github-actions-ingester 0.2.0__tar.gz → 0.2.1__tar.gz

{github_actions_ingester-0.2.0 → github_actions_ingester-0.2.1}/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project
 adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.2.1] — 2026-09-05
+
+### Added
+- Chart: `deploymentAnnotations`, for a Reloader annotation on the
+  Deployment.
+
+### Fixed
+- A read role with a name different from the schema could not resolve the
+  views by bare name, and the Grafana PostgreSQL datasource has no
+  search_path setting. After granting read access the ingester now sets
+  the database's default `search_path` to the schema (needs the ingester
+  role to own the database; skipped with a warning otherwise).
+
 ## [0.2.0] — 2026-09-05
 
 ### Added

{github_actions_ingester-0.2.0 → github_actions_ingester-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github-actions-ingester
-Version: 0.2.0
+Version: 0.2.1
 Summary: Standalone GitHub Actions ingester — pulls workflows, runs and jobs from the GitHub API into PostgreSQL for Grafana dashboards, FinOps and alerting. Prometheus /metrics for ingester health and scheduled-workflow liveness.
 Project-URL: Homepage, https://github.com/danielgines/github-actions-ingester
 Project-URL: Repository, https://github.com/danielgines/github-actions-ingester
@@ -162,7 +162,11 @@ table and view after each migration run, plus a default privilege so
 tables added by later migrations are readable too. Point Grafana at the
 database with one of those roles and it never needs the ingester's
 credentials. The roles themselves are created by whoever manages the
-database (the ingester never runs `CREATE ROLE`).
+database (the ingester never runs `CREATE ROLE`). In the same step the
+ingester sets the database's default `search_path` to the schema, so a
+Grafana datasource (which cannot send one) resolves the views by bare
+name; that statement needs the ingester's role to own the database, and
+is skipped with a warning otherwise.
 
 ### Tables and views
 

{github_actions_ingester-0.2.0 → github_actions_ingester-0.2.1}/README.md

@@ -99,7 +99,11 @@ table and view after each migration run, plus a default privilege so
 tables added by later migrations are readable too. Point Grafana at the
 database with one of those roles and it never needs the ingester's
 credentials. The roles themselves are created by whoever manages the
-database (the ingester never runs `CREATE ROLE`).
+database (the ingester never runs `CREATE ROLE`). In the same step the
+ingester sets the database's default `search_path` to the schema, so a
+Grafana datasource (which cannot send one) resolves the views by bare
+name; that statement needs the ingester's role to own the database, and
+is skipped with a warning otherwise.
 
 ### Tables and views
 

{github_actions_ingester-0.2.0 → github_actions_ingester-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "github-actions-ingester"
-version = "0.2.0"
+version = "0.2.1"
 description = "Standalone GitHub Actions ingester — pulls workflows, runs and jobs from the GitHub API into PostgreSQL for Grafana dashboards, FinOps and alerting. Prometheus /metrics for ingester health and scheduled-workflow liveness."
 readme = "README.md"
 requires-python = ">=3.11"

{github_actions_ingester-0.2.0 → github_actions_ingester-0.2.1}/src/github_actions_ingester/__init__.py

@@ -6,4 +6,4 @@ its own, and exposes Prometheus metrics about the ingestion itself and
 about the liveness of scheduled workflows.
 """
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"

{github_actions_ingester-0.2.0 → github_actions_ingester-0.2.1}/src/github_actions_ingester/store.py

@@ -200,8 +200,45 @@ class Store:
                 )
                 granted.append(role)
         logger.info("store.read_access_granted", roles=granted, schema=self._schema)
+        self._set_database_search_path()
         return granted
 
+    def _set_database_search_path(self) -> None:
+        """Make the schema resolve by bare name for every session on the database.
+
+        The ingester sets ``search_path`` on its own connections, and a role
+        named like the schema gets it for free (``"$user"`` is first in the
+        default path), which is why the Compose example works without this.
+        A read role with a different name (``grafana`` reading schema
+        ``gha``) resolves ``minion_workflow_runs`` to nothing, and the
+        Grafana PostgreSQL datasource has no search_path setting.
+
+        ``ALTER DATABASE ... SET`` needs the database owner. When the ingester
+        is not the owner this logs and moves on: the grants above still hold,
+        and the operator can run the statement once by hand.
+        """
+        conn = self.connect()
+        try:
+            with conn.transaction(), conn.cursor() as cur:
+                cur.execute("SELECT current_database() AS db")
+                row = cur.fetchone()
+                database = row["db"] if row else ""
+                cur.execute(
+                    sql.SQL("ALTER DATABASE {} SET search_path TO {}, public").format(
+                        sql.Identifier(database), sql.Identifier(self._schema)
+                    )
+                )
+        except psycopg.errors.InsufficientPrivilege:
+            conn.rollback()
+            logger.warning(
+                "store.search_path_not_set",
+                schema=self._schema,
+                hint="ingester role does not own the database; run "
+                "ALTER DATABASE <db> SET search_path TO <schema>, public as the owner",
+            )
+            return
+        logger.info("store.search_path_set", schema=self._schema)
+
     def schema_version(self) -> int | None:
         """Highest applied migration, or None when the schema was never bootstrapped."""
         conn = self.connect()

{github_actions_ingester-0.2.0 → github_actions_ingester-0.2.1}/tests/test_store.py

@@ -250,7 +250,10 @@ def test_grant_read_access_lets_a_role_read_views_and_future_tables(
         schema = migrated_store.schema
         reader_url = re.sub(r"//[^@]*@", f"//{role}:reader@", _with_userinfo(database_url))
         with psycopg.connect(reader_url, autocommit=True) as reader:
-            reader.execute(f"SET search_path TO {schema}")
+            # No SET search_path on purpose: Grafana cannot send one, so the
+            # database-level default the ingester sets must resolve the views.
+            path = reader.execute("SHOW search_path").fetchone()[0]
+            assert path.split(",")[0].strip().strip('"') == schema
             assert reader.execute("SELECT count(*) FROM minion_workflow_runs").fetchone()[0] == 0
             assert reader.execute("SELECT count(*) FROM workflow_jobs").fetchone()[0] == 0
             assert reader.execute("SELECT count(*) FROM later_migration").fetchone()[0] == 0
@@ -262,6 +265,8 @@ def test_grant_read_access_lets_a_role_read_views_and_future_tables(
         with psycopg.connect(database_url, autocommit=True) as admin:
             admin.execute(f"DROP OWNED BY {role}")
             admin.execute(f"DROP ROLE {role}")
+            db = admin.execute("SELECT current_database()").fetchone()[0]
+            admin.execute(f'ALTER DATABASE "{db}" RESET search_path')
 
 
 def test_grant_read_access_requires_an_existing_role(migrated_store: Store) -> None: