Sqlx and clippy

.cargo/config.toml

@@ -0,0 +1,2 @@
+[env]
+SQLX_OFFLINE = "true"

.github/workflows/gateway.yml

@@ -37,10 +37,15 @@ jobs:
           --health-retries 12
     env:
       TEST_DATABASE_URL: postgres://agent_gateway_admin:agent_gateway_dev@localhost:5432/agent_gateway_test
+      SQLX_OFFLINE: true
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
+      - run: cargo install sqlx-cli --version 0.8.6 --locked --no-default-features --features postgres
+      - run: SQLX_OFFLINE=false DATABASE_URL="$TEST_DATABASE_URL" cargo sqlx database setup
+      - run: SQLX_OFFLINE=false DATABASE_URL="$TEST_DATABASE_URL" cargo sqlx prepare --check -- --all-targets --locked
+      - run: cargo clippy --locked --all-targets
       - run: cargo test --locked
 
   image:

Cargo.toml

@@ -3,6 +3,9 @@ name = "agent_gateway"
 version = "0.1.0"
 edition = "2024"
 
+[lints.clippy]
+pedantic = "deny"
+
 [dependencies]
 tokio = { version = "1", features = ["io-util", "macros", "net", "rt-multi-thread", "signal", "time"] }
 rustls = { version = "0.23", default-features = false, features = ["aws-lc-rs", "std", "tls12"] }
@@ -26,7 +29,7 @@ opentelemetry = "0.31"
 opentelemetry_sdk = { version = "0.31", default-features = false, features = ["rt-tokio", "trace"] }
 opentelemetry-otlp = { version = "0.31", default-features = false, features = ["grpc-tonic", "trace"] }
 anyhow = "1"
-sqlx = { version = "0.8.6", default-features = false, features = ["runtime-tokio-rustls", "postgres", "chrono", "derive"] }
+sqlx = { version = "0.8.6", default-features = false, features = ["runtime-tokio-rustls", "postgres", "chrono", "macros"] }
 chrono = "0.4.44"
 p256 = { version = "0.13.2", features = ["ecdsa", "pkcs8"] }
 

README.md

@@ -151,3 +151,15 @@ cargo test
 ```
 
 Database-backed policy and e2e tests require `TEST_DATABASE_URL` to point at a Postgres database that the test process can migrate and write to. The tests cover policy evaluation, signed-permission verification, signer delegation scope enforcement, destination normalization, config validation, TLS PKI generation, and proxy request parsing.
+
+## SQLx Query Metadata
+
+Checked SQLx query macros compile against committed `.sqlx` metadata by default, so normal builds do not need database access. The metadata is derived from the migrations; it does not replace the migration SQL used to create or update the database schema.
+
+Regenerate the metadata after changing migrations or SQL query text:
+
+```bash
+cargo install sqlx-cli --version 0.8.6 --locked --no-default-features --features postgres
+SQLX_OFFLINE=false DATABASE_URL="$TEST_DATABASE_URL" cargo sqlx database setup
+SQLX_OFFLINE=false DATABASE_URL="$TEST_DATABASE_URL" cargo sqlx prepare -- --all-targets --locked
+```