Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Enforce SQLAlchemy-only database connections and Alembic-only schema changes

Aperta
  • Qualcosa non va?
#3,978 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

@anth-volk ci sta già lavorando.

Dal 20/10/2026.

  • #3979 di @anth-volk — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
github-actions, postgresql, python, sqlalchemy
Ambito
backend, ci-cd, databases, testing

Direzione di ricerca

Start with the existing rules registry and pytest guards, then inspect policyengine_api/data/v2/catalog/publication_staging.py to understand the two stated exceptions. Add a guard covering the specified code paths, proof fixtures, CI wiring in the existing test job, and guidance in docs/engineering/skills/alembic-migrations.md. Done means the guard rejects direct relational driver use and non-Alembic persistent schema changes, accepts only the exact exceptions, and its tests run in CI. Pull request #3979 is already open.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem

The Public API opens every relational database connection through SQLAlchemy today: API v1 builds its Cloud SQL engine in policyengine_api/data/orm.py (the Cloud SQL connector is passed to create_engine as creator=), and API v2 builds its SQLModel engine from a postgresql+psycopg URL in policyengine_api/data/v2/database.py. Schema changes go through the autogenerated Alembic revisions under migrations/v1 and migrations/v2.

Nothing enforces either of these. The rules registry has related rules, but none of them forbids:

  • a direct driver connection such as psycopg.connect(...), pymysql.connect(...) or sqlite3.connect(...), or use of the driver connection beneath SQLAlchemy, in application code, scripts or CI code. api.data.runtime-sql-confined only confines raw SQL to the data-access layer, and api.services.no-direct-queries only covers services;
  • a schema change outside Alembic, such as metadata.create_all(engine), Table.create(...), op.* outside migrations/, or CREATE / ALTER / DROP / TRUNCATE SQL text. api.migration.alembic-autogenerated-only is doc-only, and api.migration.alembic-v1-qualified / api.migration.alembic-v2-qualified check the revisions, not the code around them.

Both have happened before: the Stage 12 provisioning script (removed in d8bd72191) opened psycopg connections directly, and the local database bootstrap added in 6c7804100 called V1Base.metadata.create_all at runtime.

Proposed rule

Register an enforced rule, api.data.sqlalchemy-and-alembic-only: code connects to relational databases only through SQLAlchemy engines, connections and sessions, never by calling a database driver directly, and changes persistent schema only through Alembic revisions.

  • Enforce it with a pytest guard that parses non-test code (policyengine_api/, scripts/, migrations/, .github/, excluding tests and the generated revisions under migrations/*/versions/).
  • Declare the two current exceptions exactly, both in policyengine_api/data/v2/catalog/publication_staging.py:
    • COPY ... FROM STDIN through the psycopg connection beneath a SQLAlchemy Connection, because SQLAlchemy has no COPY API;
    • STAGING_METADATA.create_all for TEMPORARY tables that Postgres drops at commit, which are not persistent schema.
  • The guard should fail if either exception grows or is no longer needed.
  • Redis (policyengine_api/runtime_cache/) is a key-value cache, not a relational database, and is out of scope.
  • Add proof fixtures, CI wiring through the existing test job, and a section in docs/engineering/skills/alembic-migrations.md.
Lingua principale
Python
Stelle
18
Fork
33
Merge medio
2g 18h
PR unite (30g)
36

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di PolicyEngine/policyengine-api

Tutte le issue di PolicyEngine/policyengine-api

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.