Release v0.4.9

.coderabbit.yaml

@@ -81,7 +81,9 @@ reviews:
 
   # Ignore patterns - files to skip reviewing
   path_filters:
-    - "!.gobby/plans/completed/**"  # Historical plans, not active guidelines
+    - "!docs/plans/abandoned/**"  # Historical plans, not active guidelines
+    - "!docs/plans/completed/**"
+    - "!.gobby/plans/completed/**"
     - "!**/*.lock"
     - "!**/uv.lock"
     - "!**/.gobby/tasks.jsonl"

.github/coderabbit.yaml

@@ -52,7 +52,7 @@ reviews:
       instructions: |
         Focus on:
         - SQL injection prevention
-        - Thread-safety for SQLite connections
+        - Thread-safety for database connections
         - Transaction handling and rollback
         - Migration safety and backwards compatibility
         - Proper connection cleanup
@@ -95,6 +95,12 @@ reviews:
         - Clarity and completeness
         - Code example correctness
 
+  # Ignore patterns - files to skip reviewing
+  path_filters:
+    - "!docs/plans/abandoned/**"  # Historical plans, not active guidelines
+    - "!docs/plans/completed/**"
+    - "!.gobby/plans/completed/**"
+
 # Security and code quality tools
 tools:
   ruff:

.github/workflows/ci.yml

@@ -2,7 +2,10 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, "0.4.9"]
+    tags:
+      - "v*"
+      - "ci-*"
     paths-ignore:
       - '**.md'
       - 'docs/**'
@@ -22,6 +25,8 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Actions are major-version pinned so Dependabot and branch protection can
+  # carry security updates without manual SHA digest churn on every workflow.
   lint:
     name: Lint
     runs-on: ubuntu-latest
@@ -140,6 +145,14 @@ jobs:
   test:
     name: Test (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    env:
+      GOBBY_POSTGRES_TEST_CONTAINER: postgres-test
+      GOBBY_POSTGRES_TEST_DB: gobby_test
+      GOBBY_POSTGRES_TEST_IMAGE: gobby-postgres-local:18-pgsearch
+      GOBBY_POSTGRES_TEST_PASSWORD: gobby_test
+      GOBBY_POSTGRES_TEST_PORT: "60892"
+      GOBBY_POSTGRES_TEST_USER: gobby_test
+      GOBBY_TEST_PROTECT: "1"
     strategy:
       fail-fast: false
       matrix:
@@ -148,6 +161,75 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Load Postgres test image metadata
+        run: |
+          pg_search_version="$(jq -r '.pg_search_version' src/gobby/data/postgres-pgsearch/version.json)"
+          pg_search_sha256="$(jq -r '.pg_search_sha256' src/gobby/data/postgres-pgsearch/version.json)"
+          database_authority="${GOBBY_POSTGRES_TEST_USER}:${GOBBY_POSTGRES_TEST_PASSWORD}"
+          database_authority="${database_authority}@localhost:${GOBBY_POSTGRES_TEST_PORT}"
+          database_url="postgresql://${database_authority}/${GOBBY_POSTGRES_TEST_DB}"
+          test -n "$pg_search_version"
+          test -n "$pg_search_sha256"
+          test "$pg_search_version" != "null"
+          test "$pg_search_sha256" != "null"
+          {
+            echo "GOBBY_PG_SEARCH_VERSION=$pg_search_version"
+            echo "GOBBY_PG_SEARCH_SHA256=$pg_search_sha256"
+            echo "DATABASE_URL=$database_url"
+          } >> "$GITHUB_ENV"
+
+      - name: Build Postgres test image
+        run: |
+          docker build \
+            --build-arg PG_SEARCH_VERSION="${GOBBY_PG_SEARCH_VERSION}" \
+            --build-arg PG_SEARCH_SHA256="${GOBBY_PG_SEARCH_SHA256}" \
+            -t "${GOBBY_POSTGRES_TEST_IMAGE}" \
+            src/gobby/data/postgres-pgsearch
+
+      - name: Smoke Postgres audit export helper
+        run: |
+          docker run --rm "${GOBBY_POSTGRES_TEST_IMAGE}" \
+            /usr/local/bin/pg_audit_export.sh --help
+
+      - name: Start Postgres test container
+        run: |
+          docker run -d --name "${GOBBY_POSTGRES_TEST_CONTAINER}" \
+            -e POSTGRES_DB="${GOBBY_POSTGRES_TEST_DB}" \
+            -e POSTGRES_USER="${GOBBY_POSTGRES_TEST_USER}" \
+            -e POSTGRES_PASSWORD="${GOBBY_POSTGRES_TEST_PASSWORD}" \
+            -p "${GOBBY_POSTGRES_TEST_PORT}:5432" \
+            --tmpfs /var/lib/postgresql \
+            --health-cmd "pg_isready -U ${GOBBY_POSTGRES_TEST_USER}" \
+            --health-interval 2s \
+            --health-timeout 2s \
+            --health-retries 15 \
+            "${GOBBY_POSTGRES_TEST_IMAGE}" \
+            postgres \
+              -c shared_preload_libraries=pg_search,pgaudit \
+              -c pgaudit.log=write \
+              -c pgaudit.log_catalog=off \
+              -c logging_collector=on \
+              -c log_destination=stderr \
+              -c log_directory=/var/log/pgaudit \
+              -c log_filename=pgaudit-%Y-%m-%d_%H%M%S.log \
+              -c log_rotation_age=1d \
+              -c log_rotation_size=0 \
+              -c log_file_mode=0640 \
+              -c log_min_messages=log
+
+          for _ in $(seq 1 30); do
+            status="$(
+              docker inspect -f '{{.State.Health.Status}}' "${GOBBY_POSTGRES_TEST_CONTAINER}"
+            )"
+            if [ "$status" = "healthy" ]; then
+              exit 0
+            fi
+            sleep 2
+          done
+
+          docker logs "${GOBBY_POSTGRES_TEST_CONTAINER}"
+          exit 1
+
       - name: Install uv
         uses: astral-sh/setup-uv@v4
         with:
@@ -160,7 +242,7 @@ jobs:
         run: uv sync --dev
 
       - name: Run tests
-        run: uv run pytest --cov=gobby --cov-report=xml --cov-report=term-missing --cov-fail-under=80 --ignore=tests/voice --ignore=tests/servers/routes/test_voice_routes.py --deselect tests/hooks/test_hooks_context.py::test_session_start_context_injection
+        run: uv run pytest --cov=gobby --cov-report=xml --cov-report=term-missing --cov-fail-under=80 --ignore=tests/voice --ignore=tests/servers/routes/test_voice_routes.py
 
       - name: Upload coverage to Codecov
         if: matrix.python-version == '3.13'
@@ -224,9 +306,86 @@ jobs:
   build:
     name: Build Package
     runs-on: ubuntu-latest
+    env:
+      GOBBY_POSTGRES_TEST_CONTAINER: postgres-test
+      GOBBY_POSTGRES_TEST_DB: gobby_test
+      GOBBY_POSTGRES_TEST_IMAGE: gobby-postgres-local:18-pgsearch
+      GOBBY_POSTGRES_TEST_PASSWORD: gobby_test
+      GOBBY_POSTGRES_TEST_PORT: "60892"
+      GOBBY_POSTGRES_TEST_USER: gobby_test
     steps:
       - uses: actions/checkout@v4
 
+      - name: Load Postgres test image metadata
+        run: |
+          pg_search_version="$(jq -r '.pg_search_version' src/gobby/data/postgres-pgsearch/version.json)"
+          pg_search_sha256="$(jq -r '.pg_search_sha256' src/gobby/data/postgres-pgsearch/version.json)"
+          database_authority="${GOBBY_POSTGRES_TEST_USER}:${GOBBY_POSTGRES_TEST_PASSWORD}"
+          database_authority="${database_authority}@localhost:${GOBBY_POSTGRES_TEST_PORT}"
+          database_url="postgresql://${database_authority}/${GOBBY_POSTGRES_TEST_DB}"
+          test -n "$pg_search_version"
+          test -n "$pg_search_sha256"
+          test "$pg_search_version" != "null"
+          test "$pg_search_sha256" != "null"
+          {
+            echo "GOBBY_PG_SEARCH_VERSION=$pg_search_version"
+            echo "GOBBY_PG_SEARCH_SHA256=$pg_search_sha256"
+            echo "DATABASE_URL=$database_url"
+          } >> "$GITHUB_ENV"
+
+      - name: Build Postgres test image
+        run: |
+          docker build \
+            --build-arg "PG_SEARCH_VERSION=${GOBBY_PG_SEARCH_VERSION}" \
+            --build-arg "PG_SEARCH_SHA256=${GOBBY_PG_SEARCH_SHA256}" \
+            -t "${GOBBY_POSTGRES_TEST_IMAGE}" \
+            src/gobby/data/postgres-pgsearch
+
+      - name: Smoke Postgres audit export helper
+        run: |
+          docker run --rm "${GOBBY_POSTGRES_TEST_IMAGE}" \
+            /usr/local/bin/pg_audit_export.sh --help
+
+      - name: Start Postgres test container
+        run: |
+          docker rm -f "${GOBBY_POSTGRES_TEST_CONTAINER}" >/dev/null 2>&1 || true
+          docker run -d --name "${GOBBY_POSTGRES_TEST_CONTAINER}" \
+            -e POSTGRES_DB="${GOBBY_POSTGRES_TEST_DB}" \
+            -e POSTGRES_USER="${GOBBY_POSTGRES_TEST_USER}" \
+            -e POSTGRES_PASSWORD="${GOBBY_POSTGRES_TEST_PASSWORD}" \
+            -p "${GOBBY_POSTGRES_TEST_PORT}:5432" \
+            --tmpfs /var/lib/postgresql \
+            --health-cmd "pg_isready -U ${GOBBY_POSTGRES_TEST_USER}" \
+            --health-interval 2s \
+            --health-timeout 2s \
+            --health-retries 15 \
+            "${GOBBY_POSTGRES_TEST_IMAGE}" \
+            postgres \
+              -c shared_preload_libraries=pg_search,pgaudit \
+              -c pgaudit.log=write \
+              -c pgaudit.log_catalog=off \
+              -c logging_collector=on \
+              -c log_destination=stderr \
+              -c log_directory=/var/log/pgaudit \
+              -c log_filename=pgaudit-%Y-%m-%d_%H%M%S.log \
+              -c log_rotation_age=1d \
+              -c log_rotation_size=0 \
+              -c log_file_mode=0640 \
+              -c log_min_messages=log
+
+          for _ in $(seq 1 30); do
+            status="$(
+              docker inspect -f '{{.State.Health.Status}}' "${GOBBY_POSTGRES_TEST_CONTAINER}"
+            )"
+            if [ "$status" = "healthy" ]; then
+              exit 0
+            fi
+            sleep 2
+          done
+
+          docker logs "${GOBBY_POSTGRES_TEST_CONTAINER}"
+          exit 1
+
       - name: Install uv
         uses: astral-sh/setup-uv@v4
         with:
@@ -258,7 +417,8 @@ jobs:
 
       - name: Smoke installed wheel UI
         run: |
-          wheel="$(ls dist/gobby-*.whl | head -n 1)"
+          wheel="$(find dist -maxdepth 1 -name 'gobby-*.whl' -print -quit)"
+          test -n "$wheel"
           uv sync --dev
           GOBBY_TEST_PROTECT=1 GOBBY_RUN_WHEEL_UI_SMOKE=1 GOBBY_WHEEL_PATH="$wheel" \
             uv run pytest tests/packaging/test_installed_wheel_ui_smoke.py -v

.github/workflows/postgres-pgsearch-smoke.yml

@@ -0,0 +1,131 @@
+name: CI
+
+on:
+  push:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-branch-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release-branch-ci:
+    name: Release Branch CI
+    runs-on: ubuntu-latest
+    env:
+      GOBBY_POSTGRES_TEST_CONTAINER: postgres-test
+      GOBBY_POSTGRES_TEST_DB: gobby_test
+      GOBBY_POSTGRES_TEST_IMAGE: gobby-postgres-local:18-pgsearch
+      GOBBY_POSTGRES_TEST_PASSWORD: gobby_test
+      GOBBY_POSTGRES_TEST_PORT: "60892"
+      GOBBY_POSTGRES_TEST_USER: gobby_test
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Load Postgres test image metadata
+        run: |
+          pg_search_version="$(jq -r '.pg_search_version' src/gobby/data/postgres-pgsearch/version.json)"
+          pg_search_sha256="$(jq -r '.pg_search_sha256' src/gobby/data/postgres-pgsearch/version.json)"
+          database_authority="${GOBBY_POSTGRES_TEST_USER}:${GOBBY_POSTGRES_TEST_PASSWORD}"
+          database_authority="${database_authority}@localhost:${GOBBY_POSTGRES_TEST_PORT}"
+          database_url="postgresql://${database_authority}/${GOBBY_POSTGRES_TEST_DB}"
+          test -n "$pg_search_version"
+          test -n "$pg_search_sha256"
+          test "$pg_search_version" != "null"
+          test "$pg_search_sha256" != "null"
+          {
+            echo "GOBBY_PG_SEARCH_VERSION=$pg_search_version"
+            echo "GOBBY_PG_SEARCH_SHA256=$pg_search_sha256"
+            echo "DATABASE_URL=$database_url"
+          } >> "$GITHUB_ENV"
+
+      - name: Build Postgres test image
+        run: |
+          docker build \
+            --build-arg "PG_SEARCH_VERSION=${GOBBY_PG_SEARCH_VERSION}" \
+            --build-arg "PG_SEARCH_SHA256=${GOBBY_PG_SEARCH_SHA256}" \
+            -t "${GOBBY_POSTGRES_TEST_IMAGE}" \
+            src/gobby/data/postgres-pgsearch
+
+      - name: Smoke Postgres audit export helper
+        run: |
+          docker run --rm "${GOBBY_POSTGRES_TEST_IMAGE}" \
+            /usr/local/bin/pg_audit_export.sh --help
+
+      - name: Start Postgres test container
+        run: |
+          docker rm -f "${GOBBY_POSTGRES_TEST_CONTAINER}" >/dev/null 2>&1 || true
+          docker run -d --name "${GOBBY_POSTGRES_TEST_CONTAINER}" \
+            -e POSTGRES_DB="${GOBBY_POSTGRES_TEST_DB}" \
+            -e POSTGRES_USER="${GOBBY_POSTGRES_TEST_USER}" \
+            -e POSTGRES_PASSWORD="${GOBBY_POSTGRES_TEST_PASSWORD}" \
+            -p "${GOBBY_POSTGRES_TEST_PORT}:5432" \
+            --tmpfs /var/lib/postgresql \
+            --health-cmd "pg_isready -U ${GOBBY_POSTGRES_TEST_USER}" \
+            --health-interval 2s \
+            --health-timeout 2s \
+            --health-retries 15 \
+            "${GOBBY_POSTGRES_TEST_IMAGE}" \
+            postgres \
+              -c shared_preload_libraries=pg_search,pgaudit \
+              -c pgaudit.log=write \
+              -c pgaudit.log_catalog=off \
+              -c logging_collector=on \
+              -c log_destination=stderr \
+              -c log_directory=/var/log/pgaudit \
+              -c log_filename=pgaudit-%Y-%m-%d_%H%M%S.log \
+              -c log_rotation_age=1d \
+              -c log_rotation_size=0 \
+              -c log_file_mode=0640 \
+              -c log_min_messages=log
+
+          for _ in $(seq 1 30); do
+            status="$(
+              docker inspect -f '{{.State.Health.Status}}' "${GOBBY_POSTGRES_TEST_CONTAINER}"
+            )"
+            if [ "$status" = "healthy" ]; then
+              exit 0
+            fi
+            sleep 2
+          done
+
+          docker logs "${GOBBY_POSTGRES_TEST_CONTAINER}"
+          exit 1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+
+      - name: Set up Python
+        run: uv python install 3.13
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: web/package-lock.json
+
+      - name: Install Python dependencies
+        run: uv sync --dev
+
+      - name: Install frontend dependencies
+        run: npm ci
+        working-directory: web
+
+      - name: Run pre-push suite
+        run: ./pre-push-test.sh
+
+      - name: Build package
+        run: uv build
+
+      - name: Smoke installed wheel UI
+        run: |
+          wheel="$(find dist -maxdepth 1 -name 'gobby-*.whl' -print -quit)"
+          test -n "$wheel"
+          GOBBY_TEST_PROTECT=1 GOBBY_RUN_WHEEL_UI_SMOKE=1 GOBBY_WHEEL_PATH="$wheel" \
+            uv run pytest tests/packaging/test_installed_wheel_ui_smoke.py -v