[w1am]

Pass the test license key to the cluster nodes

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The test setup now passes a license key to KurrentDB and uses docker compose up -d --wait to start services.

Changes: KurrentDB test setup

Layer / File(s)	Summary
Configure and start test KurrentDB shared.env, .github/workflows/tests.yml, Makefile	shared.env reads the license key from KURRENTDB_LICENSE_KEY, defaulting to an empty value. The workflow supplies the test license secret. The Makefile uses docker compose up -d --wait instead of manually polling container health. The subsequent docker compose ps command is unchanged.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: Minimal · up to 34c3d

The startup change has no confirmed merge-blocking risk; normal CI checks remain appropriate.

Security architecture risk: Low · up to 34c3d

The license reaches the three intended cluster services without changing network exposure or authentication settings. Startup errors prevent subsequent CI tests from running. Remaining uncertainty concerns image-defined readiness checks and license-bearing container cleanup after interrupted startup.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The additional secret recipients are three cluster containers per standard test job, across the existing suite and runtime matrices, plus QA-selected cluster images. The standard startup mapping is step-scoped rather than job-wide.

Trust Boundaries and Controls

• inferred — The selected cluster image is now a license-consuming trusted workload. Ordinary runtime images come from repository configuration, while QA accepts registry, image and tag through manual-dispatch inputs. Those input sources are unchanged; the PR newly delivers the license to their default cluster workloads.
• observed — The existing OAuth job already receives this license secret and passes it as a container environment setting. The new mapping extends the recipient set rather than introducing the repository's first license-secret path.

Resilience and Maintainability Implications

• inferred — Repetition and concurrent local runs retain the pre-existing fixed project, container and network identities. The PR does not introduce those ownership collisions, but retained containers can now retain the license too. Source inspection does not establish their lifetime after cancellation or external runner disposal.

Hardening Proposals

• proposed — Where test hosts can persist beyond a job, make teardown unconditional on success, failure and cancellation to bound the lifetime of license-bearing containers. This is lifecycle hardening, not a verified cross-boundary disclosure finding.

Pre-merge checks: 3

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: da3be0a2-83ea-482c-bd75-9e9808e139a8

Commits

Reviewing files that changed from the base of the PR and between d22293c and 34c3d61.

Files selected for processing: 3

• .github/workflows/tests.yml
• Makefile
• shared.env

Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• kurrent-io/Automations (auto-detected)

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 8 remain after this review.