[IAmJSD]

Root cause

The migrations need PostgreSQL 15+ (#1110, migration 000134, uses UNIQUE NULLS NOT DISTINCT), but the Terraform environment inputs still accepted older majors:

• terraform/environments/azure/variables.tf postgres_version: validation allowed 11-16.
• terraform/environments/aws/variables.tf database_engine_version: no validation.
• terraform/environments/gcp/variables.tf database_version: no validation.

So a custom or self-hosted deployment on an older engine would plan and apply cleanly, then fail at migration time.

Fix

Validate each input at plan time:

• Azure postgres_version: contains(["15", "16"], ...).
• GCP database_version: contains(["POSTGRES_15", "POSTGRES_16"], ...).
• AWS database_engine_version: try(tonumber(regex("^([0-9]+)(\\.[0-9]+)?$", v)[0]) >= 15, false). This accepts the major-only pin ("16") and the "16.6" form the terraform/profiles/aws/*.tfvars.example files use. try() makes a malformed value such as "sixteen" fail validation cleanly instead of failing with a tonumber() evaluation error. (Terraform 1.10's && does not short-circuit, so the issue's plain tonumber(split(".", v)[0]) >= 15 would error instead of fail.)

Each variable's description and error message now name the 15+ requirement. docs/DEPLOYMENT.md → Prerequisites states the minimum and names the input for each cloud.

Every shipped tfvars (github-{dev,staging,prod}.tfvars, dev.tfvars.example, profiles) pins 16, so no deployed environment's plan changes.

Deploy gating: the AWS check takes effect on the next AWS plan. The Azure and GCP changes only take effect at their next deploy, which is gated on the paused Azure/GCP deploys. Until those resume, they are covered only by CI (terraform validate plus the new tftests below).

Tests

A new terraform/environments/{aws,azure,gcp}/tests/postgres_version.tftest.hcl per environment:

• AWS: rejects 14, 14.12 and sixteen; accepts 15, 16 and 16.6.
• Azure: rejects 14; accepts 15 and 16.
• GCP: rejects POSTGRES_14; accepts POSTGRES_15 and POSTGRES_16.

Every provider is mocked (mock_provider), so nothing reaches a cloud API. Each run uses command = plan with plan_options { target = [module.database] }. module.database is the input's only consumer, and targeting it keeps the variable's validation in the graph without planning the whole environment against mock data. An untargeted mocked plan fails on unrelated mock-data gaps (empty AZ lists, non-12-digit mock account IDs, an unknown-at-plan count). I also checked that targeting an unrelated resource (random_id.suffix) drops the validation and gives "Missing expected failure", which is why the tests target the consumer. Fixtures used: AWS mocks aws_caller_identity/aws_availability_zones with the placeholder 123456789012 that the fargate tftest already uses. GCP sets a 64-zero placeholder credential_encryption_key, because the auto-generated one is unknown at plan and the secrets module uses it in a count.

CI did not run any environment-level tftests before this change. A new "Test environment inputs" step in the terraform-validate job (after Terraform Validate) runs terraform test in terraform/environments/<cloud> when a tests/ dir exists.

Verification

All of this is local, mocked-provider tftest evidence (Terraform v1.10.5, the CI pin). No terraform plan/apply was run against a real backend or with real credentials. Everything ran with AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null.

Commands, run on temp copies of terraform/ (after = this branch, before = origin/main plus the new test files) so .terraform/ never touched the worktree:

terraform fmt -check -recursive terraform/                         # OK
actionlint .github/workflows/ci.yml                                 # OK
terraform -chdir=<copy>/terraform/environments/<cloud> init -backend=false -input=false   # aws, azure, gcp: OK
terraform -chdir=<copy>/terraform/environments/<cloud> validate     # aws, azure, gcp: "Success! The configuration is valid."
terraform -chdir=<copy>/terraform/environments/<cloud> test         # see below
go test -count=1 ./terraform/environments/aws/ ./terraform/environments/gcp/   # ok, ok (existing tfvars/variable guard tests)

Fail-before / pass-after (terraform test):

Env	before (main validation)	after (this branch)
aws	rejects_postgres_14 fail: "Missing expected failure", rest skipped	6 passed, 0 failed
azure	rejects_postgres_14 fail: "Missing expected failure", rest skipped	3 passed, 0 failed
gcp	rejects_postgres_14 fail: "Missing expected failure", rest skipped	3 passed, 0 failed

Also checked:

• The accept runs pass on main: with the reject runs removed from the before copy, aws 3/3, azure 2/2 and gcp 2/2 passed. A failing reject run therefore comes from the missing validation, not from the harness.
• Mutation, 15 rejected (AWS >= 16, Azure ["16"], GCP ["POSTGRES_16"]): accepts_postgres_15 fails with "Invalid value for variable" in all three environments, so the accept runs do catch an over-tight floor.

Combined-tree verification. This branch was tested together with six other queued branches on a local, never-pushed tree: queue/platform @ 77d116c6 = origin/main a14dc8f2 plus these heads, merged in this order:

Branch	Tested head
fix/issue-47	62feb4f
fix/issue-76	3b8c241
fix/issue-1233	e1638b7
fix/issue-153	8729074
fix/issue-532	0971624
fix/issue-64	fefdc43
fix/issue-54	91827b9

Linux, Go 1.26.9, AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null AWS_EC2_METADATA_DISABLED=true; Docker Postgres via testcontainers:

• Passed: go build ./..., go vet ./..., go vet -tags integration ./... and the full go test -race -short -count=1 ./....
• Static checks (changed packages): golangci-lint v2.10.1 found 0 issues, with and without --build-tags integration, and gocyclo -over 10 is silent on the changed non-test files. These ran at b61a9c30, which differs from 77d116c6 only by one .gitallowed line on fix/issue-1233.
• Integration tests, every changed package, one package at a time (-tags integration -count=1):
  • These packages pass: cmd/cleanup-lambda, internal/analytics, internal/auth, internal/database/postgres/migrations and internal/purchase.
  • internal/api passes, except two tests whose Postgres container didn't start, or whose migrations hit a timeout, under machine load. Rerun alone on the same tree, both pass: TestDeleteManagedPlanByExecutionStatus and TestNotifiedRow_RescheduleDoesNotOverwriteConcurrentCancel.
  • internal/config passes except TestPostgresStoreDB_ResolveStaleRIExchange_ValidatesCloudCheck, which fails the same way on unmodified main (fixed by fix(config): compare resolve checked_at at the database's microsecond precision #1252).
  • Packages were run with a 60-minute timeout (rather than CI's 20) because the VM was shared with other test runs. Some reruns used TESTCONTAINERS_RYUK_DISABLED=true to avoid a testcontainers reaper race under load.
• Secrets: git-secrets, using the repo's scripts/setup-git-secrets.sh patterns in a fresh repo with an isolated HOME, found nothing in the changed files, and a planted fake key was flagged. scripts/test-git-secrets-allowlist.sh: 137 PASS, 0 FAIL.
• Nothing was applied to any cloud.

Out of scope

• The module-level inputs (terraform/modules/database/azure postgres_version, terraform/modules/database/gcp database_version, terraform/modules/database/aws engine_version) are still unvalidated. The Azure module's description still lists "11, 12, 13, 14, 15, 16". The issue targets the environment inputs, which are the only callers in this repo. Adding the same floor to the modules would be a small follow-up.
• PostgreSQL 17 is not added to the Azure/GCP allowlists. The issue specifies 15/16, and accepting 17 is a separate decision about provider and service support. The AWS check is a numeric floor, so it accepts 17 already.
• docs/DEPLOYMENT.md still says "Aurora Serverless v2 PostgreSQL 16.4" for AWS, while the env provisions an aws_db_instance pinned to major 16. This is pre-existing doc drift and is left alone.

Maintainer: please mirror the issue's triage labels onto this PR: triaged, priority/p3, severity/low, urgency/this-quarter, impact/few, effort/xs, type/bug.

Closes #1233

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 1ecb69d483740e8d6bd9428affba1fd32a7f2ffe

Blocking:

• none

Non-blocking:

• terraform/environments/aws/variables.tf:132 vs azure:214 / gcp:117: AWS uses a numeric floor (17 and later accepted), while Azure and GCP use a 15/16 allowlist. So a 17 upgrade will need a validation edit on two clouds but not the third. The body calls this out as a separate decision, so I'm noting it, not blocking on it.
• The module-level inputs (modules/database/{aws,azure,gcp}) are still unvalidated, and the Azure module description still lists 11-16. The body declares this out of scope. The environments are the only callers, so the floor holds in practice.
• The AWS description warns against minor pins ("16.6" causes downgrade failures), but the validation accepts them, because terraform/profiles/aws/*.tfvars.example uses "16.6". That's consistent with the profiles, but the profiles contradict the description. This drift predates the PR.

Attacked:

• Checked that the new CI step runs after Terraform Init in the same terraform-validate matrix job and needs no credentials, since every provider is mocked and it only plans. On main, terraform/environments/<cloud>/tests/ didn't exist (only the ci-cd-permissions/tests subdirectories), so the step runs nothing but these new files.
• Grepped .github/, scripts/ and every tfvars file for overrides of the three inputs. All pin 16 or 16.6 (AWS profiles), and every value passes the new validations, so no deployed plan changes. Migration 000134 does use UNIQUE NULLS NOT DISTINCT.
• Ran on copies of terraform/ (TF 1.10.5): init -backend=false, validate and test. aws 6/6, azure 3/3, gcp 3/3. terraform fmt -check -recursive is clean.
• Fail-before: the same tests against origin/main's three variables.tf. Each env's rejects_postgres_14 fails with "Missing expected failure".
• Also ran go test ./terraform/environments/... ./cmd/server/ (ok), actionlint ci.yml (clean), test-git-secrets-allowlist.sh (137 PASS) and the secrets scan on the changed files ("clean; planted key flagged", which covers the new .gitallowed line for the 123456789012 mock account).

Body-stale:

• The "Combined-tree verification" section lists heads (e.g. fix/issue-1233 at e1638b7) that are older than the current head 1ecb69d. It's historical, not false, but it isn't evidence for this head.

_{Reviewer: rB4. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Merged current main into the branch and added one follow-up commit. New head: 2212023.

• .gitallowed conflicted. Main's docs(iac): stop documenting profile tfvars that terraform ignores #1151 renamed the two terraform/profiles/README.md entries to admin_password to match the README. This branch added the postgres_version tftest account-ID entry next to them. Both are kept: main's README entries, then the tftest entry.
• Follow-up fix(ci) commit: main's sec(ci): move the remaining run-block ${{ }} interpolations into env (#155) #1147 moved every run-block ${{ }} in ci.yml into env, and terraform-validate now has a job-level CLOUD. The "Test environment inputs" step this branch adds still interpolated matrix.cloud in its run block. It now uses "$CLOUD" like the neighbouring steps.
• Note: main's sec(iac/aws): restrict the Fargate ALB to CloudFront when enable_cdn is on #1106 added environments/aws/tests/fargate_cdn_alb.tftest.hcl and its own "Test AWS ALB ingress guard" step. On the aws leg, that file now also runs in this branch's "Test environment inputs" step. That is harmless, but the aws env tests run twice.

Checks:

• Mocked-provider terraform test: aws 9 passed (6 postgres_version plus main's 3 fargate_cdn_alb), azure 3 passed, gcp 3 passed. terraform fmt -check is clean.
• actionlint is clean, and no run block in ci.yml contains ${{.
• go build and go vet (default, integration, e2e) pass. golangci-lint reports 0 issues. go test -race passes on terraform/environments/{aws,gcp}.
• The git-secrets scan is clean, and the allowlist test gives 137 PASS.

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 2212023634b522df27353110ce351f4278f6481a

Blocking:

• none

Non-blocking:

• .github/workflows/ci.yml "Test environment inputs": on the aws leg this step also starts running the existing terraform/environments/aws/tests/fargate_cdn_alb.tftest.hcl, which no CI step ran before. It passes locally (3/3), so this is an improvement, but the body doesn't mention it. If it ever goes red, the step name will point people at the Postgres check.
• The module-level inputs (modules/database/{aws,azure,gcp}) are still unvalidated, and the Azure module's description still lists 11-14. The body notes this. A follow-up issue would keep it from being lost.

Attacked:

• Inputs and callers: searched every tfvars, example and profile for the three inputs. All pin 16 / POSTGRES_16, so no shipped plan changes.
• AWS validation: checked the regex/try() condition by hand. "16.6.1", "sixteen" and "14.12" are rejected, and 17 is accepted. Confirmed CLOUD is a job-level env in terraform-validate, so the new step's cd resolves.
• Ran, with AWS_CONFIG_FILE=/dev/null and mocked providers only: terraform init -backend=false && terraform validate && terraform test in terraform/environments/{aws,azure,gcp} on TF 1.10.5. Results: aws 9 passed (6 new plus 3 existing fargate_cdn_alb), azure 3 passed, gcp 3 passed.
• Fail-before: with main's variables.tf restored in each env, rejects_postgres_14 fails with "Missing expected failure" in all three. Restored afterwards.

Body-stale:

• none found

_{Reviewer: rB18. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 2212023634b522df27353110ce351f4278f6481a

Correction to my review above. The verdict is unchanged.

Blocking:

• none

Non-blocking:

• I withdraw my first point. Main already runs fargate_cdn_alb.tftest.hcl: the aws leg's "Test AWS ALB ingress guard" step (sec(iac/aws): restrict the Fargate ALB to CloudFront when enable_cdn is on #1106, ci.yml around line 1008) runs terraform test in terraform/environments/aws. An earlier comment on this PR already pointed that out.
• The effect is the reverse of what I said. On the aws leg, the whole env test directory, now including the new postgres_version.tftest.hcl, runs twice: once in that step and once in "Test environment inputs". That is harmless and only costs a few seconds. To dedupe, the new step could skip aws, or the ALB step could pass -filter=tests/fargate_cdn_alb.tftest.hcl.
• The second non-blocking point stands.

Attacked:

• Re-checked origin/main:.github/workflows/ci.yml. Everything else is in the review above.

Body-stale:

• "CI did not run any environment-level tftests before this change" is false on current main. sec(iac/aws): restrict the Fargate ALB to CloudFront when enable_cdn is on #1106's step already runs terraform test in terraform/environments/aws.

_{Reviewer: rB18. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Local verification at 2212023634b522df27353110ce351f4278f6481a merged onto main (5a2e31e3), together with #1255, #1298 in that order (combined tree bf7be33c, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 1 approving independent review(s) on it. Nothing was run against any cloud.

[IAmJSD]

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 1 approving independent review(s) on 22120236, green CI, and the combined-tree verification above. Squash-merged at exactly 2212023634b522df27353110ce351f4278f6481a.