feat(arch): PASAY-TASK-011 Worker→Queue→Container→Neon P0 Closeout (Issue #31)

.github/workflows/pr-ci.yml

@@ -19,6 +19,20 @@ jobs:
     timeout-minutes: 15
     env:
       PYTHONPATH: ""
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready -U postgres"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=5
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -50,6 +64,12 @@ jobs:
             echo "bot=false" >> "$GITHUB_OUTPUT"
           fi
 
+          if printf '%s\n' "$files" | grep -Eq '^(cloudflare-worker/)'; then
+            echo "cloudflare=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "cloudflare=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Verify GitHub workflow files
         run: |
           test -f AGENTS.md
@@ -73,13 +93,13 @@ jobs:
           grep -q "pasay-gate" README.md
 
       - name: Set up Python
-        if: steps.changed.outputs.backend == 'true' || steps.changed.outputs.bot == 'true'
+        if: steps.changed.outputs.backend == 'true' || steps.changed.outputs.bot == 'true' || steps.changed.outputs.cloudflare == 'true'
         uses: actions/setup-python@v5
         with:
           python-version: "3.11"
 
       - name: Install backend dependencies
-        if: steps.changed.outputs.backend == 'true'
+        if: steps.changed.outputs.backend == 'true' || steps.changed.outputs.cloudflare == 'true'
         run: |
           python -m pip install --upgrade pip
           python -m pip install -r requirements.txt
@@ -89,6 +109,23 @@ jobs:
         run: |
           python -c "import app.main, fastapi, alembic, sqlalchemy; print('BACKEND_IMPORT_SMOKE_OK')"
 
+      - name: Run backend targeted pytest (Issue #18 + Issue #31)
+        if: steps.changed.outputs.backend == 'true' || steps.changed.outputs.cloudflare == 'true'
+        env:
+          DATABASE_URL: "postgresql+psycopg2://postgres:postgres@localhost:5432/postgres"
+          DATABASE_URL_UNPOOLED: "postgresql+psycopg2://postgres:postgres@localhost:5432/postgres"
+          PASAY_TEST_DB_NAME: "pasay_pm_test"
+          TELEGRAM_BOT_TOKEN: "fake-token-for-ci-pass-12345"
+          TELEGRAM_WEBHOOK_SECRET: "fake-webhook-secret-for-ci"
+          PASAY_CONTAINER_INGEST_TOKEN: "fake-ingest-token-for-ci"
+          PASAY_RUNTIME_MODE: "ci"
+        timeout-minutes: 8
+        run: |
+          python -m pytest \
+            tests/test_prod_arch_closeout_p0_031.py \
+            tests/test_telegram_webhook_p018.py \
+            -v --tb=short -q
+
       - name: Install bot dependencies
         if: steps.changed.outputs.bot == 'true'
         working-directory: pasay-telegram-bot
@@ -101,3 +138,48 @@ jobs:
         working-directory: pasay-telegram-bot
         run: |
           python -c "import pasay_bot.main, telegram, httpx; print('BOT_IMPORT_SMOKE_OK')"
+
+      - name: Set up Node.js (Cloudflare Worker TS Gate)
+        if: steps.changed.outputs.cloudflare == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: cloudflare-worker/package-lock.json
+
+      - name: Cloudflare Worker — verify Node engine gate
+        if: steps.changed.outputs.cloudflare == 'true'
+        working-directory: cloudflare-worker
+        run: |
+          node -e "const v=process.versions.node.split('.').map(Number); if(v[0]<22){console.error('NODE_VERSION_TOO_OLD:', process.version); process.exit(1);} console.log('NODE_VERSION_OK:', process.version)"
+
+      - name: Cloudflare Worker — install dependencies (strict lockfile)
+        if: steps.changed.outputs.cloudflare == 'true'
+        working-directory: cloudflare-worker
+        run: |
+          npm ci --no-audit --no-fund
+
+      - name: Cloudflare Worker — typecheck gate (real src + mock tests, separate tsconfigs)
+        if: steps.changed.outputs.cloudflare == 'true'
+        working-directory: cloudflare-worker
+        run: |
+          # (1) REAL build — no mock paths, use the PUBLISHED @cloudflare/containers
+          # 0.3.7 types directly.  This FAILS CLOSED if the src code imports or
+          # declares types incompatible with the REAL npm package (earlier
+          # versions of tsconfig.json pointed @cloudflare/containers at a local
+          # mock, giving a false-green typecheck).
+          npm run types:src
+          # (2) TEST build — with paths mock, so the test-only import graph
+          # resolves @cloudflare/containers through ./tests/mock_containers.ts
+          # (the runtime platform is absent during `npx tsx` on the host).
+          npm run types:tests
+
+      - name: Cloudflare Worker — TS spec runner (real handler E2E, with paths mock)
+        if: steps.changed.outputs.cloudflare == 'true'
+        working-directory: cloudflare-worker
+        run: |
+          # Spec runtime MUST point tsconfig at the tests tsconfig so the
+          # @cloudflare/containers paths alias resolves to the mock (the
+          # real package cannot be loaded in Node.js because it imports
+          # the Cloudflare-only virtual module "cloudflare:workers").
+          npx tsx --tsconfig tsconfig.tests.json tests/index.spec.ts