chore(ci): fail closed on missing test Redis in CI and skip unused pg16 service (#8938)

- readTestRedisUrl throws when CI is set and TEST_REDIS_URL is missing, so
  Redis-gated integration suites can no longer pass by skipping
- start the postgres:16 service only on integration (push, 1/4), the one job
  whose step uses it
- move the two env-gated smoke files that no workflow enables to *.live.test.ts
  and shrink the test-patterns baseline accordingly

Author: waleedlatif1

.claude/rules/sim-testing.md

@@ -33,7 +33,7 @@ contracts, and demonstrated regressions.
 | Suffix | Needs | Run with | In CI |
 |--------|-------|----------|-------|
 | `*.test.ts(x)` | nothing; global mocks from `vitest.setup.ts` | `bun run --cwd <workspace> test` | `test` jobs |
-| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), optionally Redis (`TEST_REDIS_URL`) | `bun run --cwd <workspace> test --mode integration` | `integration` jobs, by glob (sharded per provisioning path) |
+| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), Redis (`TEST_REDIS_URL`; optional locally, required in CI) | `bun run --cwd <workspace> test --mode integration` | `integration` jobs, by glob (sharded per provisioning path) |
 | `*.live.test.ts` | provider APIs, hosted sandboxes, local runtimes, or sibling checkouts | `bun run --cwd apps/sim test --mode live <file>` | never |
 | `apps/desktop/e2e/*.spec.ts` | the packaged Electron app | Playwright | desktop E2E workflow |
 | `apps/sim/scripts/test-*-e2e.ts` | a running app over HTTP | its `package.json` script when one exists (`bun run test:scim:e2e`; `test:workflow-version-compare:e2e` adds `--no-env-file`), else `bun scripts/test-<suite>-e2e.ts` from apps/sim | `e2e` jobs (`.github/scripts/http-e2e.sh`) |

.cursor/rules/sim-testing.mdc

@@ -31,7 +31,7 @@ contracts, and demonstrated regressions.
 | Suffix | Needs | Run with | In CI |
 |--------|-------|----------|-------|
 | `*.test.ts(x)` | nothing; global mocks from `vitest.setup.ts` | `bun run --cwd <workspace> test` | `test` jobs |
-| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), optionally Redis (`TEST_REDIS_URL`) | `bun run --cwd <workspace> test --mode integration` | `integration` jobs, by glob (sharded per provisioning path) |
+| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), Redis (`TEST_REDIS_URL`; optional locally, required in CI) | `bun run --cwd <workspace> test --mode integration` | `integration` jobs, by glob (sharded per provisioning path) |
 | `*.live.test.ts` | provider APIs, hosted sandboxes, local runtimes, or sibling checkouts | `bun run --cwd apps/sim test --mode live <file>` | never |
 | `apps/desktop/e2e/*.spec.ts` | the packaged Electron app | Playwright | desktop E2E workflow |
 | `apps/sim/scripts/test-*-e2e.ts` | a running app over HTTP | its `package.json` script when one exists (`bun run test:scim:e2e`; `test:workflow-version-compare:e2e` adds `--no-env-file`), else `bun scripts/test-<suite>-e2e.ts` from apps/sim | `e2e` jobs (`.github/scripts/http-e2e.sh`) |

.github/workflows/checks.yml

@@ -49,8 +49,9 @@ jobs:
           --health-interval 5s
           --health-timeout 5s
           --health-retries 10
+      # Only push/1 runs the PostgreSQL 16 step below; an empty image skips the service elsewhere.
       postgres-legacy:
-        image: postgres:16-alpine
+        image: ${{ matrix.provision == 'push' && matrix.shard == 1 && 'postgres:16-alpine' || '' }}
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres

…agent-cli/csv-workflow-execution.test.ts …-cli/csv-workflow-execution.live.test.tsapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts renamed to apps/sim/lib/mothership/agent-cli/csv-workflow-execution.live.test.ts apps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts renamed to apps/sim/lib/mothership/agent-cli/csv-workflow-execution.live.test.ts

@@ -1,11 +1,11 @@
 /**
  * Environment contract for the real-infrastructure test layer (`*.integration.ts`).
  *
- * `TEST_DATABASE_URL` names a disposable PostgreSQL database and `TEST_REDIS_URL` an optional
- * disposable Redis. Both must use a loopback host, and the database name must contain a `test`
- * segment (`sim_test`, `sim_test_knowledge`, `sim_workflow_test`), so a stray shell variable can
- * never point destructive fixtures at a real database. Every integration run's setup file calls
- * these readers before any suite loads.
+ * `TEST_DATABASE_URL` names a disposable PostgreSQL database and `TEST_REDIS_URL` a disposable
+ * Redis (optional locally, required in CI). Both must use a loopback host, and the database name
+ * must contain a `test` segment (`sim_test`, `sim_test_knowledge`, `sim_workflow_test`), so a stray
+ * shell variable can never point destructive fixtures at a real database. Every integration run's
+ * setup file calls these readers before any suite loads.
  */
 const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]'])
 const DISPOSABLE_DATABASE_NAME = /(^|_)test(_|$)/
@@ -39,15 +39,23 @@ export function readTestDatabaseUrl(): string {
 }
 
 /**
- * Returns the validated `TEST_REDIS_URL`, or undefined when the run has no Redis.
+ * Returns the validated `TEST_REDIS_URL`, or undefined when a local run has no Redis. In CI a
+ * missing value throws: every Redis-gated suite would otherwise pass by skipping.
  *
  * Any query string is rejected, not just `username`/`password` params: Redis clients read
  * connection options (credentials, TLS, sentinels) from it, so an allowlist would have to track
  * each client's option set, and a local disposable Redis never needs one.
  */
 export function readTestRedisUrl(): string | undefined {
   const value = process.env.TEST_REDIS_URL
-  if (!value) return undefined
+  if (!value) {
+    if (process.env.CI) {
+      throw new Error(
+        'Set TEST_REDIS_URL in CI: Redis-gated integration suites would silently skip'
+      )
+    }
+    return undefined
+  }
   const url = new URL(value)
   if (
     url.protocol !== 'redis:' ||

…sim/providers/conversation-smoke.test.ts …roviders/conversation-smoke.live.test.tsapps/sim/providers/conversation-smoke.test.ts renamed to apps/sim/providers/conversation-smoke.live.test.ts apps/sim/providers/conversation-smoke.test.ts renamed to apps/sim/providers/conversation-smoke.live.test.ts

@@ -49,26 +49,6 @@
   "local-factory\tapps/sim/executor/execution/block-executor.test.ts\t@/lib/logs/execution/pii-redaction",
   "local-factory\tapps/sim/executor/utils/output-filter.test.ts\t@/blocks",
   "local-factory\tapps/sim/lib/mcp/workflow-mcp-sync.test.ts\t@/lib/mcp/pubsub",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/api/server/routes/v2-api-key-auth",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/core/rate-limiter",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/execution/preprocessing",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/execution/remote-sandbox",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/internal/principals/executor",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/logs/execution/logging-session",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/public-shares/share-manager",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/uploads/contexts/workspace",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/uploads/contexts/workspace/workspace-file-manager",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/uploads/core/storage-service",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/uploads/server/metadata",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/uploads/utils/file-utils.server",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/users/queries",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/workflows/application/context",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/workflows/custom-blocks/operations",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/workflows/executor/human-in-the-loop-manager",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/workflows/persistence/utils",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/workflows/utils",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@/lib/workspaces/application/workspace-context",
-  "local-factory\tapps/sim/lib/mothership/agent-cli/csv-workflow-execution.test.ts\t@sim/platform-authz/workspace",
   "local-factory\tapps/sim/lib/mothership/chat/application/use-cases.test.ts\t@/lib/core/application/workspace-authorization",
   "local-factory\tapps/sim/lib/mothership/chat/payload.test.ts\t@/tools/utils",
   "local-factory\tapps/sim/lib/mothership/request/application/recover-stream.test.ts\t@/lib/core/application/workspace-authorization",