dx(platform): bake synthetic preview seed fixture as rolling release

[ntindle]

Why / What / How

Why. Preview environments today boot with an empty database, so a PR's own migrations run against zero rows. That hides the failures that actually bite in production: NOT NULL columns added without a default, new UNIQUE constraints that collide on real data, and backfill/UPDATE migrations that only misbehave when there are rows to touch. We want previews to restore a populated database before the PR's migrations run, so those migrations are exercised against realistic data and fail in the preview instead of in prod. Batch/rollup previews (many approved PRs deployed together) benefit the most, since they stack multiple untested migrations onto one database.

This PR builds the bake half: a workflow that produces the fixture. The restore half (wiring previews to download and load it) is a follow-up infra-repo PR.

What. A new workflow .github/workflows/platform-preview-seed-fixture.yml that:

• Triggers on pushes to dev touching backend/migrations/**, backend/test/**, or the workflow file; a weekly schedule backstop; and workflow_dispatch. A concurrency group coalesces overlapping bakes.
• Spins up a throwaway pgvector/pgvector:pg15 service container (matches the platform's real Postgres major version — supabase/postgres:15.8.x — and provides the vector extension the docs-embedding migrations need plus the pg_trgm contrib module).
• Sets up Python 3.12 + Poetry mirroring backend CI, runs prisma generate + prisma migrate deploy against the container using ?schema=platform.
• Runs the four seeders in order, then pg_dumps the platform schema (custom format, gzipped) and writes a manifest.json, and publishes both as assets on a rolling release tagged preview-seed-fixture.

How.

• Seeders (in order). test_data_creator.py (required — a failure fails the bake), then load-store-agents, e2e_test_data.py, and test_data_updater.py (best-effort — each failure emits a loud ::warning:: but does not abort the bake, per "tolerate soft-failures but require test_data_creator").
• e2e GoTrue-less fallback. e2e_test_data.py builds a Supabase client unconditionally (supabase-py raises on an empty URL), so a truly empty Supabase config aborts it before its per-user fallback can run. It does have a documented fallback to raw synthetic UUIDs when the GoTrue admin call fails. The minimal adaptation is to point SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY at a dead localhost port: the client constructs, the auth.admin.create_user call fails, and every user falls back to a raw UUID. Verified locally: 15/15 users hit the fallback path.
• Dump. pg_dump --format=custom -Z0 --schema=platform | gzip — the platform schema only, schema and data, including platform._prisma_migrations so the restore side only replays a PR's delta migrations. -Z0 disables pg_dump's internal compression so the outer gzip is the single compressor (restore = gunzip -c fixture.dump.gz | pg_restore). pg_dump/psql run inside the service container via docker exec so the client version always matches the server (the runner's bundled client can lag the server major and refuse the dump — confirmed: the local host client is pg14 and aborts against a pg15 server).
• Manifest. manifest.json = { baked_at, dev_sha, migration_head }, where baked_at comes from git log of the checked-out commit (not wall-clock) and migration_head is the last applied migration name read from _prisma_migrations.
• Publish. Create-or-update the rolling preview-seed-fixture release (gh release create / edit + upload --clobber); GITHUB_TOKEN with contents: write suffices on this public repo. Release notes are one paragraph including the security invariant.

🔒 Security invariant

This workflow holds NO cloud credentials and has NO read path to any real database. It runs entirely against a disposable Postgres service container. The fixture contains only Faker-generated synthetic rows plus the already-public marketplace agent exports already checked into autogpt_platform/backend/agents/. The Supabase env it sets is a dummy, unreachable http://localhost:54321 with a non-secret placeholder key — it cannot reach any real auth backend. No production data is ever touched, read, or dumped.

How the restore side consumes it (follow-up infra PR)

A preview's DB provisioning will: (1) ensure the vector extension exists (create the extensions schema + CREATE EXTENSION vector, since the fixture is platform-only), (2) gunzip -c fixture.dump.gz | pg_restore into a fresh DB, (3) then run the PR's prisma migrate deploy — which, because the restored _prisma_migrations already records the baked migrations, applies only the PR's new migrations against the populated tables.

Changes 🏗️

• Add .github/workflows/platform-preview-seed-fixture.yml (bake + publish workflow). No application code, .env.default, or docker-compose.yml changes.

Checklist 📋

For configuration changes:

• .env.default is updated or already compatible with my changes (no change needed — the workflow sets its own throwaway env)
• docker-compose.yml is updated or already compatible with my changes (no change — uses a GHA service container)
• I have included a list of my configuration changes in the PR description (under Changes)

Test plan

• actionlint (with embedded shellcheck) passes on the workflow.
• Local dry-run against a pgvector/pgvector:pg15 container: prisma migrate deploy applied all migrations; test_data_creator succeeded (116 users); load-store-agents loaded 17 agents; e2e_test_data completed with the GoTrue-less raw-UUID fallback firing for all 15 users; test_data_updater applied its mutations (it then errors in a pre-existing report-only KeyError('agentGraphId'), which is tolerated as a soft failure — pre-existing on dev, unrelated to this workflow).
• pg_dump produced a valid custom-format archive (67 TABLE DATA + 6 materialized views, _prisma_migrations included), ~4.9 MB gzipped; manifest.json populated with baked_at / dev_sha / migration_head.
• First real run on dev publishes/updates the preview-seed-fixture release (verified post-merge).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Wj2E4V37tKjiGsXafYKDuk

---

Note

Low Risk
CI-only change with no app code or production DB access; main risk is publishing a bad or empty fixture, which the workflow guards with user-count and migration-head checks.

Overview
Adds .github/workflows/platform-preview-seed-fixture.yml, which bakes a fully synthetic populated platform Postgres fixture for preview DBs (restore wiring is a follow-up). It runs on eligible dev pushes, a weekly schedule, and workflow_dispatch, with concurrency so overlapping bakes cancel.

The job uses a throwaway pgvector/pgvector:pg15 service, prisma migrate deploy, then seeders (test_data_creator required; load-store-agents, e2e_test_data, test_data_updater soft-fail with warnings). e2e_test_data is driven via unreachable localhost Supabase env so GoTrue failures use the existing raw-UUID fallback—no cloud DB or real credentials.

It pg_dumps the platform schema (custom format, gzipped, including _prisma_migrations), writes manifest.json (baked_at, dev_sha, migration_head), and publishes fixture.dump.gz + manifest to the rolling preview-seed-fixture GitHub release. Checkout is pinned to dev so scheduled runs don’t bake the default branch schema.

^{Reviewed by Cursor Bugbot for commit 0646c6c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Walkthrough

The new workflow builds a synthetic Platform preview database, seeds and validates it, creates reproducible fixture artifacts, and publishes them to a rolling GitHub release.

Changes

Preview seed fixture bake

Layer / File(s)	Summary
Workflow runtime and database setup .github/workflows/platform-preview-seed-fixture.yml	Adds triggers, concurrency, write permissions, a disposable PostgreSQL service, and synthetic environment configuration.
Database migration and deterministic seeding .github/workflows/platform-preview-seed-fixture.yml	Installs dependencies, generates the Prisma client, applies migrations, and runs required plus best-effort seed scripts.
Fixture export and release publishing .github/workflows/platform-preview-seed-fixture.yml	Validates seeded users, creates fixture.dump.gz and manifest.json, and publishes them to the rolling preview-seed-fixture release.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant PostgresService
  participant SeedScripts
  participant GitHubRelease
  GitHubActions->>PostgresService: Apply Prisma migrations
  GitHubActions->>SeedScripts: Run seed scripts
  SeedScripts->>PostgresService: Insert preview data
  GitHubActions->>PostgresService: Validate users and export dump
  GitHubActions->>GitHubRelease: Upload dump and manifest

Loading

Poem

A bunny watched the workflow hop,
While seeds filled tables at the top.
A dump was packed, a manifest spun,
Then release assets joined the run.
“Fresh preview data!” the rabbit cheered.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	It clearly names the main change: baking a synthetic preview seed fixture and publishing it as a rolling release.
Description check	✅ Passed	It directly describes the workflow addition and matches the changeset.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dx/preview-seed-fixture-bake

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c7f6de4. Configure here.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (3)

.github/workflows/platform-preview-seed-fixture.yml (3)

15-21: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Trigger paths omit agent-export and dependency changes.

The push filter covers migrations/** and test/** but not autogpt_platform/backend/agents/** (referenced by the load-store-agents seeder/dump comments) or pyproject.toml/poetry.lock. Changes there won't rebake the fixture until the weekly cron fires, so the published fixture can lag behind marketplace-export or dependency updates for up to a week.

Suggested path additions

     paths:
       - "autogpt_platform/backend/migrations/**"
       - "autogpt_platform/backend/test/**"
+      - "autogpt_platform/backend/agents/**"
+      - "autogpt_platform/backend/pyproject.toml"
+      - "autogpt_platform/backend/poetry.lock"
       - ".github/workflows/platform-preview-seed-fixture.yml"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/platform-preview-seed-fixture.yml around lines 15 - 21,
Update the push path filters in the workflow trigger to include
autogpt_platform/backend/agents/** and the repository dependency manifests
pyproject.toml and poetry.lock, while preserving the existing migration, test,
and workflow paths.

---

53-54: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Pin the Postgres service image to a specific tag/digest.

pgvector/pgvector:pg15 is a floating tag; an upstream update could silently change the pgvector/pg_trgm build baked into every future run, undermining the reproducibility goal of a "baked" fixture (manifest ties baked_at/dev_sha/migration_head to a commit, but not to the exact Postgres image).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/platform-preview-seed-fixture.yml around lines 53 - 54,
Update the postgres service image configuration to use an immutable, specific
image tag or digest instead of the floating pgvector/pgvector:pg15 tag. Preserve
the PostgreSQL 15 and required pgvector/pg_trgm extensions while ensuring future
workflow runs resolve the exact same image.

---

123-142: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Repeated best-effort-seeder boilerplate.

The || { echo "::warning..."; exit 0; } pattern is duplicated across the three best-effort seeder steps. Since this is static YAML with only three repeats and the explicit warning message is intentional, this is optional — but a step-level continue-on-error: true plus a single follow-up "report failures" step would avoid the copy-pasted block if you want less duplication.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/platform-preview-seed-fixture.yml around lines 123 - 142,
The three seeder steps—“Seed: load-store-agents,” “Seed: e2e_test_data,” and
“Seed: test_data_updater”—duplicate best-effort failure handling. If reducing
duplication, replace each inline `|| { ... }` block with step-level
`continue-on-error: true`, then add one follow-up step that reports which
seeders failed while preserving workflow continuation and warning behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/platform-preview-seed-fixture.yml:
- Around line 86-87: Update the actions/checkout step in the platform preview
seed fixture workflow to set persist-credentials to false. Keep the existing
checkout behavior and explicitly supplied GH_TOKEN for the release step
unchanged.

---

Nitpick comments:
In @.github/workflows/platform-preview-seed-fixture.yml:
- Around line 15-21: Update the push path filters in the workflow trigger to
include autogpt_platform/backend/agents/** and the repository dependency
manifests pyproject.toml and poetry.lock, while preserving the existing
migration, test, and workflow paths.
- Around line 53-54: Update the postgres service image configuration to use an
immutable, specific image tag or digest instead of the floating
pgvector/pgvector:pg15 tag. Preserve the PostgreSQL 15 and required
pgvector/pg_trgm extensions while ensuring future workflow runs resolve the
exact same image.
- Around line 123-142: The three seeder steps—“Seed: load-store-agents,” “Seed:
e2e_test_data,” and “Seed: test_data_updater”—duplicate best-effort failure
handling. If reducing duplication, replace each inline `|| { ... }` block with
step-level `continue-on-error: true`, then add one follow-up step that reports
which seeders failed while preserving workflow continuation and warning
behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4db50c9f-b8d1-48eb-9a61-3e39caa11e00

📥 Commits

Reviewing files that changed from the base of the PR and between d709943 and c7f6de4.

📒 Files selected for processing (1)

• .github/workflows/platform-preview-seed-fixture.yml

📜 Review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: Check PR Status
• GitHub Check: Analyze (python)
• GitHub Check: Analyze (typescript)

🧰 Additional context used

🪛 Betterleaks (1.6.1)

.github/workflows/platform-preview-seed-fixture.yml

[high] 83-83: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

🪛 Checkov (3.3.8)

.github/workflows/platform-preview-seed-fixture.yml

[medium] 72-73: Basic Auth Credentials

(CKV_SECRET_4)

🪛 zizmor (1.26.1)

.github/workflows/platform-preview-seed-fixture.yml

[warning] 86-87: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🔇 Additional comments (1)

.github/workflows/platform-preview-seed-fixture.yml (1)

89-121: LGTM!

Also applies to: 150-160, 182-204, 207-228