fix: preserve migration TLS require semantics

scripts/gitops-render.test.ts

@@ -770,6 +770,7 @@ test("v03 render keeps node identity as data instead of generated structure", as
       CLOUD_CORE_MIGRATIONS.map((migration) => path.basename(migration.path))
     );
     assert.match(externalPostgresMigrationConfig?.data?.["run.mjs"] ?? "", /DATABASE_URL is required/u);
+    assert.match(externalPostgresMigrationConfig?.data?.["run.mjs"] ?? "", /uselibpqcompat/u);
     assert.match(externalPostgresMigrationConfig?.data?.["run.mjs"] ?? "", /hwlab-runtime-migration-started/u);
     assert.equal(externalPostgresMigrationConfig?.metadata?.annotations?.["argocd.argoproj.io/sync-wave"], "-2");
     assert.equal(externalPostgresMigrationJob?.metadata?.annotations?.["argocd.argoproj.io/sync-wave"], "-1");

scripts/src/gitops-render/runtime-manifests.mjs

@@ -864,8 +864,11 @@ function externalPostgresMigrationRunner() {
     'const { Pool } = require("/opt/hwlab-env/node_modules/pg");',
     'const root = "/opt/hwlab-migrations";',
     'const files = (await readdir(root)).filter((name) => /^\\d+_.*\\.sql$/u.test(name)).sort();',
-    'const connectionString = process.env.DATABASE_URL;',
-    'if (!connectionString) throw new Error("DATABASE_URL is required");',
+    'const rawConnectionString = process.env.DATABASE_URL;',
+    'if (!rawConnectionString) throw new Error("DATABASE_URL is required");',
+    'const connectionUrl = new URL(rawConnectionString);',
+    'if (connectionUrl.searchParams.get("sslmode") === "require" && !connectionUrl.searchParams.has("uselibpqcompat")) connectionUrl.searchParams.set("uselibpqcompat", "true");',
+    'const connectionString = connectionUrl.toString();',
     'console.error(JSON.stringify({ event: "hwlab-runtime-migration-started", fileCount: files.length, valuesPrinted: false }));',
     'const pool = new Pool({ connectionString, max: 1 });',
     'try {',