test(store): isolate firewall client integration from demo seed

Тест ждал tenant со slug demo, а seedDemo создаёт его только в пустой базе. После соседних интеграционных тестов DemoIDs пустой, и проверка падала. Теперь тест создаёт и удаляет собственный tenant.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/quality.yaml

@@ -361,7 +361,9 @@ jobs:
       - name: Run migrations and verify PostgreSQL integration tests executed
         env:
           GOFLAGS: -mod=readonly
-          EVOBGP_TEST_DATABASE_URL: postgres://evobgp:evobgp_ci@127.0.0.1:5432/evobgp_test?sslmode=disable
+          # Job and the postgres service are sibling containers on act_runner.
+          # 127.0.0.1 is the job itself; the service is reachable by its name.
+          EVOBGP_TEST_DATABASE_URL: postgres://evobgp:evobgp_ci@postgres:5432/evobgp_test?sslmode=disable
         run: bash scripts/ci/postgres-integration.sh
 
   legacy-compatibility:

internal/birddeploy/sync_unix.go

@@ -9,6 +9,6 @@ func syncDir(path string) error {
 	if err != nil {
 		return err
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 	return f.Sync()
 }

internal/repository/postgres_firewall_test.go

@@ -8,6 +8,8 @@ import (
 	"evobgp/internal/authkey"
 	"evobgp/internal/db"
 	"evobgp/internal/store"
+
+	"github.com/google/uuid"
 )
 
 func TestPostgresFirewallClientCreateAndGetIntegration(t *testing.T) {
@@ -21,14 +23,17 @@ func TestPostgresFirewallClientCreateAndGetIntegration(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer pool.Close()
-	pg, err := NewPostgres(ctx, pool, true)
+	pg, err := NewPostgres(ctx, pool, false)
 	if err != nil {
 		t.Fatal(err)
 	}
-	tenant, _, _, _, _ := pg.DemoIDs()
+	tenant := uuid.NewString()
-	if tenant == "" {
+	if _, err := pool.Exec(ctx, `INSERT INTO tenant (id, name, slug) VALUES ($1, $2, $3)`, tenant, "firewall", "fw-"+tenant); err != nil {
-		t.Fatal("demo tenant required")
+		t.Fatal(err)
 	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM tenant WHERE id = $1`, tenant)
+	})
 	tok := "evobgp_fw_pgtest_" + t.Name()
 	hash := authkey.HashToken(tok)
 	client, err := pg.CreateFirewallClient(tenant, &store.FirewallClientCreate{

scripts/ci/postgres-integration.sh

@@ -3,6 +3,31 @@ set -euo pipefail
 
 : "${EVOBGP_TEST_DATABASE_URL:?PostgreSQL integration tests require EVOBGP_TEST_DATABASE_URL}"
 
+# The Gitea job container does not publish the service onto its own loopback.
+# Wait until the DSN host accepts TCP so a slow postmaster is not a test failure.
+python3 - <<'PY'
+import os
+import socket
+import time
+from urllib.parse import urlparse
+
+raw = os.environ["EVOBGP_TEST_DATABASE_URL"]
+parsed = urlparse(raw)
+host = parsed.hostname or "127.0.0.1"
+port = parsed.port or 5432
+deadline = time.time() + 90
+last = "no attempt"
+while time.time() < deadline:
+    try:
+        with socket.create_connection((host, port), timeout=2):
+            print(f"postgres tcp open at {host}:{port}", flush=True)
+            raise SystemExit(0)
+    except OSError as exc:
+        last = str(exc)
+        time.sleep(2)
+raise SystemExit(f"postgres not accepting TCP at {host}:{port} after 90s: {last}")
+PY
+
 assert_passes() {
   local result_file="$1" package="$2" label="$3"
   shift 3