RHINENG-30223: reusable deploy-time SQL job, store owner IDs

[dominikvagner]

Summary

Enables running bundled SQL scripts when selected through deployment configuration,
avoiding separate one-off job implementations. Leave un-configured
deployments unchanged and use transactions, timeouts, and an advisory
lock for execution.

And adds dual-write of upload owner IDs to a new nullable column while preserving
the legacy subscription-manager mapping. Provide a re-runnable SQL copy
for existing rows so owner-based consumers and subscription-manager ID
extraction can switch sources in a later change.

Secure Coding Checklist

• Input Validation
• Output Encoding
• Authentication and Password Management
• Session Management
• Access Control
• Cryptographic Practices
• Error Handling and Logging
• Data Protection
• Communication Security
• System Configuration
• Database Security
• File Management
• Memory Management
• General Coding Practices

Summary by Sourcery

Introduce an opt-in deploy-time SQL runner and begin migrating inventory ownership data to a dedicated owner ID field.

New Features:

• Add a reusable deploy-time SQL job that runs selected bundled scripts with transactional execution, timeouts, readiness checks, and concurrency protection.
• Add a nullable owner ID field to system inventory records and dual-write upload owner IDs alongside the legacy subscription-manager mapping.

Enhancements:

• Provide a re-runnable owner ID backfill for existing inventory records while preserving legacy identifier values.

Build:

• Bundle SQL job scripts into the application image.

Deployment:

• Configure an opt-in SQL job and deployment invocation that skips execution when no script is selected.

Documentation:

• Document SQL job selection, execution guarantees, operational safeguards, and rerun requirements.

Tests:

• Add coverage for SQL job validation, transactional rollback, timeouts, cancellation, advisory locking, migration behavior, and owner ID backfill.

[sourcery-ai]

Reviewer's Guide

This PR adds a deployment-configured SQL runner that safely executes repository-bundled PostgreSQL scripts with transactional, timeout, and advisory-lock protections, and introduces nullable owner-ID storage with dual-write compatibility plus a rerunnable backfill for existing inventory data.

File-Level Changes

Change	Details	Files
Add a deploy-triggered, reusable SQL job for explicitly selected bundled scripts.	Bundle SQL scripts into the runtime image and expose a sql job plus per-deployment invocation. Validate that selection names a regular repository-owned .sql file and no-op when unset. Execute the selected script in a transaction with a transaction-scoped advisory lock, configurable lock/statement timeouts, rollback on failure, and fatal error reporting. Document operational usage, rerun requirements, execution constraints, and verification expectations.	Dockerfile deploy/clowdapp.yaml docs/md/database.md docs/md/sql-jobs.md main.go tasks/sql_job/sql_job.go tasks/sql_job/sql_job_test.go
Persist upload owner IDs independently while retaining the legacy subscription-manager mapping.	Add nullable owner_id to the model and partitioned inventory schema through migration 169. Dual-write the host owner ID to both owner_id and subscription_manager_id during inventory uploads. Extend listener assertions and upload tests to verify both columns.	base/models/models.go database_admin/migrations/169_add_owner_id.up.sql database_admin/migrations/169_add_owner_id.down.sql database_admin/schema/create_schema.sql listener/upload.go listener/upload_test.go listener/common_test.go
Provide a rerunnable bundled backfill for existing inventory rows.	Copy non-null legacy subscription-manager values into null owner IDs without overwriting existing owner IDs. Add integration coverage for repeated backfill execution and migration behavior.	tasks/sql_job/sql/001_backfill_owner_id.sql tasks/sql_job/owner_id_test.go

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="tasks/sql_job/sql/001_backfill_owner_id.sql" line_range="4-6" />
<code_context>
+-- Run only while subscription_manager_id still stores owner IDs.
+-- Do not run after subscription_manager_id starts storing actual subscription-manager IDs.
+-- Related to: RHINENG-30223
+UPDATE system_inventory
+SET owner_id = subscription_manager_id
+WHERE owner_id IS NULL
+  AND subscription_manager_id IS NOT NULL;
</code_context>
<issue_to_address>
**Owner IDs become stale**

When older application pods are still uploading hosts while the backfill runs, the `UPDATE` only copies rows visible when it runs, so later inserts remain NULL and subsequent `subscription_manager_id` updates leave copied `owner_id` values stale. Rerunning skips those non-NULL values, so consumers read missing or outdated owner IDs.

Run the backfill only after older pods stop uploading, or keep `owner_id` synchronized with their writes.

Also at `deploy/clowdapp.yaml:741`.
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 1 finding to address first, and this adds an automatically invoked production SQL execution path and a backfill that persists owner IDs in the database; a mistakenly selected or semantically stale script could successfully write incorrect data, and reverting the application would not restore those writes. The transaction limits partial execution, but it does not repair a completed wrong update, so recovery would require a separate corrective operation or verified data restoration.

Blocking findings: tasks/sql_job/sql/001_backfill_owner_id.sql:6

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[codecov-commenter]

Codecov Report

❌ Patch coverage is 59.37500% with 26 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.95%. Comparing base (3c8b4a3) to head (2a72e03).

Files with missing lines	Patch %	Lines
tasks/sql_job/sql_job.go	60.00%	21 Missing and 3 partials ⚠️
main.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2356      +/-   ##
==========================================
+ Coverage   58.92%   58.95%   +0.03%     
==========================================
  Files         150      151       +1     
  Lines        9626     9690      +64     
==========================================
+ Hits         5672     5713      +41     
- Misses       3355     3375      +20     
- Partials      599      602       +3     

Flag	Coverage Δ
unittests	58.95% <59.37%> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dominikvagner]

/test

[dominikvagner]

/test