refactor(test): use container-based postgres_tls for TLS SQL tests

[robobun]

Summary

• Refactors tls-sql.test.ts to use describeWithContainer with a local Docker container instead of external Neon secrets
• Updates postgres_tls service to build from Dockerfile (fixes SSL key permission issues)
• Fixes pg_hba.conf to allow local socket connections for init scripts

Test plan

• Verified tests pass locally with bun bd test test/js/sql/tls-sql.test.ts (30 tests pass)
• CI passes on x64 Linux (arm64 Docker tests are currently disabled)

🤖 Generated with Claude Code

[robobun]

^{Updated 10:02 PM PT - Jan 27th, 2026}

❌ Your commit cf2b8677 has 3 failures in Build #36003 (All Failures):

• test/integration/next-pages/test/dev-server.test.ts - 1 failing on 🍎 14 aarch64
• test/cli/hot/watch-many-dirs.test.ts - pid 3525 segmentation fault on 🐧 3.22 x64
• test/bundler/compile-windows-metadata.test.ts - 1 failing on 🪟 2019 x64
• test/bundler/compile-windows-metadata.test.ts - 1 failing on 🪟 2019 x64-baseline

---

🧪   To try this PR locally:

bunx bun-pr 26518

That installs a local version of the PR into your bun-26518 executable, so you can run:

bun-26518 --bun

[coderabbitai]

Walkthrough

Switches the test PostgreSQL TLS service to a locally-built image with added startup flags and extended healthcheck timing, broadens pg_hba.conf to allow remote TLS, adds postgres_tls to pre-up builds, and refactors TLS tests to run against the containerized Postgres via a Docker-gated harness.

Changes

Cohort / File(s)	Summary
Docker compose & helper test/docker/docker-compose.yml, test/docker/index.ts	postgres_tls changed from image: postgres:15 with host-mounted volumes to a local build (build: context: ../js/sql/docker-tls, dockerfile: Dockerfile) and image bun-postgres-tls:local; removed env/volumes; added command: postgres -c hba_file=... and SSL flags; healthcheck start_period increased to 60s and start_interval added at 1s; postgres_tls added to pre-up build list.
Postgres TLS Dockerfile / pg_hba.conf test/js/sql/docker-tls/Dockerfile, test/js/sql/docker-tls/...pg_hba.conf	Rewrote pg_hba.conf rules to allow remote TLS connections (0.0.0.0/0 and ::/0) for various users and replication while retaining a final reject rule; Dockerfile adjusted to support the new TLS-enabled, remotely-accessible configuration.
TLS test suite test/js/sql/tls-sql.test.ts	Replaced secret/multi-URL matrix with a Docker-based harness guarded by isDockerEnabled and describeWithContainer; tests now run against the postgres_tls container using container-derived Bun.SQL.Options and include transactional, savepoint, concurrency, and error-propagation scenarios adapted to the container.

Possibly related PRs

• Migrate all Docker usage to unified docker-compose infrastructure #22740 — Modifies the same postgres_tls service, Dockerfile, and Docker compose/build changes referenced here.
• fix(Bun.SQL) fix timers test and disable describeWithContainer on macos #22382 — Updates the container test harness and container-scoped Postgres tests that this TLS refactor depends on.
• fix(Bun.SQL) fix SSLRequest #22378 — Adds/adjusts Docker-based TLS test helpers and isDockerEnabled/describeWithContainer usage relevant to these test changes.

Suggested reviewers

• Jarred-Sumner
• markovejnovic

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: refactoring TLS SQL tests to use a container-based postgres_tls service instead of external secrets.
Description check	✅ Passed	The description covers the main changes and includes a test plan with verification steps, but lacks detail on 'How did you verify your code works?' section as specified in the template.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

test/docker/index.ts (1)

388-390: Include postgres_tls in buildServices() to keep CI prep complete.
Line 389 still omits postgres_tls, so prepareImages() won’t prebuild the TLS image even though it now requires building. Please add it to servicesToBuild.

♻️ Suggested fix

-    const servicesToBuild = ["mysql_tls", "redis_unified"];
+    const servicesToBuild = ["mysql_tls", "redis_unified", "postgres_tls"];

🤖 Fix all issues with AI agents

In `@test/js/sql/tls-sql.test.ts`:
- Around line 8-15: Two parallel test suites use describeWithContainer with
concurrent: true causing both beforeAll hooks to call
dockerHelper.ensure("postgres_tls") and race on docker-compose up; fix by making
the container setup single-threaded: either set concurrent: false on the
describeWithContainer that uses image "postgres_tls" or merge the two suites
into one describeWithContainer and move the for (const prepare of [true, false])
loop inside it so only one beforeAll/dockerHelper.ensure() runs; update
references to describeWithContainer, beforeAll, and dockerHelper.ensure
accordingly.

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In `@test/js/sql/tls-sql.test.ts`:
- Around line 26-33: The test double-disposes the SQL connection: the `await
using sql = new SQL(getOptions())` line will automatically dispose `sql` at
scope exit, so remove the explicit `await sql.close()` call to avoid a
double-close; locate the test function (tls (explicit)) and delete the final
`await sql.close();` so that disposal is handled solely by the `using`/disposer
for the `SQL` instance.
- Around line 97-113: The test currently masks the real error by converting any
rejection to the string "fail"; update the assertion to capture and assert the
actual thrown error message instead: when using sql.begin and sql.savepoint in
the "Transaction throws on uncaught named savepoint" test, replace the .catch(()
=> "fail") handler with one that returns the caught error's message (e.g., e =>
e.message) and assert that the message equals "fail" so the test verifies the
real error thrown by the savepoint.

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@test/js/sql/tls-sql.test.ts`:
- Around line 114-136: The test "Transaction succeeds on caught savepoint"
creates a persistent table; change the CREATE statement in that test to create a
temporary table instead by replacing the SQL`CREATE TABLE IF NOT EXISTS
${sql(random_name)} (a int)` call inside the test with a TEMPORARY variant
(e.g., SQL`CREATE TEMPORARY TABLE IF NOT EXISTS ${sql(random_name)} (a int)`) so
it matches other tests and prevents persistence if cleanup fails; locate this in
the test function around the random_name and SQL usage (sql`...`) and update the
SQL string accordingly.