Repository navigation
docs: a Postgres source is attached read-only, not read with postgres_scan (forge-cli #740) - #160
Merged
Merged
Conversation
…_scan (forge-cli #740) DuckDB 2.0's postgres extension has no postgres_scan, so forge-cli #740 attaches a Postgres acquisition source read-only before the sandbox locks and reads <alias>.<schema>.<table>, as it attaches MySQL and SQLite sources. - walkthrough/source-aligned-postgres-duckdb: the contract's description and the "Source read" row name the attach instead of postgres_scan. - advanced/duckdb-sandbox: the acquisition row says postgres and mysql sources are attached read-only before the sandbox closes; the SQLite note says why the confinement is the only check (the attach happens before the lock); the scanner limit is version-qualified (through 1.5 postgres_scan reaches any host and the sqlite scanner any file; 2.0 has no postgres_scan and bounds sqlite; on both an ATTACH after the lock is refused). - the source-aligned bronze reel no longer credits postgres_scan.
1 task done
fas89
added a commit
to Agenticstiger/forge-cli
that referenced
this pull request
Oct 22, 2026
DuckDB 2.0.0 (2026-10-21) turned main red: 51 tests across Test 3.11-3.14,
Coverage and the DuckDB end-to-end legs. forge-cli now runs on DuckDB 2.x as
well as 1.5.x (duckdb>=1.5.0, no ceiling).
- providers/_duckdb_compat.py, the version seam:
- first_row/one_row read each result to the end (2.0 relations have no
fetchone, and a partly read result keeps its connection busy);
- query_relation answers as 1.5 does: None for SQL ending in DDL/DML, a
parse error before any statement runs, a trailing comment cut, earlier
statements drained with complete();
- relation_view falls back to a table where 2.0 refuses a view over rows
it already holds;
- files forge-cli creates on 2.x keep storage version 64, which 1.5 opens.
- Postgres and MySQL acquisition sources are attached read-only before the
sandbox locks (postgres_scan is gone in 2.0), each with an empty temporary
secret. Without that secret, every MySQL source failed with "Unknown secret
storage found: 'local_file'".
- Enum columns read as VARCHAR, as postgres_scan typed them.
- A Postgres secretRef is resolved.
- A setup or connect failure fails the run with a run record and the password
masked; READ_ONLY is documented as no write barrier for postgres_execute.
- CI: a duckdb-floor job runs the version-sensitive and end-to-end suites on
exactly MIN_DUCKDB_VERSION; a guard test keeps its list complete.
- CHANGELOG [Unreleased]: upgrade notes (storage format, conversion recipe,
2.0 SQL changes, Postgres secretRef) and fixes.
Validated:
- the full suite on 3.12/2.0.0, 3.14/2.0.0, 3.12/1.5.6 and 3.10/1.5.6, every
remaining failure shared with main;
- the floor list on 1.5.0;
- the Postgres example and the live Postgres/MySQL round trips via the fluid
CLI on 2.0.0, 1.5.0 and 1.5.6;
- mutation rounds, 15/15 and 7/7 killed;
- three /security-review rounds with no vulnerabilities, plus a world-class
inspection and a defect scan.
Docs: Agenticstiger/forge_docs#160.
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docs for forge-cli #740, which makes forge-cli run on DuckDB 2.x as well as 1.5.x.
DuckDB 2.0's postgres extension dropped
postgres_scan, so the DuckDB acquisition runner now attaches a Postgres source read-only before the sandbox locks and reads<alias>.<schema>.<table>, as it does for MySQL and SQLite sources. Three pages describedpostgres_scan:walkthrough/source-aligned-postgres-duckdb.md: the contract's description and the "Source read" row now name the attach. The row is marked (unreleased, forge-cli #740).advanced/duckdb-sandbox.md:postgresormysqlsource is attached read-only before the sandbox closes (marked unreleased).postgres_scanreaches any host and the sqlite scanner any file. 2.0 has nopostgres_scanand bounds sqlite by the allowlist. On both, anATTACHafter the lock is refused.postgres_scan.No documented DuckDB requirement changes (
duckdb>=1.5.0stands). The DuckDB 2.x upgrade notes (storage format, conversion recipe, SQL changes) are in forge-cli's CHANGELOG under[Unreleased]and belong inupgrading.mdat release time.