From b41b136607b5d1ec7cdd8919b96c6393748c5613 Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Sun, 11 Oct 2026 03:34:41 +0000
Subject: [PATCH] Run the CI PG setup as postgres via runuser/su (root
 container, no sudo)

Why: the runner container executes as root without sudo; the previous $SUDO -u postgres expanded to a bare '-u' and failed with exit 127 on the first test-pg run (job 2280 log).

Evidence: job 2280 log lines '/var/run/act/workflow/3: line 6: -u: command not found', exitcode 127; postgresql service itself started fine as root.

Impact: test-pg job setup steps only; also prints pinned pgvector/pg_trgm extension versions for acceptance records.

Refs: PR #325; docs/guides/team-storage.md section 5.
---
 .gitea/workflows/ci.yaml | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 73973f23..65c4e37d 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -344,18 +344,26 @@ jobs:
           $SUDO apt-get install -y postgresql postgresql-contrib postgresql-16-pgvector redis-server
           # 固定组件/扩展版本输出（随日志归档，作为验收对齐依据）。
           psql --version
-          $SUDO -u postgres psql -tAc "SELECT extversion FROM pg_extension WHERE extname='pgvector'" || true
           redis-server --version
       - name: Start PostgreSQL and Redis
         run: |
           set -euo pipefail
           SUDO=""
           if command -v sudo >/dev/null 2>&1 && [ "$(id -u)" != 0 ]; then SUDO=sudo; fi
+          # 运行器容器以 root 运行且无 sudo：以 postgres 身份执行用 runuser/su
+          # （实测 $SUDO -u 在 root 容器展开成裸 "-u" → exit 127）。
+          pg_as_postgres() {
+            if command -v runuser >/dev/null 2>&1; then runuser -u postgres -- "$@";
+            else su postgres -s /bin/bash -c "$*"; fi
+          }
           $SUDO service postgresql start || $SUDO pg_ctlcluster 16 main start
-          $SUDO -u postgres psql -c "CREATE USER ci_agent PASSWORD 'ci_job_local_only' CREATEDB"
-          $SUDO -u postgres psql -c "CREATE DATABASE agent_test OWNER ci_agent"
-          # 预装 pg_trgm 到 public：与测试辅助的幂等预装一致，锁定的组件契约。
-          $SUDO -u postgres psql -d agent_test -c "CREATE EXTENSION IF NOT EXISTS pg_trgm"
+          # 预装 pg_trgm 到 public：与测试辅助的幂等预装一致，锁定的组件契约；
+          # pgvector 版本一并输出（随日志归档，作为验收对齐依据）。
+          pg_as_postgres psql -tAc "CREATE EXTENSION IF NOT EXISTS pgvector"
+          pg_as_postgres psql -tAc "SELECT extname || '=' || extversion FROM pg_extension WHERE extname IN ('pgvector','pg_trgm')"
+          pg_as_postgres psql -c "CREATE USER ci_agent PASSWORD 'ci_job_local_only' CREATEDB"
+          pg_as_postgres psql -c "CREATE DATABASE agent_test OWNER ci_agent"
+          pg_as_postgres psql -d agent_test -c "CREATE EXTENSION IF NOT EXISTS pg_trgm"
           redis-server --daemonize yes --port 6399 --save '' --appendonly no
           redis-cli -p 6399 ping
       - name: Backend tests against real PostgreSQL and Redis (required, no silent skip)