fix: repair CI migration and release smoke checks

Author: 1012839419a-alt

.github/workflows/ci.yml

@@ -102,7 +102,6 @@ jobs:
     env:
       API_AUTH_TOKEN: ci-release-token
       BOOTSTRAP_ADMIN_TOKEN: ci-bootstrap-admin-token
-      SECRET_KEY: ci-release-secret
       CREDENTIAL_ENCRYPTION_KEY: MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA=
       COMPOSE_PROJECT_NAME: opencli-admin-ci
     steps:
@@ -111,6 +110,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Generate ephemeral test secret
+        run: echo "SECRET_KEY=$(openssl rand -hex 32)" >> "$GITHUB_ENV"
+
       - name: Validate Compose
         run: docker compose --env-file .env.docker.example -f docker-compose.yml -f docker-compose.build.yml config --quiet
 
@@ -259,7 +261,7 @@ jobs:
       # rot (dropped columns with no re-add, wrong op order, etc.).
       - name: alembic downgrade/upgrade smoke test
         run: |
-          alembic downgrade -1
+          alembic downgrade p3q4r5s6t7u8
           alembic upgrade head
 
       - name: Native intelligence and event spine PostgreSQL conformance

.github/workflows/release.yml

@@ -164,7 +164,6 @@ jobs:
     env:
       API_AUTH_TOKEN: ci-release-token
       BOOTSTRAP_ADMIN_TOKEN: ci-bootstrap-admin-token
-      SECRET_KEY: ci-release-secret
       CREDENTIAL_ENCRYPTION_KEY: MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA=
       COMPOSE_PROJECT_NAME: opencli-admin-release-${{ github.run_id }}-${{ github.run_attempt }}
       DOCKER_IMAGE_NAMESPACE: ${{ github.repository_owner }}
@@ -183,6 +182,9 @@ jobs:
         with:
           python-version: "3.13"
 
+      - name: Generate ephemeral test secret
+        run: echo "SECRET_KEY=$(openssl rand -hex 32)" >> "$GITHUB_ENV"
+
       - name: Log in to GHCR
         uses: docker/login-action@v3
         with:

docker-compose.yml

@@ -437,7 +437,7 @@ services:
     environment:
       ODP_QUERY_HOST: 0.0.0.0
       ODP_QUERY_PORT: 8042
-      ODP_QUERY_DATABASE_URL: postgresql://${POSTGRES_USER:-opencli}:${POSTGRES_PASSWORD:-opencli_secret}@postgres:5432/${POSTGRES_DB:-opencli_admin}
+      ODP_QUERY_DATABASE_URL: postgresql://${POSTGRES_USER:-opencli}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env or run scripts/install.sh}@postgres:5432/${POSTGRES_DB:-opencli_admin}
       ODP_QUERY_ADMIN_CREDENTIAL: ${ODP_QUERY_ADMIN_CREDENTIAL:-}
       ODP_QUERY_CURSOR_SECRET: ${ODP_QUERY_CURSOR_SECRET:-}
       RUST_LOG: info,odp_query=debug

tests/unit/test_migration_heads.py

@@ -1,3 +1,4 @@
+import re
 import sqlite3
 from pathlib import Path
 from tempfile import TemporaryDirectory
@@ -16,6 +17,18 @@ def test_alembic_has_one_head():
     assert ScriptDirectory.from_config(config).get_heads() == ["q4r5s6t7u8v9"]
 
 
+def test_ci_downgrade_target_is_unambiguous():
+    workflow = Path(".github/workflows/ci.yml").read_text(encoding="utf-8")
+    target = re.search(r"alembic downgrade (\S+)", workflow)
+    assert target is not None
+
+    config = Config()
+    config.set_main_option("script_location", "backend/migrations")
+    script = ScriptDirectory.from_config(config)
+
+    assert script._downgrade_revs(target.group(1), tuple(script.get_heads()))
+
+
 def test_upgrade_head_creates_identity_and_operations_tables(monkeypatch):
     with TemporaryDirectory() as directory:
         database = Path(directory) / "migration.db"

tests/unit/test_public_release_contract.py

@@ -338,6 +338,7 @@ def test_source_and_release_smokes_gate_daemon_recovery_before_release() -> None
 def test_public_release_keeps_existing_security_and_packaging_guards() -> None:
     workflow = source(".github/workflows/ci.yml")
     release_workflow = source(".github/workflows/release.yml")
+    compose = source("docker-compose.yml")
     windows_installer = source("scripts/install.ps1")
     unix_installer = source("scripts/install.sh")
 
@@ -357,3 +358,10 @@ def test_public_release_keeps_existing_security_and_packaging_guards() -> None:
     assert "packages: write" in release_workflow
     assert "id-token: write" not in release_workflow
     assert "Source Recovery Smoke" in workflow
+    ephemeral_secret = 'echo "SECRET_KEY=$(openssl rand -hex 32)" >> "$GITHUB_ENV"'
+    assert ephemeral_secret in workflow
+    assert ephemeral_secret in release_workflow
+    assert "ci-release-secret" not in workflow
+    assert "ci-release-secret" not in release_workflow
+    assert "ODP_QUERY_DATABASE_URL" in compose
+    assert "${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD" in compose