sync: migrate ai-operator to Gitea (2026-08-10)

internal/db/migrations.go

@@ -0,0 +1,71 @@
+package db
+
+import (
+	"context"
+	"fmt"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type MigrationResult struct {
+	Applied []string
+	Skipped []string
+}
+
+func ApplyMigrations(ctx context.Context, pool *pgxpool.Pool, files map[string]string) (MigrationResult, error) {
+	if _, err := pool.Exec(ctx, `CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY, applied_at timestamptz NOT NULL DEFAULT now())`); err != nil {
+		return MigrationResult{}, err
+	}
+	versions := make([]string, 0, len(files))
+	for v := range files {
+		versions = append(versions, v)
+	}
+	sort.Strings(versions)
+	res := MigrationResult{}
+	for _, version := range versions {
+		var exists bool
+		if err := pool.QueryRow(ctx, `SELECT EXISTS (SELECT 1 FROM schema_migrations WHERE version=$1)`, version).Scan(&exists); err != nil {
+			return res, err
+		}
+		if exists {
+			res.Skipped = append(res.Skipped, version)
+			continue
+		}
+		tx, err := pool.Begin(ctx)
+		if err != nil {
+			return res, err
+		}
+		if _, err = tx.Exec(ctx, files[version]); err != nil {
+			_ = tx.Rollback(ctx)
+			return res, fmt.Errorf("apply migration %s: %w", version, err)
+		}
+		if _, err = tx.Exec(ctx, `INSERT INTO schema_migrations(version) VALUES($1)`, version); err != nil {
+			_ = tx.Rollback(ctx)
+			return res, err
+		}
+		if err = tx.Commit(ctx); err != nil {
+			return res, err
+		}
+		res.Applied = append(res.Applied, version)
+	}
+	return res, nil
+}
+
+func LoadMigrationFiles(paths []string, read func(string) ([]byte, error)) (map[string]string, error) {
+	out := map[string]string{}
+	for _, p := range paths {
+		b, err := read(p)
+		if err != nil {
+			return nil, err
+		}
+		name := filepath.Base(p)
+		if !strings.HasSuffix(name, ".sql") {
+			continue
+		}
+		out[name] = string(b)
+	}
+	return out, nil
+}

internal/db/migrations_test.go

@@ -0,0 +1,25 @@
+package db
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestAuditMigrationSafety(t *testing.T) {
+	b, err := os.ReadFile("/opt/ai-operator/migrations/003_audit_tables.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := strings.ToUpper(string(b))
+	for _, bad := range []string{"DROP TABLE", "DROP DATABASE", "TRUNCATE", "DELETE FROM"} {
+		if strings.Contains(s, bad) {
+			t.Fatalf("migration contains destructive SQL: %s", bad)
+		}
+	}
+	for _, table := range []string{"ai_calls", "ai_call_events", "ai_transcript_events", "ai_tool_audit", "ai_kb_audit", "ai_handoff_audit", "ai_provider_audit", "ai_media_audit", "ai_audit_retention_runs"} {
+		if !strings.Contains(string(b), table) {
+			t.Fatalf("missing table %s", table)
+		}
+	}
+}

internal/db/pool.go

@@ -0,0 +1,31 @@
+package db
+
+import (
+	"context"
+	"fmt"
+
+	"ai-operator/internal/config"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+func OpenPool(ctx context.Context, cfg config.DatabaseConfig) (*pgxpool.Pool, error) {
+	if cfg.URL == "" {
+		return nil, fmt.Errorf("DATABASE_URL is required")
+	}
+	pc, err := pgxpool.ParseConfig(cfg.URL)
+	if err != nil {
+		return nil, fmt.Errorf("parse database url: %w", err)
+	}
+	pc.MaxConns = int32(cfg.MaxOpenConns)
+	pc.MinConns = 0
+	pc.MaxConnLifetime = cfg.ConnMaxLifetime
+	pool, err := pgxpool.NewWithConfig(ctx, pc)
+	if err != nil {
+		return nil, fmt.Errorf("open db pool: %w", err)
+	}
+	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("db ping: %w", err)
+	}
+	return pool, nil
+}