ci: reuse verified PostgreSQL rustls SQLx CLI binaries

.github/actions/sqlx-cli-tool/action.yml

@@ -0,0 +1,39 @@
+name: PostgreSQL rustls SQLx CLI
+description: Restore or build the pinned PostgreSQL-only rustls CLI profile
+inputs:
+  probe:
+    description: Use an isolated branch diagnostic cache on explicit manual runs
+    default: 'false'
+outputs:
+  cache-hit:
+    description: Exact executable cache hit
+    value: ${{ steps.restore.outputs.cache-hit }}
+  key:
+    description: Tool/compiler/platform cache identity
+    value: ${{ steps.prepare.outputs.key }}
+runs:
+  using: composite
+  steps:
+    - name: Prepare SQLx CLI cache
+      id: prepare
+      shell: bash
+      env:
+        SQLX_CACHE_PROBE: ${{ inputs.probe }}
+      run: bash "$GITHUB_WORKSPACE/.github/scripts/sqlx-cli-tool.sh" prepare
+    - name: Restore SQLx CLI
+      id: restore
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      with:
+        key: ${{ steps.prepare.outputs.key }}
+        path: ${{ steps.prepare.outputs.path }}
+    - name: Install or verify SQLx CLI
+      shell: bash
+      env:
+        CACHE_HIT: ${{ steps.restore.outputs.cache-hit }}
+      run: bash "$GITHUB_WORKSPACE/.github/scripts/sqlx-cli-tool.sh" install "$CACHE_HIT"
+    - name: Save SQLx CLI
+      if: steps.restore.outputs.cache-hit != 'true' && steps.prepare.outputs.save_allowed == 'true'
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      with:
+        key: ${{ steps.prepare.outputs.key }}
+        path: ${{ steps.prepare.outputs.path }}

.github/scripts/run-prediction-market-data-contracts.sh

@@ -6,15 +6,11 @@ cd "$(dirname "$0")/../../rust_hft/prediction-markets"
 : "${DATABASE_URL:?ephemeral PostgreSQL URL required}"
 : "${PLOY_TEST_DATABASE_URL:?ephemeral PostgreSQL test URL required}"
 : "${SQLX_CLI_VERSION:?pinned SQLx CLI version required}"
+[[ $(sqlx --version) == "sqlx-cli $SQLX_CLI_VERSION" ]] || { echo 'pinned SQLx CLI is not prepared' >&2; exit 2; }
 
 cargo check --locked -p ploy-market-data --features live --lib
 cargo test --locked -p ploy-market-data --features live --lib
 
-cargo install sqlx-cli \
-  --locked \
-  --version "${SQLX_CLI_VERSION}" \
-  --no-default-features \
-  --features rustls,postgres
 sqlx migrate run
 
 # Reuse the live lib test above. Missing or renamed tests must fail this lane.

.github/scripts/run-prediction-research-contracts.sh

@@ -3,6 +3,8 @@
 set -euo pipefail
 SECONDS=0
 cd "$(dirname "$0")/../../rust_hft/prediction-markets"
+: "${SQLX_CLI_VERSION:?pinned SQLx CLI version required}"
+[[ $(sqlx --version) == "sqlx-cli $SQLX_CLI_VERSION" ]] || { echo 'pinned SQLx CLI is not prepared' >&2; exit 2; }
 cargo test --locked -p ploy-feed-loaders --lib
 cargo test --locked -p ploy-research --lib
 cargo test --locked -p ploy-research --no-default-features --features rl --lib model::rl
@@ -28,12 +30,6 @@ CODEX_CLI_BIN="$handoff_root/mock-codex" CODEX_CLI_TIMEOUT_SECS=10 \
   -- --exact --ignored --test-threads=1 --nocapture
 test -s "$handoff_root/consumer-proof.json"
 
-cargo install sqlx-cli \
-  --locked \
-  --version "${SQLX_CLI_VERSION}" \
-  --no-default-features \
-  --features rustls,postgres
-
 sqlx migrate run
 cargo check --locked -p ploy-research --features db,polars-export,ml,rl,strategy-runtime --lib
 cargo test --locked -p ploy-research --features db --example persist_research_trace

.github/scripts/select-rust-ci-scope.sh

@@ -761,6 +761,16 @@ for path in "${paths[@]}"; do
       [[ $event == pull_request ]] && select_job ploy/commit-hygiene
       continue
       ;;
+    .github/actions/sqlx-cli-tool/*|.github/scripts/sqlx-cli-tool.sh|.github/scripts/test-sqlx-cli-tool.sh|.github/scripts/verify-sqlx-cli-postgres.sh)
+      select_job ci/ci-contracts
+      select_job ploy/workflow-lint
+      select_job ploy/sqlx-cli-equivalence
+      select_job ploy/rust-control-plane
+      select_job ploy/rust-market-data
+      select_job ploy/rust-research-heavy
+      [[ $event == pull_request ]] && select_job ploy/commit-hygiene
+      continue
+      ;;
     .github/scripts/cargo-license-tool.sh|.github/scripts/test-cargo-license-tool.sh)
       select_job ci/ci-contracts
       select_job ploy/workflow-lint

.github/scripts/sqlx-cli-tool.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Reuse only the original PostgreSQL/rustls CLI profile, not default-feature binaries.
+set -euo pipefail
+version=0.8.6
+[[ ${SQLX_CLI_VERSION:-$version} == "$version" ]] || { echo 'SQLx recipe version mismatch' >&2; exit 2; }
+tool_root=${RUNNER_TEMP:?}/sqlx-cli-tool
+receipt=$tool_root/receipt.json
+script=$(cd "$(dirname "$0")" && pwd)/$(basename "$0")
+digest() { sha256sum | awk '{print $1}'; }
+identity() {
+  { printf '%s\n' "$version" 'no-default-features;postgres,rustls;locked' \
+      "${RUNNER_OS:?}" "${RUNNER_ARCH:?}" "${ImageOS:?}"
+    rustc -vV
+    cat "$script"
+  } | digest
+}
+case ${1:-} in
+  prepare)
+    namespace=trusted
+    save_allowed=false
+    if [[ ${GITHUB_REF:-} == refs/heads/main ]]; then
+      case ${GITHUB_EVENT_NAME:-} in push|schedule|workflow_dispatch) save_allowed=true ;; esac
+    fi
+    case ${SQLX_CACHE_PROBE:-false} in
+      true)
+        [[ ${GITHUB_EVENT_NAME:-} == workflow_dispatch ]] || exit 2
+        if [[ ${GITHUB_REF:-} != refs/heads/main ]]; then
+          [[ ${GITHUB_SHA:-} =~ ^[a-f0-9]{40}$ ]] || exit 2
+          namespace=probe-$GITHUB_SHA
+          save_allowed=true
+        fi
+        ;;
+      false|'') ;;
+      *) exit 2 ;;
+    esac
+    printf 'key=sqlx-cli-v1-%s-%s\npath=%s\nsave_allowed=%s\n' \
+      "$namespace" "$(identity)" "$tool_root" "$save_allowed" >>"${GITHUB_OUTPUT:?}"
+    ;;
+  install)
+    began=$SECONDS
+    case ${2:-} in
+      true) ;;
+      false|'')
+        toolchain=$(rustup show active-toolchain | awk '{print $1}')
+        rm -rf -- "$tool_root"
+        (cd "${RUNNER_TEMP:?}" && \
+          env -u CARGO_TARGET_DIR -u CARGO_BUILD_TARGET -u RUSTFLAGS -u CARGO_ENCODED_RUSTFLAGS \
+          RUSTUP_TOOLCHAIN="$toolchain" cargo install sqlx-cli --locked --version "$version" \
+          --no-default-features --features rustls,postgres --root "$tool_root")
+        # Cargo records the actual feature selection, not just the package version.
+        jq -e --arg version "$version" '
+          .installs | to_entries | map(select(.key | startswith("sqlx-cli "+$version+" "))) |
+          length==1 and (.[0].value | .no_default_features==true and .all_features==false and
+          (.features|sort)==["postgres","rustls"] and (.bins|sort)==["cargo-sqlx","sqlx"])
+        ' "$tool_root/.crates2.json" >/dev/null
+        jq -n --arg version "$version" --arg identity "$(identity)" \
+          --arg sqlx "$(digest <"$tool_root/bin/sqlx")" \
+          --arg cargo_sqlx "$(digest <"$tool_root/bin/cargo-sqlx")" \
+          '{schema:"monday.sqlx-cli-cache.v1",version:$version,features:["postgres","rustls"],
+            no_default_features:true,identity:$identity,sqlx:$sqlx,cargo_sqlx:$cargo_sqlx}' >"$receipt"
+        rm -f "$tool_root/.crates.toml" "$tool_root/.crates2.json"
+        ;;
+      *) exit 2 ;;
+    esac
+    for name in sqlx cargo-sqlx; do
+      [[ -f $tool_root/bin/$name && -x $tool_root/bin/$name && ! -L $tool_root/bin/$name ]]
+    done
+    [[ -f $receipt && ! -L $receipt ]]
+    jq -e --arg version "$version" --arg identity "$(identity)" \
+      --arg sqlx "$(digest <"$tool_root/bin/sqlx")" --arg cargo_sqlx "$(digest <"$tool_root/bin/cargo-sqlx")" '
+      .schema=="monday.sqlx-cli-cache.v1" and .version==$version and .identity==$identity and
+      .features==["postgres","rustls"] and .no_default_features==true and .sqlx==$sqlx and .cargo_sqlx==$cargo_sqlx
+    ' "$receipt" >/dev/null
+    [[ $("$tool_root/bin/sqlx" --version) == "sqlx-cli $version" ]]
+    printf '%s\n' "$tool_root/bin" >>"${GITHUB_PATH:?}"
+    printf 'sqlx-cli version=%s features=postgres,rustls cache_hit=%s install_seconds=%s sha256=%s\n' \
+      "$version" "${2:-false}" "$((SECONDS-began))" "$(digest <"$tool_root/bin/sqlx")"
+    ;;
+  *) echo 'usage: sqlx-cli-tool.sh prepare|install [cache-hit]' >&2; exit 2 ;;
+esac

.github/scripts/test-ci-monitor-scope.sh

@@ -32,7 +32,7 @@ ancestors = lambda do |id|
 end
 %w[workflow-lint commit-hygiene rust-format safety-scans audit rust-control-plane rust-runner-lean
    rust-runner-full rust-market-data rust-research-heavy frontend integration-regressions
-   strategy-config-contracts architecture-contracts].each do |id|
+   strategy-config-contracts architecture-contracts sqlx-cli-equivalence].each do |id|
   abort "#{id} waits for publication history" if ancestors.call(id).include?('research-image-scope')
 end
 %w[research-image-binaries research-image-smoke prediction-markets-gate].each do |id|
@@ -41,10 +41,13 @@ end
 abort 'direct selector consults publication history' if prediction.fetch('image-smoke-selector').to_s.include?('select-main-research-scope')
 abort 'gate ignores carried jobs' unless prediction.fetch('prediction-markets-gate').to_s.include?('needs.research-image-scope.outputs.jobs')
 diagnostic = "github.event_name == 'workflow_dispatch' && inputs.research_cache_probe"
+sqlx_diagnostic = "github.event_name == 'workflow_dispatch' && inputs.sqlx_cli_probe"
 abort 'probe can replace the required release gate' unless prediction.fetch('prediction-markets-gate').fetch('name') ==
-  "${{ #{diagnostic} && 'Research build A/B diagnostic gate' || 'Prediction Markets CI gate' }}"
+  "${{ #{sqlx_diagnostic} && 'SQLx CLI diagnostic gate' || #{diagnostic} && 'Research build A/B diagnostic gate' || 'Prediction Markets CI gate' }}"
 document = YAML.safe_load(File.read("#{repo}/.github/workflows/ploy-ci.yml"))
 abort 'probe can cancel ordinary CI' unless document.fetch('concurrency').fetch('group').include?("#{diagnostic} && 'research-cache-probe-'")
+abort 'SQLx probe can cancel ordinary CI' unless document.fetch('concurrency').fetch('group').include?("#{sqlx_diagnostic} && 'sqlx-cli-probe-'")
+abort 'SQLx contract missing from aggregate gate' unless prediction.fetch('prediction-markets-gate').fetch('needs').include?('sqlx-cli-equivalence')
 File.write("#{work}/diagnostic-plan.sh", prediction.fetch('image-smoke-selector').fetch('steps').find { |step| step['id']=='scope' }.fetch('run'))
 {
   'ci.yml'=>'scope', 'ploy-ci.yml'=>'image-smoke-scope', 'security-enabled.yml'=>'security-scope'
@@ -72,7 +75,7 @@ for probe in true false '' invalid; do
     called="$output.ordinary"
     code=0
     (cd "$probe_repo/rust_hft/prediction-markets" &&
-      RESEARCH_CACHE_PROBE=$probe GITHUB_EVENT_NAME=$event GITHUB_OUTPUT="$output" \
+      SQLX_CLI_PROBE=false RESEARCH_CACHE_PROBE=$probe GITHUB_EVENT_NAME=$event GITHUB_OUTPUT="$output" \
       ORDINARY_PLAN_CALLED="$called" BASE_SHA=base HEAD_SHA=head bash "$work/diagnostic-plan.sh") \
       >"$work/probe.stdout" 2>"$work/probe.stderr" || code=$?
     if [[ $probe == true && $event == workflow_dispatch ]]; then
@@ -89,10 +92,49 @@ for probe in true false '' invalid; do
   done
 done
 
+# SQLx diagnostics use the same fail-closed plan boundary without broad research.
+for probe in true false '' invalid; do
+  for event in workflow_dispatch push pull_request; do
+    output="$work/sqlx-$event-${probe:-absent}.out"
+    called="$output.ordinary"
+    code=0
+    (cd "$probe_repo/rust_hft/prediction-markets" &&
+      SQLX_CLI_PROBE=$probe RESEARCH_CACHE_PROBE=false GITHUB_EVENT_NAME=$event GITHUB_OUTPUT="$output" \
+      ORDINARY_PLAN_CALLED="$called" BASE_SHA=base HEAD_SHA=head bash "$work/diagnostic-plan.sh") \
+      >"$work/probe.stdout" 2>"$work/probe.stderr" || code=$?
+    if [[ $probe == true && $event == workflow_dispatch ]]; then
+      [[ $code == 0 && ! -e $called ]]
+      grep -Fqx 'jobs=,ploy/sqlx-cli-equivalence,' "$output"
+      grep -Fqx research_product=none "$output"
+      grep -Fqx selection_complete=true "$output"
+    elif [[ $probe == false || -z $probe ]]; then
+      [[ $code == 0 ]]
+      grep -Fqx -- "--event $event --base base --head head" "$called"
+    else
+      [[ $code != 0 && ! -e $called && ! -s $output ]]
+    fi
+  done
+done
+for other_probe in true invalid; do
+  if (cd "$probe_repo/rust_hft/prediction-markets" &&
+    SQLX_CLI_PROBE=true RESEARCH_CACHE_PROBE=$other_probe GITHUB_EVENT_NAME=workflow_dispatch \
+    GITHUB_OUTPUT="$work/conflicting.out" ORDINARY_PLAN_CALLED="$work/conflicting.ordinary" \
+    bash "$work/diagnostic-plan.sh"); then exit 1; fi
+  [[ ! -s $work/conflicting.out && ! -e $work/conflicting.ordinary ]]
+done
+
 # Diagnostic success cannot satisfy the production publication check reader.
-printf '%s\n' '{"check_runs":[{"id":1,"name":"Research build A/B diagnostic gate","status":"completed","conclusion":"success","app":{"slug":"github-actions","id":15368}}]}' >"$work/probe-checks.json"
-bash "$script_dir/read-release-required-checks.sh" "$work/probe-checks.json" "$work/probe-release-state"
-grep -Fqx prediction_conclusion=missing "$work/probe-release-state"
+for name in 'Research build A/B diagnostic gate' 'SQLx CLI diagnostic gate'; do
+  jq -n --arg name "$name" '{check_runs:[{id:1,name:$name,status:"completed",conclusion:"success",app:{slug:"github-actions",id:15368}}]}' >"$work/probe-checks.json"
+  bash "$script_dir/read-release-required-checks.sh" "$work/probe-checks.json" "$work/probe-release-state"
+  grep -Fqx prediction_conclusion=missing "$work/probe-release-state"
+done
+sqlx_needs='{"image-smoke-selector":{"result":"success"},"image-smoke-scope":{"result":"success"},"research-image-scope":{"result":"success"},"sqlx-cli-equivalence":{"result":"success"}}'
+printf '%s' "$sqlx_needs" | bash "$script_dir/verify-ci-gate.sh" --job-prefix ploy --expected-jobs ',ploy/sqlx-cli-equivalence,'
+for result in skipped failure cancelled missing; do
+  payload=$(jq -c --arg result "$result" 'if $result=="missing" then del(."sqlx-cli-equivalence") else ."sqlx-cli-equivalence".result=$result end' <<<"$sqlx_needs")
+  if printf '%s' "$payload" | bash "$script_dir/verify-ci-gate.sh" --job-prefix ploy --expected-jobs ',ploy/sqlx-cli-equivalence,' >"$work/sqlx-gate.log" 2>&1; then exit 1; fi
+done
 
 for file in ci.yml ploy-ci.yml security-enabled.yml; do
   for result in success failure; do

.github/scripts/test-select-rust-ci-scope.sh

@@ -356,14 +356,18 @@ SH
 #!/usr/bin/env bash
 set -euo pipefail
 printf 'sqlx %s\n' "$*" >>"$CONTRACT_FIXTURE/calls"
+if [[ $* == --version ]]; then
+  if [[ $CONTRACT_CASE == version-failure ]]; then echo 'sqlx-cli 0.9.0'; else echo 'sqlx-cli 0.8.6'; fi
+  exit 0
+fi
 [[ $* == 'migrate run' ]]
 [[ $CONTRACT_CASE != migration-failure ]] || exit 61
 printf 'migrated\n' >"$CONTRACT_FIXTURE/migrated"
 SH
   chmod +x "$fixture/bin/cargo" "$fixture/bin/sqlx"
   local pg_test=predict_fun::tests::postgres_predict_fun_restart_restores_clock_and_persists_failure_readiness
   local scenario
-  for scenario in success missing migration-failure test-failure; do
+  for scenario in success missing migration-failure test-failure version-failure; do
     rm -f "$fixture/migrated" "$fixture/calls" "$fixture/cwd"
     result=0
     PATH="$fixture/bin:$PATH" CONTRACT_FIXTURE="$fixture" CONTRACT_CASE="$scenario" CONTRACT_PG_TEST="$pg_test" \
@@ -376,15 +380,19 @@ SH
         [[ $result == 0 ]]
         [[ $(sort -u "$fixture/cwd") == "$fixture/repo/rust_hft/prediction-markets" ]]
         cat >"$fixture/expected" <<EOF
+sqlx --version
 cargo check --locked -p ploy-market-data --features live --lib
 cargo test --locked -p ploy-market-data --features live --lib
-cargo install sqlx-cli --locked --version 0.8.6 --no-default-features --features rustls,postgres
 sqlx migrate run
 cargo test --locked -p ploy-market-data --features live --lib -- --ignored --list
 cargo test --locked -p ploy-market-data --features live --lib $pg_test -- --ignored --exact
 EOF
         diff -u "$fixture/expected" "$fixture/calls"
         ;;
+      version-failure)
+        [[ $result != 0 ]]
+        [[ $(cat "$fixture/calls") == 'sqlx --version' ]]
+        ;;
       missing|migration-failure)
         [[ $result != 0 ]]
         if grep -Fq -- '--ignored --exact' "$fixture/calls"; then
@@ -1347,7 +1355,7 @@ if grep -Fq 'test-polymarket-market-recorder-release.sh' <<<"$rust_job_block"; t
 grep -Fq 'ci-owner-cache.sh" cleanup' <<<"$rust_job_block"
 
 ploy_workflow="$script_dir/../workflows/ploy-ci.yml"
-grep -Fqx "  group: prediction-markets-\${{ github.event_name == 'workflow_dispatch' && inputs.research_cache_probe && 'research-cache-probe-' || '' }}\${{ github.ref == 'refs/heads/main' && github.run_id || github.ref }}" "$ploy_workflow"
+grep -Fqx "  group: prediction-markets-\${{ github.event_name == 'workflow_dispatch' && inputs.sqlx_cli_probe && 'sqlx-cli-probe-' || '' }}\${{ github.event_name == 'workflow_dispatch' && inputs.research_cache_probe && 'research-cache-probe-' || '' }}\${{ github.ref == 'refs/heads/main' && github.run_id || github.ref }}" "$ploy_workflow"
 grep -Fqx "  cancel-in-progress: \${{ github.ref != 'refs/heads/main' }}" "$ploy_workflow"
 [[ $(grep -Fxc '    branches: [main, develop]' "$ploy_workflow") -eq 2 ]]
 if sed -n '/^  push:$/,/^  workflow_dispatch:$/p' "$ploy_workflow" \
@@ -1574,7 +1582,7 @@ grep -Fqx '      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea186
 grep -Fqx '          EXPECTED_JOBS: ${{ needs.scope.outputs.jobs }}' "$ci_workflow"
 grep -Fqx "        run: printf '%s' \"\$GATE_NEEDS\" | bash .github/scripts/verify-ci-gate.sh --job-prefix ci --expected-jobs \"\$EXPECTED_JOBS\"" "$ci_workflow"
 grep -Fqx '  prediction-markets-gate:' "$ploy_workflow"
-grep -Fqx "    name: \${{ github.event_name == 'workflow_dispatch' && inputs.research_cache_probe && 'Research build A/B diagnostic gate' || 'Prediction Markets CI gate' }}" "$ploy_workflow"
+grep -Fqx "    name: \${{ github.event_name == 'workflow_dispatch' && inputs.sqlx_cli_probe && 'SQLx CLI diagnostic gate' || github.event_name == 'workflow_dispatch' && inputs.research_cache_probe && 'Research build A/B diagnostic gate' || 'Prediction Markets CI gate' }}" "$ploy_workflow"
 grep -Fqx '      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0' "$ploy_workflow"
 grep -Fqx '          EXPECTED_JOBS: ${{ needs.research-image-scope.outputs.jobs }}' "$ploy_workflow"
 grep -Fqx "        run: printf '%s' \"\$GATE_NEEDS\" | bash .github/scripts/verify-ci-gate.sh --job-prefix ploy --expected-jobs \"\$EXPECTED_JOBS\"" "$ploy_workflow"