Rene Cannao	6e23f405c2	test(tap): fix plan(7)->plan(6) and unused loop var in pgsql-socket CodeRabbit flagged two issues on PR #5844: - pgsql-unix_socket-t.cpp:96 declared plan(7) but only six ok() calls execute (the SELECT 1 ok() in the if/else branches is mutually exclusive, so only one of them runs). - pgsql-socket/setup-infras.bash:29 used 'i' as a loop variable but never referenced it; rename to '_' for shellcheck SC2034.	3 weeks ago
Rene Cannao	c093a6fca7	fix(ci): coverage — GCOV_PREFIX_STRIP=2 + /opt/proxysql mount in test-runner Two related defects were producing a near-zero lib/ coverage report on Codecov despite the WITHGCOV proxysql build + PROXYSQL GCOV DUMP per test path being correctly wired: 1. GCOV_PREFIX_STRIP=3 overstripped one extra component. The workspace is mounted at /opt/proxysql in both the build and run containers (docker-compose.yml volume rule ./:/opt/proxysql/), so .gcno files embed absolute paths shaped /opt/proxysql/{lib,src}/obj/ X.gcno. With STRIP=3 the gcov runtime stripped opt/proxysql/lib (or opt/proxysql/src), and .gcda files landed at /gcov/obj/X.gcda with no {lib,src} component. The .gcno copy loop in run-tests-isolated. bash's collect_coverage trap then couldn't reconstruct the original directory, and fastcov reported every .gcda as "Missing 'current_working_directory'" with 'files': [] producing an LCOV report devoid of lib/ source-file entries. Switch both containers to GCOV_PREFIX_STRIP=2 so .gcda files preserve their {lib,src,test}/.../obj/ directory under /gcov, matching the {lib,src,test}/.../obj/ subtree under ${WORKSPACE} from which the trap copies the corresponding .gcno. 2. The test-runner container didn't mount /opt/proxysql. fastcov+gcov resolve source-file references via the absolute paths embedded in .gcno files (e.g. /opt/proxysql/lib/MySQL_Session.cpp). The test-runner only mounted ${WORKSPACE} at ${WORKSPACE}, so gcov couldn't open the referenced source files and produced no SF entries for them. Add a read-only bind mount of ${WORKSPACE} at /opt/proxysql so the in-container absolute path resolves to the same workspace tree. Both fixes are required: STRIP=2 alone leaves .gcda + .gcno adjacent but gcov still can't open source files; the bind mount alone doesn't help if the .gcno paths can't be located under /gcov. The pre-test PROXYSQL GCOV DUMP mechanism (proxysql-tester.py:880-881) was working all along; only the post-processing pipeline was dropping the data on the floor. The single PROXYSQL GCOV DUMP visible in CI run logs was an artifact of daemon stdout only reaching the runner during teardown, not evidence of the per-test dump being skipped. After this PR Codecov should accumulate real coverage for the daemon lib/ code paths (MySQL_Session, Admin_Handler, MySQL_Monitor, ProxySQL_Cluster, etc.), not just the small subset of files that unit tests exercise in-process.	3 weeks ago
Rene Cannao	49371fd647	pgsql: omit port= when port==0 (Unix socket support) Closes #5837. When pgsql_servers.port is 0 the hostname is documented to be a Unix-domain socket path. libpq rejects 'port=0' with 'invalid port number: "0"', so the field has to be omitted from the conninfo string. Add an 'if (port != 0)' guard at the three call sites that build libpq conninfo (client connect, backend kill, monitor) instead of creating a new helper header for a 3-line check. Add a regression TAP test (pgsql-socket-g1) that configures a pgsql_servers row with hostname='/var/run/postgresql-shared' and port=0, then exercises both the client connect path and the pgsql monitor. The infra uses a host-directory bind mount shared between the pgdb1 container (which creates the socket) and the ProxySQL container (which reads it), following the same pattern already used for the SSL cert directory in the same infra.	3 weeks ago
René Cannaò	7ddb3dc015	Merge pull request #5840 from sysown/fix/clang-parsersql-cxx-and-arm64-verify-file fix(build,ci): unblock clang packages + arm64 package verification (3.0.9)	3 weeks ago
Rene Cannao	b41df66032	chore(deps): vendor ParserSQL 1.0.9 tarball from official v1.0.9 tag Regenerated via git archive of the released v1.0.9 tag (ProxySQL/ParserSQL) for provenance; tree is identical to the prior commit.	3 weeks ago
Rene Cannao	792d48d801	fix(build,ci): clang package builds + arm64 package verification Two release-blocking bugs surfaced while building 3.0.9/3.1.9 packages: 1. clang builds (16 distro variants) failed at deps build with exit 127. Root cause: vendored ParserSQL's Makefile hardcoded `CXX = g++`, which the `CC=.. CXX=.. make` env prefix does not override, so clang containers (no g++) could not compile src/sql_parser/*.o. Fixed upstream in ParserSQL 1.0.9 (CXX ?= g++); re-vendored the 1.0.9 tarball and repointed the symlink. No change needed to deps/Makefile. 2. arm64 base package builds (14 distros) failed in the new 'Verify package installs' step: verify-package-install.bash used `file` (and `which`), absent in slim base images, so verification aborted after a good build and blocked the upload. Replaced with a portable ELF-magic check (head -c4 + od) and `command -v`.	3 weeks ago
René Cannaò	cae8c76e12	Merge pull request #5828 from sysown/feature/ci-codecov-tap-all-groups-callers ci(coverage): grant write-all on TAP-group callers for Codecov OIDC	1 month ago
Rene Cannao	b25ed9f804	fix(ci): broaden CI-unit-tests-asan-coverage to write-all for OIDC + checks Follow-up to `30b255339`, which added `checks: write` to the narrow permissions block. That wasn't enough -- the next run still failed with "Resource not accessible by integration" at the LouisBrunner/checks-action step. The reason is the workflow_run trigger context. This workflow is spawned by CI-trigger's completion (workflow_run), and the GITHUB_TOKEN GitHub mints for that context is scoped to the default branch, not to the PR branch the cascade was actually testing. Trying to POST a check-run for a PR-branch SHA from that token fails even with `checks: write` granted -- the same wall the legacy-g2-genai pipeline hit during PR #5818 ratcheting (see the commit history on ci-legacy-g2-genai.yml under GH-Actions, where the author tried adding scopes one at a time before settling on write-all). Switch to `permissions: write-all` -- identical to what every TAP- group reusable workflow in this PR's fan-out already declares. The older minimal block's only motivation was a noted desire not to widen scope unnecessarily; in this case the wider scope is actually required for the workflow's last step to succeed.	1 month ago
Rene Cannao	b7b2be0cd4	fix(ci): scrub unescaped double quotes from coverage-trap comment Second self-inflicted breakage on top of `76bfaf527`. My previous comment used markdown-style double quotes around "No such file or directory" and "bash -c". The whole script body is the argument to an outer bash -c "..." block: inside the outer DOUBLE QUOTES, any bare " character closes the outer string early. The inner bash then saw a truncated script ending mid-statement and reported -c: line 96: syntax error: unexpected end of file which tripped set -e in run-tests-isolated.bash and killed every TAP-group run within seconds, just like the backtick regression did before it. This commit rewrites the explanatory comment without any literal " or ` characters: apostrophes throughout, and explicit instructions for the next editor on which characters must stay out of this block (the only legitimate use of " inside the bash -c body is the bash quoting idiom on line 524, where the outer string is intentionally closed to allow ${WORKSPACE} to expand in the OUTER shell before the string is reopened -- that pattern is preserved exactly as-is). Audit: between the opening /bin/bash -c " on line 305 and the closing " on line 525, only one unescaped " remains (the pre-existing ${WORKSPACE} idiom on line 524), and zero backticks.	1 month ago
Rene Cannao	76bfaf5277	fix(ci): remove backticks from explanatory comment that itself triggered the bug Self-inflicted regression on a94ba88a2: the comment intended to warn the next contributor about the backtick-in-bash-c trap reintroduced the same trap twice, in markdown-style code references: # script is wrapped in `bash -c "..."`, and inside the # outer double quotes backticks trigger command # substitution, so `SF:proxysql/...` would make the outer ^^^^^^^^^^^^^^^^^ command substitution: bash tries to execute this token as a command, prints "No such file or directory", trips set -e on the outer docker-run line, the test step exits before any container starts. The previous cascade tally was misleading: the runs at commit `30b25533` never actually fired downstream (workflow_dispatch on a non-default branch doesn't propagate workflow_run events), so the bug hid until the natural pull_request trigger on commit `ca90fb540` fired the cascade and every TAP group exited within seconds. Rewrite the comment without any backticks, single quotes throughout, explicit "NB:" prefix.	1 month ago
Rene Cannao	ca90fb540b	fix(coverage): mount .gcno files into ProxySQL container so gcov runtime resolves daemon coverage Daemon-side coverage has been silently empty since gcov was first wired up. The TAP cascade hits the right code paths and the tester calls `PROXYSQL GCOV DUMP` after every test (proxysql-tester.py line 880), and proxysql writes 226 .gcda files into /gcov. But every single one of them lands with empty metadata: [error]: Missing 'current_working_directory' for data file: {'data_file': '/gcov/obj/MySQL_Query_Processor.gcda', 'files': []} [error]: Missing 'current_working_directory' for data file: {'data_file': '/gcov/obj/MySQL_Session.gcda', 'files': []} ... (x226) fastcov gives up on every one of them. The resulting .info file has zero `lib/.cpp` SF: entries -- only the ~200 header files indirectly pulled in by other sources. Codecov then reports `lib/MySQL_Session.cpp`, `lib/MySQL_Monitor.cpp`, `lib/MySQL_Protocol.cpp`, `lib/Admin_Handler.cpp`, `lib/MySQL_Logger.cpp`, `lib/MySQL_PreparedStatement.cpp`, `lib/ProxySQL_Cluster.cpp` and dozens more at 0% coverage* even though they're the hottest paths in the daemon. Root cause: the proxysql binary is built inside the build container with the source bind-mounted at /opt/proxysql/ (docker-compose.yml `- ./:/opt/proxysql/`). gcc embeds the .gcno paths into the binary as `/opt/proxysql/{lib,src}/obj/X.gcno`. At runtime, gcov reads those .gcno files at startup to populate per-translation-unit metadata that later goes into the .gcda files written by __gcov_dump(). The proxysql RUNTIME container has the binary but does NOT have the .gcno files at /opt/proxysql/{lib,src}/obj/ -- the entire 'current_working _directory' field of every .gcda comes out blank. Fix: mount the .gcno files from the build cache into the proxysql container at the compile-time path. The build cache restore already puts them at ${WORKSPACE}/lib/obj/.gcno and ${WORKSPACE}/src/obj/ .gcno on the runner, so this is just two extra `-v ...:ro` mounts on the docker run in start-proxysql-isolated.bash. Always-on, gated on .gcno presence: for a non-coverage build, the WORKSPACE has no .gcno files and the conditional adds nothing. This is the missing piece behind every prior coverage attempt -- PR #5817 (lib-only unit tests) bypassed it by running tests in the same container that built proxysql, PR #5818 (legacy-g2 TAP) hit exactly this bug and quietly uploaded a near-empty .info that Codecov merged with the unit-test data, masking the issue under a reasonable-looking 15% aggregate.	1 month ago
Rene Cannao	30b2553398	fix(ci): grant checks:write to CI-unit-tests-asan-coverage The workflow's permissions block declared only `contents: read` and `id-token: write`. The final step in the job is a `LouisBrunner/checks-action@v2.0.0` call that updates the check-run status. POSTing a check run requires `checks:write`, and without it the action fails with: ##[error]Resource not accessible by integration Every run since at least 2026-05-26 has failed at this step even when build + ASAN unit tests + LCOV coverage capture + Codecov upload all succeeded -- the workflow has been showing red on the dashboard for purely cosmetic reasons. Found while investigating the #5828 fan-out cascade's red lines (this workflow isn't in the fan-out, but the same cascade re-runs it, so it appeared in the same failure list).	1 month ago
Rene Cannao	a94ba88a20	fix(ci): stop leaking backticks from coverage trap into outer shell The coverage-collection trap inside `run-tests-isolated.bash` is embedded in a `docker run ... /bin/bash -c "..."` block where the script body is the argument to `bash -c`, double-quoted. Inside double quotes, backticks are still command substitution. One comment line in the SF: path-normalization block had used markdown-style backticks for code formatting: # as `SF:proxysql/...` get resolved -- the other two forms The outer shell sees `SF:proxysql/...` as command substitution, tries to execute `SF:proxysql/...` as a command before passing the body to docker, and prints to the runner log on every TAP run: test/infra/control/run-tests-isolated.bash: line 275: SF:proxysql/...: No such file or directory (Line 275 is where the `docker run \` compound command begins.) The error is non-fatal: the substitution evaluates to the empty string, the inner bash receives a comment with that empty substitution still inert, and the actual `sed -i` normalization a few lines below runs correctly. Codecov uploads have been working. But: - log noise looks alarming and got asked about, - any future "comment" with backticks in this block silently executes as a real command in the outer shell -- a footgun waiting for the next contributor. Fix: swap the backticks for single quotes and add a sibling comment explaining the trap so the next author doesn't reintroduce it. No behavior change for the test infrastructure or coverage upload.	1 month ago
Rene Cannao	9b56e56621	ci: retrigger after #5827 (Codecov callees) merged	1 month ago
Rene Cannao	8878076cf8	ci(coverage): grant write-all on TAP-group callers for Codecov OIDC Fan-out companion to the reusable-side change on GH-Actions (feature/ci-codecov-tap-all-groups-callees). Every CI-<group>.yml caller now declares `permissions: write-all` on its `jobs.run` block so the `id-token:write` scope that codecov- action@v4 needs (`use_oidc: true`) actually reaches the callee. Reusable-workflow permissions are the intersection of caller + callee; without this grant on the caller side, the OIDC token mint fails even though the callee declares write-all. Mirrors what CI-legacy-g2-genai.yml already does (from PR #5818). Workflows touched (38): CI-legacy-clickhouse-g1 CI-legacy-g1, CI-legacy-g3..g9 CI-mariadb10-galera-g1..g9 CI-mysql56-single-g1 CI-mysql84-g1..g9 CI-mysql84-gr-g1..g9 CI-set_parser_algorithm_3-g1	1 month ago
René Cannaò	97eab1bbf0	Merge pull request #5825 from sysown/v3.0_partition-fairness Promote longest-waiting B session via max_connect_time fold	1 month ago
René Cannaò	aa0f1367e1	Merge branch 'v3.0' into v3.0_partition-fairness	1 month ago
René Cannaò	b5b4d8bd13	Merge pull request #5818 from sysown/feature/ci-codecov-tap-legacy-g2 ci(coverage): upload legacy-g2 TAP coverage to Codecov via OIDC	1 month ago
Rene Cannao	638d33bf96	test: fix two false-positive failures unmasked by recent CI Two distinct test bugs, same kind of mistake: assuming the absence of one specific external signal in a fixed time window. Both are purely test-side -- the proxy code under test is correct. 1. reg_test_oversize_first_pkt-t (legacy-g7, mysql84-g7) ----------------------------------------------------- `peer_closed_within()` polled once, recv'd once, and concluded "peer is still talking" if any bytes came back. That works for PgSQL (server stays silent until the client sends StartupMessage) but fails for MySQL: ProxySQL emits its ~80-byte Initial Handshake Packet immediately on accept, so by the time the helper polls the client socket those bytes are already in the recv buffer. recv() returned them with n>0, the helper returned 0 (not closed), and all four MySQL probes failed with closed=0 -- even though the proxysql.log clearly shows the security-fix bound check ("Oversized first packet... Closing fd=...") firing for every probe and shut_soft() being called. Replace the single-shot poll/recv with a drain-and-re-poll loop bounded by a steady_clock deadline. The helper now returns 1 only when it observes EOF (recv == 0) or a non-EAGAIN error (RST). Bytes that arrive without an accompanying close are drained and we keep polling until either close or the deadline. This keeps the test's contract intact (3-second timeout for the peer to close after we send an oversized header) while correctly handling server-initiated greeting traffic that exists in some protocols but not others. 2. pgsql-test_dns_cache-t (legacy-g4) ---------------------------------- Step 8's assertion `MySQL_Monitor_dns_cache_queried` stays unchanged during a 4-5 s PgSQL-only window was ~40% flaky. Root cause: that counter is bumped by the MySQL Monitor's own DNS resolver loop -- mysql-monitor_local_dns_cache_refresh_interval defaults to 60 s and on each tick the loop iterates every hostname in mysql_servers UNION proxysql_servers. A 4-5 s window sometimes catches one tick (counter goes up by N hostnames) and sometimes catches zero (counter stays flat). The failing run showed 407 -> 411 (+4 = one tick covering four hostnames). The substantive isolation guarantee is "PgSQL activity does not mutate MySQL DNS cache state", which is already covered by the sibling assertion on MySQL_Monitor_dns_cache_record_updated (records are not added or refreshed by the background loop unless hostnames actually change). Drop the noisy queried-counter assertion and adjust the plan from 17 to 16. Alternatives considered: (a) disable mysql-monitor_local_dns_cache for the duration of the test -- doesn't reliably remove in-flight resolver-queue items so the race still exists, (b) widen the tolerance -- still timing-dependent. Removing the assertion is the cleanest, and the long comment in the test explains the why so the next reader does not re-add it. Neither fix touches the security fix (GHSA-58ww-865x-grpr) nor any proxy code; the bound checks in lib/mysql_data_stream.cpp:678 and lib/PgSQL_Data_Stream.cpp:547 fire correctly and identically on both protocols. Verified by reading proxysql.log from a failing run -- all 8 "Oversized first packet... Closing fd=" lines are present.	1 month ago
Rahim Kanji	eed52db897	Merge branch 'v3.0' into v3.0_partition-fairness	1 month ago
Rahim Kanji	6909011b67	perf(partition): promote longest-waiting B session via max_connect_time fold Under sustained contention ProcessAllSessions_Partition leaves the B (CONNECTING_SERVER) band unordered, so the pass can serve newer waiters ahead of older ones until they hit connect_timeout_server_max and abort. Track the oldest waiter during the classifier's is_B arm (no second pass) and swap it to running_end. Key on max_connect_time, which the is_B test already loads -- the min-compare is a register compare with no extra memory access, and the smallest value is the waiter closest to the timeout abort. Gated by \|B\| > PARTITION_FAIRNESS_MIN_B (=4) and partition_active.	1 month ago
René Cannaò	55740e9edb	Merge branch 'v3.0' into feature/ci-codecov-tap-legacy-g2	1 month ago
René Cannaò	a1ca6a0ca3	Merge pull request #5819 from sysown/v3.0_partition-gate perf: session-partition gate (supersedes #5776 and #5799)	1 month ago
Rene Cannao	0ba0ad1609	test(security): use getaddrinfo so oversize_first_pkt-t works with hostnames The GHSA-58ww-865x-grpr regression test was failing every CI run for every branch since it merged. Root cause: `tcp_connect()` resolved the target with `inet_pton(AF_INET, host, ...)`, which only accepts numeric IPv4 strings. In CI, `cl.host` / `cl.pgsql_host` are set to the Docker DNS hostname `proxysql` (the proxy container's service name), so inet_pton returned 0 and every probe failed with `-1` before the function ever sent a byte. Test output: # MySQL probe: connect to proxysql:6033 failed: No such file or directory not ok 1 - MySQL listener closed connection on oversize first-packet pkt_length=32765 (closed=-1) not ok 2 ... pkt_length=65535 (closed=-1) not ok 3 ... pkt_length=100000 (closed=-1) not ok 4 ... pkt_length=16777215 (closed=-1) # PgSQL listener not reachable at proxysql:6133; skipping PgSQL probes ok 5 - ProxySQL admin still accepting connections after oversize attacks # Failed 4 tests! (The misleading "No such file or directory" was just whatever errno happened to hold at the time `strerror(errno)` was called -- inet_pton doesn't set errno.) Switch to getaddrinfo, which transparently handles both hostnames and numeric IPs, and gai_strerror for a meaningful failure message. The probe semantics (4 KB header + poll for FIN/RST) are unchanged. Without this the test cannot exercise the actual security fix it was written to regression-guard; on an ASAN build the pre-fix code would NOT crash here because the probe never gets a chance to land any bytes, leaving the heap-buffer-overflow open with green CI.	1 month ago
Rene Cannao	2e1d89260e	test(groups): swap pp1_unknown_spoof / proclist_use_after_free to fix sort order The v3.0 merge into this branch (`efa852351`) brought in two entries out of alphabetical order: reg_test_proclist_use_after_free-t appeared before reg_test_pp1_unknown_spoof-t, and CI-lint-groups-json flags it with: Keys not sorted: 'reg_test_pp1_unknown_spoof-t' should come before 'reg_test_proclist_use_after_free-t' Swap the two lines.	1 month ago
Rene Cannao	9d9ede1532	fix(test): sort groups.json — pp1_unknown_spoof before proclist_use_after_free Run-with --fix from test/tap/groups/lint_groups_json.py. Unblocks the 'lint' check on PR #5819.	1 month ago
René Cannaò	a5bb7f640f	Merge branch 'v3.0' into v3.0_partition-gate	1 month ago
René Cannaò	efa8523510	Merge branch 'v3.0' into feature/ci-codecov-tap-legacy-g2	1 month ago
René Cannaò	46ab989adb	Merge commit from fork fix(security): reject addresses after PROXY UNKNOWN (CVE-2026-48772 / GHSA-gw94-85m2-x8v2)	1 month ago
René Cannaò	7dbe1f7029	Merge commit from fork fix(security): bound first-packet recv() in data streams (CVE-2026-48773 / GHSA-58ww-865x-grpr)	1 month ago
René Cannaò	08cc2dbaa5	Merge commit from fork fix(security): MCP run_sql_readonly multi-statement bypass (CVE-2026-48774 / GHSA-7wh6-2vcc-gcm4)	1 month ago
Rene Cannao	12b84f98bd	fix(coverage): normalize SF: paths in LCOV report so Codecov stores all files The previous green run (`4823a407`) successfully uploaded 1.18 MB of LCOV data to Codecov, but querying the Codecov API showed only 27 files / 5694 lines stored -- a fraction of the 84621 lines fastcov actually measured. Cause: fastcov runs inside the test container at cwd=/opt/proxysql and writes SF: lines in three flavors depending on whether the .gcno embedded absolute or relative source paths: SF:/opt/proxysql/include/Admin_ifaces.h (absolute container path) SF:lib/MySQL_Session.cpp (relative to fastcov cwd) SF:proxysql/src/SQLite3_Server.cpp (already correct -- the 27 files that survived) codecov-cli runs on the host with network_root_folder pointing at the runner's /home/runner/work/proxysql/proxysql, and the repo content lives one level deeper at <network_root>/proxysql/. So only the third shape resolves to an actual file; the other two are silently dropped server-side, with no warning in either the upload log or the Codecov UI. Fix: sed-rewrite all SF: lines so they all begin with `SF:proxysql/`. The transform is idempotent for already-correct paths via the `!s` negation guard, and is applied immediately after fastcov writes the .info (before genhtml runs, so the HTML report also benefits). After this, Codecov should store the full ~84621-line measurement and the per-file coverage explorer will show all of lib/, src/, include/, and test/tap/ instead of just src/SQLite3_Server.cpp + 26 friends.	1 month ago
René Cannaò	896bdde93a	Merge branch 'v3.0' into feature/ci-codecov-tap-legacy-g2	1 month ago
René Cannaò	3e7b77456e	Merge branch 'v3.0' into v3.0_partition-gate	1 month ago
Rene Cannao	4823a40766	ci(coverage): use write-all on legacy-g2-genai caller (match callee) Mirror of the callee switch from explicit-scope list to write-all. Reusable-workflow permissions intersect caller and callee, so the callee's write-all is no-op unless the caller also declares write-all. See the callee commit on GH-Actions for the full rationale.	1 month ago
Rene Cannao	7122523db1	ci(coverage): mirror actions:write to legacy-g2-genai caller Mirror of the callee scope bump. Reusable-workflow permissions intersect caller + callee, so the callee's actions:write is no-op without this matching grant on the caller.	1 month ago
Rene Cannao	af64f444d6	ci(coverage): mirror actions:read grant to legacy-g2-genai caller Mirror of the third callee permission addition (cache restore). Reusable-workflow permissions are intersected with the caller's, so the callee's actions:read grant is no-op without this. The full grant list is now: contents:read checkout id-token:write Codecov OIDC upload checks:write LouisBrunner/checks-action packages:read GHCR docker pull actions:read cache restore This is what GITHUB_TOKEN had implicitly before the `permissions:` block was added; we've now rebuilt that subset explicitly to keep id-token:write (which is not a default and so does need the explicit block).	1 month ago
Rene Cannao	d35043ff91	fix(coverage): match .gcno to .gcda by basename, not path-strip The previous algorithm in run-tests-isolated.bash's collect_coverage function stripped leading path components off a .gcda relative path and looked up `${WORKSPACE}/<stripped>.gcno`. That only works when the .gcda relative path is a path-suffix of the .gcno absolute path -- and for the ProxySQL daemon it's not. The proxysql binary is built with CWD=/opt/proxysql/lib/, so the embedded path in each .gcda is /opt/proxysql/lib/obj/X.gcda. The daemon container runs with GCOV_PREFIX=/gcov and GCOV_PREFIX_STRIP=3, which drops /opt/proxysql/lib/, landing the .gcda at /gcov/obj/X.gcda. The matching .gcno is at ${WORKSPACE}/lib/obj/X.gcno -- but the previous lookup only tried ${WORKSPACE}/obj/X.gcno and ${WORKSPACE}/X.gcno, never thinking to prepend lib/. Result: every daemon .gcda was logged by fastcov as "Missing 'current_working_directory'" with an empty files list, and the .info report came out 0 bytes. This replaces the strip-and-retry loop with an index built from `find ${WORKSPACE} -name '.gcno'` mapping basename -> path, and looks each .gcda up by basename. Robust to GCOV_PREFIX_STRIP, build CWD, and arbitrary path layouts. ProxySQL doesn't reuse .cpp basenames across directories, so basename collision is not a concern. Also emits a `matched=N unmatched=M` summary so the next time something goes wrong with coverage, the failure mode is loud. Requires the companion change on GH-Actions ci-builds.yml (extends the _src cache to include proxysql/lib/obj/.gcno) -- without that, the .gcno files for daemon-side lib code aren't available in the test workflow's WORKSPACE at all.	1 month ago
René Cannaò	7551ec6bbe	Merge pull request #5789 from sysown/v3.0_fix_pgsql-set_statement_test_5788 fix(test): pgsql-set_statement_test-t log race (#5788)	1 month ago
Rene Cannao	3a594d2058	ci(coverage): mirror packages:read grant to legacy-g2-genai caller Same logic as the previous caller commit (`65be0dc2c` added checks:write to mirror the callee). Reusable-workflow permissions intersect caller + callee, so the callee's packages:read grant is no-op without this caller-side mirror. This should be the final permissions tweak: contents:read, id-token:write, checks:write, and packages:read together restore all defaults the workflow steps actually use, plus the OIDC scope codecov-action@v4 needs.	1 month ago
Rene Cannao	65be0dc2cc	ci(coverage): add checks:write to legacy-g2-genai caller (mirror callee) Mirror of GH-Actions side: declaring `permissions:` on the caller shrinks GITHUB_TOKEN to only the listed scopes, which then becomes the upper bound for the reusable workflow's GITHUB_TOKEN. The callee added `checks: write` to fix the LouisBrunner/checks-action permission failure; the caller has to grant the same scope or the intersection drops it again. See sysown/proxysql@<GH-Actions-sha> for the failure mode.	1 month ago
Rene Cannao	3846bbd1be	ci(coverage): grant id-token:write to legacy-g2-genai caller for Codecov OIDC The reusable workflow ci-legacy-g2-genai.yml@GH-Actions was just extended (`6335dca47`) to upload its LCOV coverage report to Codecov via codecov-action@v4 with `use_oidc: true`. That action needs the runner to mint a GitHub OIDC token, which requires `id-token: write` on the calling job. Reusable-workflow permissions are the intersection of caller and callee, so the callee declaring it is necessary but not sufficient -- this commit grants it on the v3.0 caller too. This is the first non-unit-test Codecov upload: real ProxySQL coverage from the legacy-g2 TAP integration suite running against a WITHGCOV=1 proxysql daemon. Once green, the same pattern extends to the other TAP groups (flip their build cache to -tap-genai-gcov, add the upload step + this grant).	1 month ago
René Cannaò	a62b6a2b4f	Merge branch 'v3.0' into v3.0_fix_pgsql-set_statement_test_5788	1 month ago
René Cannaò	141c3e87c4	Merge pull request #5816 from sysown/v3.0_pgsql_options_5801 Strip trailing space from backend options startup parameter	1 month ago
René Cannaò	f4030443c6	Merge branch 'v3.0' into v3.0_fix_pgsql-set_statement_test_5788	1 month ago
René Cannaò	8025acdf60	Merge branch 'v3.0' into v3.0_pgsql_options_5801	1 month ago

1 2 3 4 5 ...

10364 Commits (fix/pgsql-unix-socket) All Branches Search

10364 Commits (fix/pgsql-unix-socket)

All Branches