Commit Graph
4534 Commits
Author SHA1 Message Date
renovate[bot]andWolfgang Walther 87b480bc0a chore(deps): update actions/checkout action to v7 2026-06-19 19:09:44 +00:00
renovate[bot]andWolfgang Walther 336d32d1ce chore(deps): update nixbuild/nix-quick-install-action action to v35 2026-06-19 19:09:02 +00:00
renovate[bot]andWolfgang Walther 9aef6f30a8 chore(deps): update vmactions/freebsd-vm action to v1.4.7 2026-06-19 19:08:17 +00:00
Taimoor ZaeemandSteve Chavez 242e5ba87e chore(cabal): explain performance related build flags
These flags were added in 9f97147cc3. Adding
a comment to clarify the use.

Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>
2026-06-17 14:15:45 -05:00
Michał KłeczekandTaimoor Zaeem 9f97147cc3 perf: add ghc 9.12 options -fexpose-overloaded-unfoldings -fspecialise-aggressively
Before 9.12.1 it was necessary to mark functions as INLINABLE or INLINE to make GHC consider cross-module specialization of polymorphic functions.
9.12 added a new -fexpose-overloaded-unfoldings flag that exposes optimized polymorphic functions in interface files. -fspecialise-aggressively then makes GHC apply aggresive specialization.
2026-06-17 13:13:48 +05:00
Taimoor ZaeemandSteve Chavez 9048332b0e test(io): clarify test names
Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>
2026-06-16 13:13:51 -05:00
Taimoor ZaeemandSteve Chavez b6c12abf0e test: move http header related tests from io tests to spec tests
Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>
2026-06-16 13:13:51 -05:00
Michał KłeczekandSteve Chavez 8fa26ee865 fix: Start listening after schema cache load
This change ensures PostgREST starts listening on a server socket only after it loaded the schema cache and is ready to handle requests. It is no longer going to return 503 errors during startup until the schema cache is loaded.
2026-06-16 12:30:51 -05:00
Michał KłeczekandWolfgang Walther fae6253932 refactor: make nextListenerDelay local to Listener module
Right now stateNextListenerDelay is only used in Listener module.
This change is a small refactoring moving nextListenerDelay to Listener to increase cohesion and decrease coupling.
2026-06-14 18:39:59 +00:00
Wolfgang Walther 2976eb047b add: support running admin server on unix socket
This is useful when multiple instances run on the same machine, for
example behind a proxy. Unix sockets for web and admin servers can then
be put in the same folder for each instance.

Can be helpful when writing tests as well.
2026-06-14 17:18:37 +00:00
Wolfgang Walther f24bc7092f test(io): fix UnboundLocalError
The `if response` check a few rows down would not actually work without
initializing the variable first. It'd throw:

```
E       UnboundLocalError: cannot access local variable 'response' where
it is not associated with a value
```
2026-06-14 17:18:37 +00:00
Wolfgang Walther 6d87fc5879 test(io): move some tests to unix sockets
No need to run these with TCP and freeport, I believe.
2026-06-14 17:18:37 +00:00
Michał KłeczekandSteve Chavez 54430c3a2c fix: Do not clear the schema cache during retries
retryingSchemaCacheLoad should not clear existing schema cache upon failure - there is no reason to do that. If there is a communication issue with the database server or db is down, clients are going to get 502 anyway. If it was a glitch when loading the schema cache - the clients are going to use old (stale) schema cache for some time until next retry re-loads it successfully.
2026-06-11 13:14:37 -05:00
Taimoor Zaeem e9a016670f Revert "add: string slicing operator for jwt-role-claim-key"
This reverts commit fe0386e9c4.

As discussed in https://github.com/PostgREST/postgrest/pull/4984#issuecomment-4652725178.
2026-06-11 23:07:05 +05:00
steve-chavez 1ebf480258 amend: required membership for postgrest_test_anonymous
Previous test correction required GRANTing membership for
postgrest_test_anonymous.
2026-06-11 12:00:02 -05:00
steve-chavez e7c8d70333 test: correct test_admin_ready_includes_schema_cache_state
There was an oversight on d556cea, `timeout_authenticator` doesn't have
any privileges on the tables so it shouldn't be making requests to the
API server or it will end up with 401 responses.
2026-06-11 11:51:14 -05:00
Wolfgang Walther 9097752888 ci(release): lowercase ghcr repo
ghcr does not support uppercase letters, which was not a problem when
testing in my fork. But the PostgREST org's name obviously has uppercase
letters in it, so we need to lowercase these for the ghcr namespace.
2026-06-10 14:18:12 +02:00
Wolfgang Walther 62503466a0 Revert "ci(ci): avoid running build jobs twice on pushes to main"
This reverts commit 840d3f99ed.

This was a nice idea in theory, but in practice this means that the
build jobs do not run at all on the default branch anymore. This means
the caches they push to won't be used by any other jobs, neither on the
tag pipelines, nor on PRs. This in turn makes all of these jobs really
slow.

Not helpful!
2026-06-10 14:04:59 +02:00
Wolfgang Walther 1560078ce2 ci: push container images to ghcr.io
Resolves #2836
2026-06-10 13:17:37 +02:00
Taimoor ZaeemandWolfgang Walther 8bde0ad474 test: move cors related tests from io tests to spec tests
Towards #4946.

Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>
2026-06-10 10:27:49 +00:00
Taimoor ZaeemandWolfgang Walther 21433d10c2 refactor(config): use correct data type for server-cors-allowed-origins
Replaces the `Maybe [Text]` with `[Text]`. The `Maybe` is unnecessary
because we handle `Just []` and `Nothing` the same way.

Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>
2026-06-09 12:35:47 +00:00
Wolfgang Walther 044d623424 ci(test): fail loadtest correctly
Previously this would only fail if *each* row had `:x:` in it, which was
never the case, because the header never has it. It is supposed to fail
when *at least one* row has an .
2026-06-09 12:35:25 +00:00
renovate[bot]andWolfgang Walther 0b5655b9d3 chore(deps): update codecov/codecov-action action to v7 2026-06-07 11:01:07 +00:00
steve-chavez 4df0654998 docs: add how-to for Query Identifier 2026-06-06 06:47:33 -05:00
steve-chavez ad790baefb test: explain verbose reveals query identifier
This also requires enabling shared_preload_libraries=pg_stat_statements.
Really we only need compute_query_id=on, but pg_stat_statements is
useful for other tests and it already enables compute_query_id (since
it's `auto` by default).
2026-06-06 06:47:33 -05:00
Wolfgang Walther cb6fc55a2d chore(deps): update nixpkgs, stackage and hackage pins 2026-06-05 20:29:48 +00:00
Wolfgang Walther b114bb9395 nix: replace silver-searcher with fd
The former has been removed from Nixpkgs and won't be available on the
next bump.
2026-06-05 20:29:48 +00:00
Taimoor ZaeemandSteve Chavez da8738b88e chore: add changelog entry for v14.13
Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>
2026-06-05 13:30:59 -05:00
renovate[bot]andWolfgang Walther 3ca876da62 chore(deps): update actions/checkout action to v6.0.3 2026-06-04 09:09:49 +00:00
Laurence IslaandSteve Chavez 416a15480f fix: request failures when work_mem is set on a role 2026-06-03 13:45:34 -05:00
Wolfgang Walther a149405d11 ci: remove deprecation warning
app-id was replaced with client-id
2026-06-03 10:09:38 +02:00
netandWolfgang Walther 3d596e2dbc fix: don't mention retrying in the database connection error message
The PGRST000 database connection error message was "Database connection
error. Retrying the connection.", but reconnection attempts are already
logged separately by the reconnection observation, and on fatal errors
(e.g. authentication failure) PostgREST does not retry at all. Drop the
"Retrying the connection." part, leaving "Database connection error.".
2026-06-03 08:04:40 +00:00
Pedro Gil MoraandWolfgang Walther fae58174fa docs: Add efcore-postgrest library to client-side libraries 2026-06-02 08:19:45 +00:00
Wolfgang Walther 840d3f99ed ci(ci): avoid running build jobs twice on pushes to main
It's enough to run the build jobs in the release pipeline, no need to
run them on the push event as well.
2026-06-02 10:08:16 +02:00
Wolfgang Walther 871aa058f8 ci(release): only update docker description from devel release
This condition was accidentally removed when merging 4 release jobs into
2.
2026-06-02 10:07:37 +02:00
Wolfgang Walther 8552c66c1e ci: Use FreeBSD VM instead of cirrus 2026-06-02 07:36:59 +00:00
netandWolfgang Walther 097a1de67d chore: sort config dump alphabetically
The config dump in Config.hs listed db-config, db-pre-config and the
db-pool-* settings out of alphabetical order, while the rest of the dump
was sorted. Now the whole dump is consistently alphabetical and update
the expected IO test configs to match.
2026-06-02 07:32:11 +00:00
Wolfgang Walther ed4b68c364 test(spec): remove obsolete extra search path from postgis tests
This was brought over in the last commit, because the postgis was
re-using the same config as another test. Now it has a separate config,
so we can reduce it a bit.
2026-06-02 06:49:15 +00:00
Wolfgang Walther 268ab00ed9 test(spec): inline config into test suite
Previously, information about each test-suite was repeated in 3 separate
places:
- as a label and as implicit knowledge in the test-suite itself,
- as a comment in Main.hs, and
- as a configuration in SpecHelper.hs.

With this change, there will be a single source of truth in the test
suite itself. This will allow a single test-suite to easily test
multiple different configurations.
2026-06-02 06:49:15 +00:00
Wolfgang Walther 7803960cd1 test(spec): fix test labels 2026-06-02 06:49:15 +00:00
Wolfgang Walther 0e46474cb2 test(spec): fix typo in comment 2026-06-02 06:49:15 +00:00
Wolfgang Walther 7c806a2bf9 test(spec): move two tests with basic config into list
Everything that uses withApp is in that list.
2026-06-02 06:49:15 +00:00
Wolfgang Walther c2d32be3c5 test(spec): remove obsolete ANALYZE calls
These are now part of the with- helpers.
2026-06-02 06:49:15 +00:00
Michał KłeczekandTaimoor Zaeem 13c0e7061e refactor: simplify control flow in App.postgrest
Currently, authentication and response execution each unwrap ExceptT with separate runExceptT calls, which split the main request flow across nested pattern matching and Either handling. Control flow is complex and difficult to understand.

The goal of this change is to make request execution as sequential
monadic code with clear error handling.

To implement that, request handling is now run in ExceptT over WriterT (Last ByteString) IO monad stack. Auth role is written after authentication succeeds and further returned along the response. Thanks to it response observation generation is centralized at the end of request handling.

It was necessary to abstract monad stack in getAuthResult, lookupJwtCache, postgrestResponse, and withTiming to enable introduction of WriterT.
2026-06-02 11:28:19 +05:00
Wolfgang Walther 1d6e0bd35f nix(loadtest): report percentage change
This reports the percentage change between the current head branch and
the main branch, which is exactly the number we'll want to make our
decisions on "success or fail" on.

CI failures will initially be reported for regressions of 5% or more on
an individual number.
2026-06-01 20:49:35 +00:00
Wolfgang Walther ff92846e64 nix(loadtest): report multiple percentiles at once
We can look at the data over time and see which percentile works best
for our purpose.
2026-06-01 20:49:35 +00:00
Wolfgang Walther 640039a180 nix(loadtest): move errors into mixed
Because we separate loadtest results per URL now, we can move the error
tests into the regular mixed bag of loadtests - we will be able to tell
from the misspelled URLs when we hit a regression in that area.

We should be able to do similar things for JWT tests, but we'll need
more infrastructure here.
2026-06-01 20:49:35 +00:00
Wolfgang Walther 59dffc258a nix(loadtest): report latency instead of rate
We previously used "rate", i.e. number of requests per second, as the
primary metric to judge loadtest results. However, this has always been
varying from run to run quite a bit, especially in CI where other jobs
possibly run on the same VM host.

The run-to-run variance has massively increased after splitting the
results up per request. Example run in CI with rate on the PR
introducing this change (on which we would expect no change at all):

| rate [1/s]                         |   main |   head |    Δ |
|:-----------------------------------|-------:|-------:|-----:|
| /                                  |    9.4 |    9.5 |   1% |
| /actors                            |  870.4 | 1023.0 |  18% |
| /actors?actor=eq.1                 |  188.5 |  198.6 |   5% |
| /actors?actor=eq.1&columns=name    |  197.3 |  167.1 | -15% |
| /actors?select=*,roles(*,films(*)) |  153.9 |  144.9 |  -6% |
| /films?columns=id,title            |  157.9 |  182.6 |  16% |
| /films?columns=id,title,year,...   |   87.0 |   87.1 |   0% |
| /roles                             |  204.5 |  267.3 |  31% |
| /rpc/call_me                       |  231.3 |  208.8 | -10% |
| /rpc/call_me?name=John             |  212.2 |  201.7 |  -5% |

From the data we can easily tell that the very reason that rate as a
paramter has only worked, so far, because the data was *heavily*
dominated by the requests on the root endpoint for OpenAPI. The longer
duration makes the request much less vulnerable for concurrent activity.
For all other requests its essentially not possible to judge the effect
of a PR this way.

One way to counter this would be to massively increase the time the
loadtest runs. More samples will result in a smoother average. However,
that's not practical for usability of CI. In the original PR #1812 I
already evaluated using the *minimum latency* as the most reliable
criteriumi, but this has never really caught on. The theory behind this
is: The variation in timings between requests is happening because of
concurrent activity, priority chosen by the scheduler, availability of
resources and such - all factors *outside* our control, and *irrelevant*
to the Haskell code we're writing.

Using the minimum latency is an estimation of how fast the code can run
*in the best case*. This might not be a number relevant for production,
but it's much more directly related to the code we write.

Here's to show how variation becomes *much* smaller with minimum latency
as the parameter:

| min latency [μs]                   |     main |   head |    Δ |
|:-----------------------------------|---------:|-------:|-----:|
| /                                  |   1275.3 | 1263.6 |  -1% |
| /actors                            |     10.0 |    9.9 |  -1% |
| /actors?actor=eq.1                 |     50.7 |   48.3 |  -5% |
| /actors?actor=eq.1&columns=name    |     54.1 |   54.0 |   0% |
| /actors?select=*,roles(*,films(*)) |     63.2 |   61.9 |  -2% |
| /films?columns=id,title            |     51.1 |   50.7 |  -1% |
| /films?columns=id,title,year,...   |    121.9 |  121.8 |   0% |
| /roles                             |     42.9 |   42.6 |  -1% |
| /rpc/call_me                       |     45.6 |   45.4 |   0% |
| /rpc/call_me?name=John             |     44.4 |   44.2 |   0% |

Since we're separating results per request now, we can only sensibly
focus on *one* parameter - otherwise this would get really clunky
UI-wise. Especially for automated CI failures, minimum latency is the
logical choice.

This commit starts using minimum latency, i.e. P0, but any percentile
should be an improvement over the status quo. A later commit will change
to a different P-value.
2026-06-01 20:49:35 +00:00
Wolfgang Walther 8a9f98371e nix(loadtest): group results by status, method and URL
Different requests hit different code paths and perform very
differently. By looking at each request type separately, we should be
able to get a much better idea of what kind of change in performance
we're looking at and where the root cause might be.

It will hopefully also allow us to migrate some of the other test-cases
into the main loadtest.
2026-06-01 20:49:35 +00:00
Wolfgang Walther 5cdf2e0569 nix(loadtest): remove noise from report
Ultimately, we only look at the `rate` column, so we can just as well
remove all other columns.

This makes the next step, when we split results by request type, much
less noisy.
2026-06-01 20:49:35 +00:00