ci(coverage): wire PostgreSQL store tests into the coverage gate

[eoinfennessy]

Background

store/postgres.rs is excluded from the coverage-check gate
(Makefile) because its 27 tests are
#[ignore]d — they require a live DATABASE_URL that the coverage
job doesn't provide. That exclusion currently covers the whole file
(~1000 lines), not just the untestable parts, so future regressions
in the ~700 lines of pre-existing production code (connection setup,
CRUD, row conversion, schema validation) are invisible to the 95%
line-coverage threshold.

Flagged by praxis-bot on #570: #570 (comment)

#739 already added a postgres.yaml CI workflow that runs the
ignored postgres unit/integration tests against a real service
container, but that run is separate from make coverage-check and
isn't instrumented for coverage.

Proposed approach

cargo-llvm-cov supports accumulating coverage across multiple test
invocations via --no-report, then producing one merged report:

cargo llvm-cov clean --workspace
cargo llvm-cov --no-report --workspace ...                                    # normal suite
DATABASE_URL=... cargo llvm-cov --no-report -p praxis-ai-apis store::tests::pg_ -- --ignored   # postgres unit tests
cargo llvm-cov report --json --output-path coverage.json                      # merged report

This would let coverage-check include store/postgres.rs without
the blanket exclusion. It requires:

• Adding a postgres service container to .github/workflows/coverage.yaml
  (mirroring the one already in postgres.yaml).
• Splitting the coverage-check Makefile target into the --no-report
  accumulation passes above plus a final merged report.
• Removing the store/postgres\.rs exclusion from the
  --ignore-filename-regex in Makefile.

Trade-off to weigh

This makes the coverage gate depend on a live database for every PR,
adding container startup time to a job that currently runs without
external services.

[jordigilh]

Found this while doing a broader test-coverage audit across the repo, flagging it here instead of filing a duplicate issue since it's the same gap this issue already describes.

apis/src/store/postgres.rs is a default-enabled response-store backend (apis/Cargo.toml L16-17: default = ["store"]), but its own test module barely touches it -- 4 tests, all exercising pg_connect_options, for an 831-line file. The CRUD/row-conversion/schema-validation logic that makes up the other ~700 lines isn't covered there at all:

mod tests {
    use super::*;

    #[test]
    fn connect_options_defaults_to_verify_full() { ... }

    #[test]
    fn connect_options_default_overrides_url_sslmode() { ... }

    #[test]
    fn connect_options_uses_explicit_sslmode_override() { ... }

    #[test]
    fn connect_options_applies_ssl_root_cert() { ... }
}

postgres.rs#L783-L830

That logic is tested separately, by 27 #[ignore]d pg_* tests that only run via make test-postgres-unit against a live DATABASE_URL.

Checked this still holds against current main (upstream/main@333f93d): #739 added .github/workflows/postgres.yaml to run those ignored tests for real, but that's a separate CI job from the one this issue is about. make coverage-check's workspace-wide cargo llvm-cov run doesn't include it, so the 95% line-coverage gate this issue wants to add still wouldn't see this file's real coverage. Confirming the gap is still there before anyone scopes a fix. No new issue needed, just wanted it visible here.

[leseb]

closed by #739?