CI runs no Go tests at all

For: whoever owns CI.
Status: proposal — .github/workflows/test.yml on branch sweep/deployment-wide-predicates, verified green, not merged.
Date: 2026-08-20

The finding

.github/workflows/images.yml is the only workflow in the repository. It builds and
publishes images. It contains no go test, no go vet, no lint.

So the framing this started from — "the two-tenant tests skip because TEST_DATABASE_URL is
unset in CI" — is too narrow. Setting that variable would have changed nothing, because there
was no job to set it on. No Go test in this repository is enforced by CI. The DB-backed ones
are not a special case; they are just the ones whose skip is visible in a local run.

Why it surfaced now

TestTenantWithSSOOffIsOfferedNoIdPStepUp pins a security guard: a tenant that has opted out of
SSO must not be offered step-up-via-IdP. It reports PASS on a run that never executes it,
because it skips without a database.

That test was the evidence for merging c99e02e1. The merge was still correct — Deployment ran
it against a real Postgres, and against a neutered build to confirm it fails — but that was a
person choosing to check, not a pipeline.

38 skip lines in ./internal/auth/... ./internal/operator/ alone when no database is
reachable. Every one of those is a test that would report success in CI while proving nothing.

The proposal

.github/workflows/test.yml — one job, go vet then go test:

• pgvector/pgvector:pg17, not postgres:alpine. The migration set creates a vector
  column; plain Postgres answers extension "vector" is not available and every DB-backed test
  fails at migration. (Found the hard way — Deployment hit it with postgres:16-alpine.)
• -p 1. Packages share one database and one public schema; in parallel they stamp on each
  other and produce failures that look like product bugs.
• A named -skip list of the 13 tests that fail on main today (dms/esign/workflow
  adapters, pre-existing, unrelated to any current branch). A job that is red on its first run
  gets muted within a week. The list is meant to shrink — each name is a small piece of work, and
  deleting a line is how that gets recorded.
• A skip-guard step. If any test in auth/operator skips for want of a database, the job
  fails. Without it, a broken service container reproduces exactly the problem this file exists
  to fix: a green log that proves nothing.

Verified before proposing

At c99e02e1, fresh pgvector/pgvector:pg17:

go vet ./...            → clean
go test ./... -p 1 -skip '<the 13>'  → fully green, zero failures
skip-guard, DB present  → 0
skip-guard, DB absent   → 38   (the guard fires)

What I did not decide

Whether this belongs as its own workflow or a job inside images.yml; whether it should gate
merges; and whether the 13 exclusions should instead be fixed first. Those are CI's calls, not
mine — the file is a starting point, not a merge request.