fix: disable dev cloud api db ssl mode

scripts/deploy-desired-state-plan.test.mjs

@@ -18,13 +18,17 @@ async function makeFixture({
   deployEnvMirrors = true,
   deploySkillsCommitId = null,
   deployCodeAgentProviderEnv = true,
+  deployDbEnv = true,
+  deployDbSslMode = "disable",
   workloadTag = commitId,
   workloadEnvCommitId = commitId,
   workloadEnvImageTag = commitId,
   workloadEnvImage = null,
   workloadEnvMirrors = true,
   workloadSkillsCommitId = null,
-  workloadCodeAgentProviderEnv = true
+  workloadCodeAgentProviderEnv = true,
+  workloadDbEnv = true,
+  workloadDbSslMode = "disable"
 } = {}) {
   const root = await mkdtemp(path.join(os.tmpdir(), "hwlab-desired-state-"));
   await mkdir(path.join(root, "deploy/k8s/base"), { recursive: true });
@@ -59,6 +63,28 @@ async function makeFixture({
           }
         ]
       : [];
+  const dbEnv =
+    serviceId === "hwlab-cloud-api" && deployDbEnv
+      ? {
+          HWLAB_CLOUD_DB_URL: "secretRef:hwlab-cloud-api-dev-db/database-url",
+          HWLAB_CLOUD_DB_SSL_MODE: deployDbSslMode
+        }
+      : {};
+  const workloadDbEntries =
+    serviceId === "hwlab-cloud-api" && workloadDbEnv
+      ? [
+          {
+            name: "HWLAB_CLOUD_DB_URL",
+            valueFrom: {
+              secretKeyRef: {
+                name: "hwlab-cloud-api-dev-db",
+                key: "database-url"
+              }
+            }
+          },
+          { name: "HWLAB_CLOUD_DB_SSL_MODE", value: workloadDbSslMode }
+        ]
+      : [];
   const deploy = {
     manifestVersion: "v1",
     environment: "dev",
@@ -77,6 +103,7 @@ async function makeFixture({
               HWLAB_IMAGE: deployEnvImage ?? image,
               HWLAB_IMAGE_TAG: deployEnvImageTag,
               ...(deploySkillsCommitId ? { HWLAB_SKILLS_COMMIT_ID: deploySkillsCommitId } : {}),
+              ...dbEnv,
               ...providerEnv
             }
           : {}
@@ -136,6 +163,7 @@ async function makeFixture({
                         { name: "HWLAB_IMAGE", value: workloadEnvImage ?? image },
                         { name: "HWLAB_IMAGE_TAG", value: workloadEnvImageTag },
                         ...(workloadSkillsCommitId ? [{ name: "HWLAB_SKILLS_COMMIT_ID", value: workloadSkillsCommitId }] : []),
+                        ...workloadDbEntries,
                         ...workloadProviderEnv
                       ]
                     : []
@@ -174,12 +202,30 @@ test("passes when cloud-api preserves provider env and DEV egress contract", asy
   const repoRoot = await makeFixture();
   const plan = await buildDesiredStatePlan({ repoRoot });
   assert.equal(plan.status, "pass");
+  assert.equal(plan.cloudApiDb.ready, true);
+  assert.equal(plan.cloudApiDb.sslMode.expected, "disable");
+  assert.equal(plan.cloudApiDb.sslMode.deployMatches, true);
+  assert.equal(plan.cloudApiDb.sslMode.workloadMatches, true);
   assert.equal(plan.codeAgentProvider.ready, true);
   assert.equal(plan.codeAgentProvider.secretRef.present, true);
   assert.equal(plan.codeAgentProvider.egress.deployMatchesDevProxy, true);
   assert.deepEqual(plan.diagnostics, []);
 });
 
+test("blocks when cloud-api DB SSL mode drifts back to require", async () => {
+  const repoRoot = await makeFixture({
+    deployDbSslMode: "require",
+    workloadDbSslMode: "require"
+  });
+  const plan = await buildDesiredStatePlan({ repoRoot });
+  assert.equal(plan.status, "blocked");
+  assert.equal(plan.cloudApiDb.ready, false);
+  assert.equal(plan.cloudApiDb.sslMode.expected, "disable");
+  assert.equal(plan.cloudApiDb.sslMode.deployMatches, false);
+  assert.equal(plan.cloudApiDb.sslMode.workloadMatches, false);
+  assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "cloud_api_db_contract_mismatch"));
+});
+
 test("blocks when cloud-web runtime identity mirrors are missing", async () => {
   const repoRoot = await makeFixture({
     serviceId: "hwlab-cloud-web",