chore(prod): pin pgwire proxy image to 1.0.0

.github/workflows/ci.yaml

@@ -13,42 +13,62 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
-      - name: Setup Rust
+      - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
-      - name: Download dependencies
-        run: cargo fetch
+      - name: Cache cargo
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Run tests
-        run: cargo test
+        run: cargo test --locked
 
       - name: Build
-        run: cargo build --release
+        run: cargo build --release --locked
 
   lint:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
-      - name: Setup Rust
+      - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
-          components: clippy
+          components: rustfmt, clippy
+
+      - name: Cache cargo
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
-      - name: Download dependencies
-        run: cargo fetch
+      - name: Check formatting
+        run: cargo fmt --all --check
 
-      - name: Install qlty
-        run: |
-          curl -fsSL https://qlty.sh | QLTY_VERSION=0.618.0 bash
-          echo "$HOME/.qlty/bin" >> $GITHUB_PATH
+      - name: Lint with clippy
+        run: cargo clippy --all-targets --locked -- -D warnings
 
-      - name: Lint and security scan
-        run: qlty check --all --no-progress
+  osv-scan:
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.5
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    with:
+      scan-args: |-
+        --lockfile=Cargo.lock

.github/workflows/pr.yaml

@@ -13,31 +13,43 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
-      - name: Setup Rust
+      - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
-          components: clippy
+          components: rustfmt, clippy
 
-      - name: Download dependencies
-        run: cargo fetch
-
-      - name: Install qlty
-        run: |
-          curl -fsSL https://qlty.sh | QLTY_VERSION=0.618.0 bash
-          echo "$HOME/.qlty/bin" >> $GITHUB_PATH
+      - name: Cache cargo
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
-      - name: Lint and security scan
-        run: qlty check --all --no-progress
+      - name: Check formatting
+        run: cargo fmt --all --check
 
-      - name: Clippy
-        run: cargo clippy --all-targets -- -D warnings
+      - name: Lint with clippy
+        run: cargo clippy --all-targets --locked -- -D warnings
 
       - name: Test
-        run: cargo test
+        run: cargo test --locked
 
       - name: Build
-        run: cargo build --release
+        run: cargo build --release --locked
+
+  osv-scan:
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.5
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+      pull-requests: write
+    with:
+      scan-args: |-
+        --lockfile=Cargo.lock

CLAUDE.md

@@ -10,7 +10,7 @@ make test       # cargo test
 make clippy     # cargo clippy --all-targets -- -D warnings
 make fmt        # cargo fmt
 make ci         # clippy + test + build (full pre-merge check)
-make qlty       # qlty check --all (clippy + security scan)
+make lint       # lefthook checks
 ```
 
 Run a single test:

Cargo.toml

@@ -34,7 +34,7 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
 # Random
-rand = "0.8"
+rand = "0.10.1"
 
 # TLS (optional — enable with features = ["tls"]; currently disabled for no-TLS MVP)
 # tokio-rustls = "0.26"

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help build clean test fmt clippy qlty ci check-clean install-hooks
+.PHONY: help build clean test fmt clippy lint ci check-clean install-hooks
 
 # Default target
 help:
@@ -8,10 +8,10 @@ help:
 	@echo "  make test          - Run tests"
 	@echo "  make fmt           - Format code with rustfmt"
 	@echo "  make clippy        - Run clippy linter"
-	@echo "  make qlty          - Run qlty check (clippy + security scan)"
-	@echo "  make ci            - Run all CI checks (qlty, test, build)"
+	@echo "  make lint          - Run lefthook checks"
+	@echo "  make ci            - Run all CI checks (clippy, test, build)"
 	@echo "  make check-clean   - Check if working directory is clean"
-	@echo "  make install-hooks - Install qlty git hooks"
+	@echo "  make install-hooks - Install lefthook git hooks"
 
 # Build the release binary
 build:
@@ -35,11 +35,9 @@ fmt:
 clippy:
 	@cargo clippy --all-targets -- -D warnings
 
-# Run qlty check (clippy + trufflehog + hadolint + osv-scanner)
-qlty:
-	@echo "Running qlty check..."
-	@qlty check --all --no-progress
-	@echo "✓ Qlty check complete"
+# Run lefthook checks
+lint:
+	@lefthook run pre-commit --all-files
 
 # Run all checks and build
 ci: clippy test build
@@ -55,7 +53,7 @@ check-clean:
 		echo "✓ Working directory is clean"; \
 	fi
 
-# Install qlty git hooks (pre-commit: fmt, pre-push: lint + security)
+# Install lefthook git hooks
 install-hooks:
-	@qlty githooks install
-	@echo "✓ Qlty hooks installed"
+	@lefthook install
+	@echo "✓ Lefthook hooks installed"

lefthook.yml

@@ -0,0 +1,16 @@
+pre-commit:
+  parallel: true
+  jobs:
+    - name: fmt
+      glob: "*.rs"
+      run: cargo fmt --all --check
+
+    - name: clippy
+      glob: "*.rs"
+      run: cargo clippy --all-targets -- -D warnings
+
+    - name: osv
+      glob:
+        - "Cargo.lock"
+        - "Cargo.toml"
+      run: osv-scanner --lockfile Cargo.lock

tanka/environments/prod/main.jsonnet

@@ -3,7 +3,7 @@ local pgwire = import '../../lib/pgwire.libsonnet';
 local params = {
   env: 'prod',
   namespace: 'supa-prod',
-  imageTag: 'v0.1.1',
+  imageTag: '1.0.0',
   imagePullPolicy: 'IfNotPresent',
 
   // CNPG pooler connection (flicknote-rw is in infra-prod, serves supabase db)