Use local Postgres service in GHA for integration tests

Replace the Neon-specific DATABASE_URL secret dependency with a
Postgres 16 service container in the integration test job. This makes
the CI self-contained — no external database or secret configuration
is required.

- Add `postgres` npm package as a standard PostgreSQL driver
- Update lib/db/index.ts to detect Neon URLs and fall back to the
  postgres driver for standard PostgreSQL connections
- Update tests/utils/db-reset.ts with the same dual-driver support
- Replace the secrets-gated integration job with a Postgres service
  container, health checks, and a hardcoded local DATABASE_URL

https://claude.ai/code/session_01FhzJavweKuMbx2d4U3ocDx

Author: claude

.github/workflows/ci.yml

@@ -77,47 +77,40 @@ jobs:
   test-integration:
     name: Integration Tests
     runs-on: ubuntu-latest
-    # Requires a Neon-compatible DATABASE_URL secret.
-    # Add it under GitHub → Settings → Secrets and variables → Actions.
-    # The app uses @neondatabase/serverless (HTTP-based), so a standard local
-    # Postgres container is not sufficient — use a real Neon test database.
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: clabot_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
     env:
-      DATABASE_URL: ${{ secrets.DATABASE_URL }}
-      # SESSION_SECRET can be any string for test purposes
-      SESSION_SECRET: ${{ secrets.SESSION_SECRET || 'ci-integration-test-secret' }}
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432/clabot_test
+      SESSION_SECRET: ci-integration-test-secret
     steps:
-      - name: Check for required secrets
-        id: check-secrets
-        run: |
-          if [ -z "$DATABASE_URL" ]; then
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            echo "::notice::Skipping integration tests — DATABASE_URL secret is not configured"
-          else
-            echo "skip=false" >> "$GITHUB_OUTPUT"
-          fi
-
       - uses: actions/checkout@v6
-        if: steps.check-secrets.outputs.skip != 'true'
 
       - uses: pnpm/action-setup@v4
-        if: steps.check-secrets.outputs.skip != 'true'
         with:
           version: latest
 
       - uses: actions/setup-node@v6
-        if: steps.check-secrets.outputs.skip != 'true'
         with:
           node-version: "20"
           cache: "pnpm"
 
       - name: Install dependencies
-        if: steps.check-secrets.outputs.skip != 'true'
         run: pnpm install --frozen-lockfile
 
       - name: Apply database migrations
-        if: steps.check-secrets.outputs.skip != 'true'
         run: pnpm db:migrate
 
       - name: Run integration tests
-        if: steps.check-secrets.outputs.skip != 'true'
         run: pnpm test:integration

lib/db/index.ts

@@ -1,13 +1,26 @@
 import "server-only"
 import { neon } from "@neondatabase/serverless"
-import { drizzle } from "drizzle-orm/neon-http"
+import { drizzle as drizzleNeonHttp } from "drizzle-orm/neon-http"
+import postgres from "postgres"
+import { drizzle as drizzlePostgresJs } from "drizzle-orm/postgres-js"
 import * as schema from "./schema"
 
 // ── Types ──────────────────────────────────────────────────────────
 
-export type Database = ReturnType<typeof createNeonDb>
+// Tagged-template SQL function compatible with both neon() and postgres()
+type RawSqlFn = (
+  strings: TemplateStringsArray,
+  ...values: unknown[]
+) => Promise<Record<string, unknown>[]>
 
-// ── Neon client ────────────────────────────────────────────────────
+export type Database = ReturnType<typeof createDb>
+
+// ── Helpers ────────────────────────────────────────────────────────
+
+/** Returns true when the URL points at a Neon serverless endpoint. */
+function isNeonUrl(url: string): boolean {
+  return /neon\.tech|neondb\.net/.test(url)
+}
 
 function getDatabaseUrl() {
   const databaseUrl = process.env.DATABASE_URL
@@ -17,9 +30,30 @@ function getDatabaseUrl() {
   return databaseUrl
 }
 
-function createNeonDb() {
-  const sql = neon(getDatabaseUrl())
-  return drizzle({ client: sql, schema })
+// ── Raw SQL (for migration checks & reset) ─────────────────────────
+
+let _pgClient: ReturnType<typeof postgres> | null = null
+
+function createRawSql(url: string): RawSqlFn {
+  if (isNeonUrl(url)) {
+    return neon(url) as unknown as RawSqlFn
+  }
+  if (!_pgClient) {
+    _pgClient = postgres(url)
+  }
+  return _pgClient as unknown as RawSqlFn
+}
+
+// ── Drizzle instance ───────────────────────────────────────────────
+
+function createDb() {
+  const url = getDatabaseUrl()
+  if (isNeonUrl(url)) {
+    const sql = neon(url)
+    return drizzleNeonHttp({ client: sql, schema })
+  }
+  _pgClient = postgres(url)
+  return drizzlePostgresJs({ client: _pgClient, schema })
 }
 
 // ── Singleton ──────────────────────────────────────────────────────
@@ -33,7 +67,7 @@ const globalForDb = globalThis as unknown as {
 
 function getDb(): Database {
   if (!globalForDb.__db) {
-    globalForDb.__db = createNeonDb()
+    globalForDb.__db = createDb()
     // Kick off migration verification + optional seed immediately.
     globalForDb.__dbReady = initDb(globalForDb.__db).catch((err) => {
       console.error("[db] Init failed, will retry on next request:", err)
@@ -58,7 +92,7 @@ async function initDb(db: Database) {
 }
 
 async function assertMigrationsApplied() {
-  const sql = neon(getDatabaseUrl())
+  const sql = createRawSql(getDatabaseUrl())
   const migrationsTable = process.env.DRIZZLE_MIGRATIONS_TABLE ?? "__drizzle_migrations"
   const migrationsSchema = process.env.DRIZZLE_MIGRATIONS_SCHEMA
   try {
@@ -127,7 +161,7 @@ export async function ensureDbReady(): Promise<Database> {
  * Full reset -- truncate all data and re-seed.
  */
 export async function resetDb(): Promise<void> {
-  const sql = neon(getDatabaseUrl())
+  const sql = createRawSql(getDatabaseUrl())
   await sql`TRUNCATE audit_events, webhook_deliveries, org_cla_bypass_accounts, cla_signatures, cla_archives, organizations, users CASCADE`
   const { seedDatabase } = await import("./seed")
   await seedDatabase(db)

package.json

@@ -63,6 +63,7 @@
     "lucide-react": "^0.544.0",
     "next": "16.1.6",
     "next-themes": "^0.4.6",
+    "postgres": "^3.4.8",
     "react": "^19",
     "react-day-picker": "8.10.1",
     "react-dom": "^19",