@shipfox/api-workflows 4.0.0 → 6.0.0

package/src/temporal/activities/orchestration-activities.test.ts

@@ -5,6 +5,7 @@ import {
   getJobsByWorkflowRunId,
   updateJobExecutionStatus,
 } from '#db/index.js';
+import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
 import {stripSetupStep} from '#test/fixtures/strip-setup-step.js';
 import {workflowModel} from '#test/index.js';
 import {resolveLeaseExpiredJobExecutionActivity, setJobStatus} from './orchestration-activities.js';
@@ -12,6 +13,7 @@ import {resolveLeaseExpiredJobExecutionActivity, setJobStatus} from './orchestra
 let workspaceId: string;
 let projectId: string;
 let definitionId: string;
+const secrets = createTestSecretsClient();
 
 beforeEach(() => {
   workspaceId = crypto.randomUUID();
@@ -51,10 +53,10 @@ describe('resolveLeaseExpiredJobExecutionActivity', () => {
     // reproduce a genuinely stepless (malformed) job.
     await stripSetupStep(jobId);
 
-    const error = await resolveLeaseExpiredJobExecutionActivity({
-      jobExecutionId,
-      expectedVersion: runningVersion,
-    }).catch((err: unknown) => err);
+    const error = await resolveLeaseExpiredJobExecutionActivity(
+      {jobExecutionId, expectedVersion: runningVersion},
+      secrets,
+    ).catch((err: unknown) => err);
 
     expect(error).toBeInstanceOf(ApplicationFailure);
     expect((error as ApplicationFailure).nonRetryable).toBe(true);
@@ -63,10 +65,10 @@ describe('resolveLeaseExpiredJobExecutionActivity', () => {
   test('a well-formed job resolves without raising', async () => {
     const {jobExecutionId, runningVersion} = await seedRunningJob(2);
 
-    const result = await resolveLeaseExpiredJobExecutionActivity({
-      jobExecutionId,
-      expectedVersion: runningVersion,
-    });
+    const result = await resolveLeaseExpiredJobExecutionActivity(
+      {jobExecutionId, expectedVersion: runningVersion},
+      secrets,
+    );
 
     expect(result.status).toBe('failed');
   });

package/src/temporal/activities/orchestration-activities.ts

@@ -1,4 +1,12 @@
-import {cancelRunnerJobs, enqueueJobExecution, releaseJobExecution} from '@shipfox/api-runners';
+import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import {
+  type RunnersInterModuleClient,
+  runnersInterModuleContract,
+} from '@shipfox/api-runners-dto/inter-module';
+import type {SecretsInterModuleClient} from '@shipfox/api-secrets-dto/inter-module';
+import {isInterModuleKnownError} from '@shipfox/inter-module';
 import {ApplicationFailure} from '@temporalio/common';
 import {defaultJobConditionTrace} from '#core/condition-trace.js';
 import type {JobStatus, JobStatusReason, ResolutionReason} from '#core/entities/job.js';
@@ -161,17 +169,21 @@ function jobStatusEvaluationTrace(params: {
     : undefined;
 }
 
-export async function setJobExecutionStatus(params: {
-  jobExecutionId: string;
-  status: Exclude<JobStatus, 'skipped'>;
-  version: number;
-  statusReason?: JobStatusReason | null | undefined;
-}): Promise<{newVersion: number; status: Exclude<JobStatus, 'skipped'>}> {
+export async function setJobExecutionStatus(
+  params: {
+    jobExecutionId: string;
+    status: Exclude<JobStatus, 'skipped'>;
+    version: number;
+    statusReason?: JobStatusReason | null | undefined;
+  },
+  secrets?: Pick<SecretsInterModuleClient, 'getVariablesByNamespace'>,
+): Promise<{newVersion: number; status: Exclude<JobStatus, 'skipped'>}> {
   const updated = await updateJobExecutionStatus({
     jobExecutionId: params.jobExecutionId,
     status: params.status,
     expectedVersion: params.version,
     statusReason: params.statusReason,
+    secrets,
   });
   return {newVersion: updated.version, status: updated.status};
 }
@@ -183,12 +195,12 @@ export async function bulkSetStepStatuses(params: {
   await bulkUpdateStepStatuses(params);
 }
 
-export async function resolveLeaseExpiredJobExecutionActivity(params: {
-  jobExecutionId: string;
-  expectedVersion: number;
-}): Promise<{status: RuntimeCompletionStatus; executionVersion: number}> {
+export async function resolveLeaseExpiredJobExecutionActivity(
+  params: {jobExecutionId: string; expectedVersion: number},
+  secrets: Pick<SecretsInterModuleClient, 'getVariablesByNamespace'>,
+): Promise<{status: RuntimeCompletionStatus; executionVersion: number}> {
   try {
-    return await resolveJobExecutionAfterLeaseExpiry(params);
+    return await resolveJobExecutionAfterLeaseExpiry({...params, secrets});
   } catch (err) {
     if (err instanceof JobNotFoundError) {
       throw ApplicationFailure.nonRetryable(err.message, err.name);
@@ -200,50 +212,56 @@ export async function resolveLeaseExpiredJobExecutionActivity(params: {
 // Best-effort lease cleanup on job finalization. Idempotent: deleting an
 // already-released (or already-reaped) lease is a no-op. The workflow wraps the
 // call so a persistent failure never blocks the DAG result.
-export async function releaseLeaseActivity(params: {jobExecutionId: string}): Promise<void> {
-  await releaseJobExecution({jobExecutionId: params.jobExecutionId});
+export function createReleaseLeaseActivity(runners: RunnersInterModuleClient) {
+  return async function releaseLeaseActivity(params: {jobExecutionId: string}): Promise<void> {
+    await runners.releaseJobExecution({jobExecutionId: params.jobExecutionId});
+  };
 }
 
-export async function enqueueJobExecutionForRunner(params: {
-  workspaceId: string;
-  workflowRunId: string;
-  jobId: string;
-  jobExecutionId: string;
-  runAttemptId: string;
-  projectId: string;
-  requiredLabels: string[];
-}): Promise<void> {
-  try {
-    await enqueueJobExecution({
-      workspaceId: params.workspaceId,
-      workflowRunId: params.workflowRunId,
-      workflowRunAttemptId: params.runAttemptId,
-      jobId: params.jobId,
-      jobExecutionId: params.jobExecutionId,
-      projectId: params.projectId,
-      requiredLabels: params.requiredLabels,
-    });
-  } catch (err) {
-    if (err instanceof Error && err.name === 'EmptyRequiredLabelsError') {
-      throw ApplicationFailure.nonRetryable(err.message, err.name);
+export function createEnqueueJobExecutionForRunner(runners: RunnersInterModuleClient) {
+  return async function enqueueJobExecutionForRunner(params: {
+    workspaceId: string;
+    workflowRunId: string;
+    jobId: string;
+    jobExecutionId: string;
+    runAttemptId: string;
+    projectId: string;
+    requiredLabels: string[];
+  }): Promise<void> {
+    try {
+      await runners.enqueueJobExecution({
+        workspaceId: params.workspaceId,
+        workflowRunId: params.workflowRunId,
+        workflowRunAttemptId: params.runAttemptId,
+        jobId: params.jobId,
+        jobExecutionId: params.jobExecutionId,
+        projectId: params.projectId,
+        requiredLabels: params.requiredLabels,
+      });
+    } catch (err) {
+      if (isInterModuleKnownError(runnersInterModuleContract.methods.enqueueJobExecution, err)) {
+        throw ApplicationFailure.nonRetryable(err.message, err.name);
+      }
+      throw err;
     }
-    throw err;
-  }
+  };
 }
 
-export async function cancelRunnerJobsActivity(params: {jobIds: string[]}): Promise<void> {
-  await cancelRunnerJobs({jobIds: params.jobIds});
+export function createCancelRunnerJobsActivity(runners: RunnersInterModuleClient) {
+  return async function cancelRunnerJobsActivity(params: {jobIds: string[]}): Promise<void> {
+    await runners.cancelJobs(params);
+  };
 }
 
-export async function failJobExecutionAsTimedOutActivity(params: {
-  jobExecutionId: string;
-  runAttemptId: string;
-  expectedVersion: number;
-}): Promise<{newVersion: number}> {
+export async function failJobExecutionAsTimedOutActivity(
+  params: {jobExecutionId: string; runAttemptId: string; expectedVersion: number},
+  secrets: Pick<SecretsInterModuleClient, 'getVariablesByNamespace'>,
+): Promise<{newVersion: number}> {
   const jobExecution = await failJobExecutionAsTimedOut({
     jobExecutionId: params.jobExecutionId,
     workflowRunAttemptId: params.runAttemptId,
     expectedVersion: params.expectedVersion,
+    secrets,
   });
   return {newVersion: jobExecution.version};
 }
@@ -265,12 +283,18 @@ export async function activateJobListenerActivity(params: {
   return await activateJobListener(params);
 }
 
-export async function drainListenerEventsActivity(params: {
-  jobId: string;
-  expectedSequence: number;
-  maxSize?: number | undefined;
+export function createDrainListenerEventsActivity(clients: {
+  agent: AgentInterModuleClient;
+  integrations?: IntegrationsModuleClient | undefined;
+  projects?: ProjectsModuleClient | undefined;
 }) {
-  return await drainListenerEventsIntoExecution(params);
+  return async function drainListenerEventsActivity(params: {
+    jobId: string;
+    expectedSequence: number;
+    maxSize?: number | undefined;
+  }) {
+    return await drainListenerEventsIntoExecution({...params, ...clients});
+  };
 }
 
 export async function peekListenerBufferActivity(params: {jobId: string}) {

package/src/temporal/workflows/job-execution-orchestration.test.ts

@@ -22,7 +22,7 @@ const WORKFLOWS_PATH = resolve(import.meta.dirname, '../../../dist/temporal/work
 
 beforeAll(async () => {
   await setupEnv();
-}, 60_000);
+}, 15_000);
 
 afterAll(async () => {
   await teardownEnv();
@@ -43,7 +43,9 @@ const defaultJobInput = {
   requiredLabels: ['ubuntu22'],
 };
 
-function executeJob(input: typeof defaultJobInput): Promise<{status: string; jobVersion: number}> {
+function executeJob(
+  input: typeof defaultJobInput & {executionTimeoutMs?: number | undefined},
+): Promise<{status: string; jobVersion: number}> {
   const normalized = {
     ...input,
     jobExecutionId:
@@ -297,6 +299,49 @@ describe('jobExecutionOrchestration', () => {
     expect(callsNamed('releaseLeaseActivity').length).toBeGreaterThanOrEqual(1);
   });
 
+  test('times out after the execution deadline and fails its steps without releasing the lease', async () => {
+    setCfg({
+      dag: makeDag([dagJob('job-timeout', 'build')]),
+      jobResults: new Map(),
+      skipSignal: true,
+    });
+
+    const result = await executeJob({
+      ...defaultJobInput,
+      jobId: 'job-timeout',
+      executionTimeoutMs: 250,
+    });
+
+    expect(result.status).toBe('failed');
+    expect(callsNamed('failJobExecutionAsTimedOutActivity')).toHaveLength(1);
+    expect(finalStatusesFor('job-timeout')).toEqual(['running']);
+    expect(callsNamed('bulkSetStepStatuses')).toContainEqual({
+      name: 'bulkSetStepStatuses',
+      params: {jobExecutionId: 'job-timeout', status: 'failed'},
+    });
+    expect(callsNamed('releaseLeaseActivity')).toHaveLength(0);
+    expect(callsNamed('resolveLeaseExpiredJobExecutionActivity')).toHaveLength(0);
+  });
+
+  test('surfaces a timeout activity failure', async () => {
+    setCfg({
+      dag: makeDag([dagJob('job-timeout-error', 'build')]),
+      jobResults: new Map(),
+      skipSignal: true,
+      failJobExecutionAsTimedOutError: 'simulated DB outage',
+    });
+
+    await expect(
+      executeJob({
+        ...defaultJobInput,
+        jobId: 'job-timeout-error',
+        executionTimeoutMs: 250,
+      }),
+    ).rejects.toThrow();
+
+    expect(finalStatusesFor('job-timeout-error')).toEqual(['running']);
+  });
+
   test('no signal — workflow stays blocked indefinitely', async () => {
     setCfg({dag: makeDag([]), jobResults: new Map(), skipSignal: true});
 

package/test/env.ts

@@ -4,8 +4,6 @@ process.env.POSTGRES_USERNAME ??= 'shipfox';
 process.env.POSTGRES_PASSWORD ??= 'password';
 process.env.POSTGRES_DATABASE = 'api_test';
 process.env.POSTGRES_MAX_CONNECTIONS ??= '5';
-process.env.AUTH_JWT_SECRET = 'test-secret';
-process.env.AUTH_JOB_LEASE_TOKEN_SECRET = 'test-lease-secret';
-process.env.AUTH_RUNNER_SESSION_TOKEN_SECRET = 'test-runner-session-secret';
+process.env.AUTH_ROOT_KEY = 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=';
 process.env.SECRETS_ENCRYPTION_KEK = 'ZmVkY2JhOTg3NjU0MzIxMGZlZGNiYTk4NzY1NDMyMTA=';
 process.env.TZ = 'UTC';

package/test/factories/project.ts

@@ -1,10 +1,15 @@
-import type {Project} from '@shipfox/api-projects';
 import {Factory} from 'fishery';
 
-// Build-only: the workflows routes resolve projects through a mocked
-// `getProjectById`, so these are never persisted (the projects table lives in
-// @shipfox/api-projects). Typed against the real `Project` so the mock cannot
-// drift from the contract under test.
+interface Project {
+  id: string;
+  workspaceId: string;
+  sourceConnectionId: string;
+  sourceExternalRepositoryId: string;
+  name: string;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
 export const projectFactory = Factory.define<Project>(({sequence}) => ({
   id: crypto.randomUUID(),
   workspaceId: crypto.randomUUID(),

package/test/factories/workflow-model.test.ts

@@ -1,3 +1,4 @@
+import type {WorkflowModel} from '@shipfox/api-definitions-dto';
 import {workflowModel} from './workflow-model.js';
 
 describe('workflowModel', () => {
@@ -21,6 +22,9 @@ describe('workflowModel', () => {
       },
     });
 
-    expect(model.jobs.map((job) => job.runner)).toEqual([['ubuntu-22'], ['ubuntu-22', 'node-22']]);
+    expect(model.jobs.map((job: WorkflowModel['jobs'][number]) => job.runner)).toEqual([
+      ['ubuntu-22'],
+      ['ubuntu-22', 'node-22'],
+    ]);
   });
 });

package/test/factories/workflow-model.ts

@@ -1,4 +1,4 @@
-import {DEFAULT_JOB_CHECKOUT, type WorkflowModel} from '@shipfox/api-definitions';
+import {DEFAULT_JOB_CHECKOUT, type WorkflowModel} from '@shipfox/api-definitions-dto';
 import {
   createWorkflowExpression,
   parseWorkflowTemplate,

package/test/factories/workflow-run.ts

@@ -1,4 +1,4 @@
-import type {WorkflowModel} from '@shipfox/api-definitions';
+import type {WorkflowModel} from '@shipfox/api-definitions-dto';
 import {Factory} from 'fishery';
 import type {WorkflowRun} from '#core/entities/workflow-run.js';
 import {createWorkflowRun} from '#db/workflow-runs.js';

package/test/fixtures/agent-inter-module.ts

@@ -0,0 +1,27 @@
+import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
+import type {AgentDefaultsResolver} from '#core/agent-defaults.js';
+
+export const agentTestClient: AgentInterModuleClient = {
+  resolveAgentConfig({config}) {
+    return Promise.resolve(resolveTestAgentDefaults(config));
+  },
+  resolveRuntimeCredentials({harness, provider, model, thinking}) {
+    return Promise.resolve({
+      harness,
+      provider_id: provider,
+      model,
+      thinking,
+      credentials: {api_key: 'test-agent-credential'},
+    });
+  },
+};
+
+export const resolveTestAgentDefaults: AgentDefaultsResolver = (config) => {
+  const provider = config.provider ?? 'anthropic';
+  return {
+    harness: config.harness ?? 'pi',
+    provider,
+    model: config.model ?? (provider === 'openai' ? 'gpt-5.5-pro' : 'claude-opus-4-8'),
+    thinking: config.thinking ?? 'xhigh',
+  };
+};

package/test/fixtures/annotations-inter-module.ts

@@ -0,0 +1,5 @@
+import type {AnnotationsInterModuleClient} from '@shipfox/annotations-dto/inter-module';
+
+export const annotationsTestClient: AnnotationsInterModuleClient = {
+  replaceOrRemoveAnnotation: async () => ({}),
+};

package/test/fixtures/auth-inter-module.ts

@@ -0,0 +1,22 @@
+import {JOB_LEASE_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
+import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
+import {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';
+import {signHs256} from '@shipfox/node-jwt';
+
+const leaseSecret = jobLeaseTokenKey();
+
+export const workflowsTestAuthClient: AuthInterModuleClient = {
+  mintRunnerSessionToken() {
+    throw new Error('Runner session token minting is not configured');
+  },
+  async mintJobLeaseToken(claims) {
+    return {
+      token: await signHs256({
+        payload: claims,
+        secret: leaseSecret,
+        expiresIn: '90m',
+        audience: JOB_LEASE_TOKEN_AUDIENCE,
+      }),
+    };
+  },
+};

package/test/fixtures/lease-token.ts

@@ -1,9 +1,10 @@
 import {JOB_LEASE_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
+import {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';
 import {signHs256} from '@shipfox/node-jwt';
 import {getFirstJobExecutionByJobId} from '#db/workflow-runs.js';
 
 // Matches test/env.ts; the lease-token auth method reads this same value from config.
-const SECRET = process.env.AUTH_JOB_LEASE_TOKEN_SECRET ?? 'test-lease-secret';
+const SECRET = jobLeaseTokenKey();
 
 export interface MintLeaseTokenParams {
   jobId: string;

package/test/fixtures/projects-inter-module.ts

@@ -0,0 +1,8 @@
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+
+export const projectsTestClient = {
+  getProjectById: async () => ({project: undefined}),
+  requireProjectForWorkspace: () => {
+    throw new Error('Project is not configured');
+  },
+} as unknown as ProjectsModuleClient;

package/test/fixtures/runners-inter-module.ts

@@ -0,0 +1,52 @@
+import {runnerToolCapabilitiesSchema} from '@shipfox/api-runners-dto';
+import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
+import {sql} from 'drizzle-orm';
+import {db} from '#db/db.js';
+
+export const runnersTestClient: RunnersInterModuleClient = {
+  enqueueJobExecution() {
+    return Promise.resolve({});
+  },
+  releaseJobExecution() {
+    return Promise.resolve({});
+  },
+  cancelJobs() {
+    return Promise.resolve({});
+  },
+  async getLeaseState({jobId, jobExecutionId, runnerSessionId}) {
+    const result = await db().execute<{active: boolean}>(sql`
+      SELECT EXISTS(
+        SELECT 1
+        FROM runners_running_jobs
+        WHERE job_id = ${jobId}
+          AND job_execution_id = ${jobExecutionId}
+          AND runner_session_id = ${runnerSessionId}
+      ) AS active
+    `);
+    return {active: result.rows[0]?.active ?? false};
+  },
+  async getEffectiveRunnerToolCapabilities({runnerSessionId}) {
+    const result = await db().execute<{
+      toolCapabilities: unknown;
+      toolCapabilitiesReportedAt: Date | string | null;
+    }>(sql`
+      SELECT
+        tool_capabilities AS "toolCapabilities",
+        tool_capabilities_reported_at AS "toolCapabilitiesReportedAt"
+      FROM runners_runner_sessions
+      WHERE id = ${runnerSessionId}
+    `);
+    const row = result.rows[0];
+    const reportedAt = row?.toolCapabilitiesReportedAt;
+    const reportFresh =
+      reportedAt !== null &&
+      reportedAt !== undefined &&
+      Date.now() - new Date(reportedAt).getTime() <= 60_000;
+    return {
+      capabilities: reportFresh
+        ? runnerToolCapabilitiesSchema.parse(row?.toolCapabilities ?? {harnesses: {}})
+        : {harnesses: {}},
+      reportFresh,
+    };
+  },
+};

package/test/fixtures/secrets-inter-module.ts

@@ -0,0 +1,61 @@
+import type {SecretsInterModuleClient} from '@shipfox/api-secrets-dto/inter-module';
+
+export function createTestSecretsClient(): SecretsInterModuleClient {
+  const values = new Map<string, string>();
+  const normalize = (params: {
+    workspaceId: string;
+    projectId?: string | null | undefined;
+    namespace?: string | undefined;
+  }) => ({
+    workspaceId: params.workspaceId,
+    projectId: params.projectId ?? null,
+    namespace: params.namespace ?? '',
+  });
+  const scopeId = (params: ReturnType<typeof normalize>) =>
+    `${params.workspaceId}\0${params.projectId ?? ''}\0${params.namespace}`;
+  const keyId = (params: ReturnType<typeof normalize>, key: string) => `${scopeId(params)}\0${key}`;
+  const entries = (input: {
+    workspaceId: string;
+    projectId?: string | null | undefined;
+    namespace?: string | undefined;
+  }) => {
+    const params = normalize(input);
+    const projectScope = `${scopeId(params)}\0`;
+    const workspaceScope = `${scopeId({...params, projectId: null})}\0`;
+    const selected = new Map<string, string>();
+    for (const [id, value] of values) {
+      if (id.startsWith(workspaceScope)) selected.set(id.slice(workspaceScope.length), value);
+      if (params.projectId && id.startsWith(projectScope))
+        selected.set(id.slice(projectScope.length), value);
+    }
+    return Object.fromEntries(selected);
+  };
+
+  return {
+    getSecret: async (params) => ({
+      value:
+        values.get(keyId(normalize(params), params.key)) ??
+        (params.projectId
+          ? values.get(keyId(normalize({...params, projectId: null}), params.key))
+          : undefined) ??
+        null,
+    }),
+    getSecretsByNamespace: async (params) => ({values: entries(params)}),
+    getVariablesByNamespace: async (params) => ({values: entries(params)}),
+    setSecrets: async (params) => {
+      await Promise.resolve();
+      for (const [key, value] of Object.entries(params.values))
+        values.set(keyId(normalize(params), key), value);
+      return {};
+    },
+    deleteSecrets: async (params) => {
+      await Promise.resolve();
+      const keys = params.keys ?? Object.keys(entries(params));
+      let deleted = 0;
+      for (const key of keys) {
+        if (values.delete(keyId(normalize(params), key))) deleted += 1;
+      }
+      return {deleted};
+    },
+  };
+}

package/test/globalSetup.ts

@@ -1,8 +1,8 @@
 import './env.js';
 import {annotationsModule} from '@shipfox/annotations';
-import {agentModule} from '@shipfox/api-agent';
-import {runnersModule} from '@shipfox/api-runners';
-import {secretsModule} from '@shipfox/api-secrets';
+import {createAgentModule} from '@shipfox/api-agent';
+import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
+import {createRunnersModule} from '@shipfox/api-runners';
 import {runMigrations} from '@shipfox/node-drizzle';
 import {closePostgresClient, createPostgresClient} from '@shipfox/node-postgres';
 import {sql} from 'drizzle-orm';
@@ -10,7 +10,15 @@ import {closeDb, db, migrationsPath} from '#db/index.js';
 
 export async function setup() {
   createPostgresClient();
+  const runnersModule = createRunnersModule({auth: {} as AuthInterModuleClient});
 
+  const agentModule = createAgentModule({
+    secrets: {
+      deleteSecrets: async () => ({deleted: 0}),
+      getSecretsByNamespace: async () => ({values: {}}),
+      setSecrets: async () => ({}),
+    },
+  });
   if (!agentModule.database || Array.isArray(agentModule.database)) {
     throw new Error('Agent module database is not configured');
   }
@@ -27,14 +35,6 @@ export async function setup() {
     runnersModule.database.migrationsPath,
     '__drizzle_migrations_runners',
   );
-  if (!secretsModule.database || Array.isArray(secretsModule.database)) {
-    throw new Error('Secrets module database is not configured');
-  }
-  await runMigrations(
-    secretsModule.database.db(),
-    secretsModule.database.migrationsPath,
-    '__drizzle_migrations_secrets',
-  );
   if (!annotationsModule.database || Array.isArray(annotationsModule.database)) {
     throw new Error('Annotations module database is not configured');
   }