CI runs the store tests, and the server's dependencies are declared

Two gaps I flagged when the server half landed, both of the same kind: something
that looked covered and was not.

CI NOW EXERCISES THE SQL ON EVERY PUSH
  A postgres:16-alpine service on every matrix leg, with OT_TEST_DSN in the job
  env. fail-fast: false, so one Python version failing does not hide the others.

  The service is the easy part. The real problem was that a SKIPPED test in CI
  reads exactly like a passing one on the summary page -- the same
  looks-clean-but-was-never-checked failure this whole product is built around,
  one level up in the toolchain. So there are two guards:

    * test_server_store.py REFUSES to skip when CI=true and raises with an
      explanation. Verified both ways: it errors under CI=true with no DSN, and
      stays an ordinary skip on a developer machine.
    * a final CI step re-runs that file and greps for "passed" with no
      "skipped", so a service that fails to come up turns the build red rather
      than quietly green having exercised no SQL at all.

  Simulated locally against a real container the way CI will run it:
  243 passed, 0 skipped.

DEPENDENCIES DECLARED, AND KEPT APART
  ot_server/requirements.txt -- fastapi, uvicorn, psycopg[binary] -- separate
  from the collector's, which stays dpkt alone. A collector is an appliance in a
  substation and should carry as little as it can; a server is operator-hosted
  and may carry a web framework and a database driver. Merging them would put a
  web framework on every Pi.

  requirements-dev.txt gains the server deps because the suite covers all three
  components. Without them the server tests do not fail, they ERROR at import,
  which reads as a broken checkout rather than a missing install.

CHECKED RATHER THAN ASSUMED
  The matrix still includes Python 3.8, so before adding these I verified in a
  python:3.8-slim container that fastapi 0.124.4 and psycopg 3.2.13 actually
  install there. Had they not, this commit would have broken the 3.8 leg on the
  next push -- and the breakage would have looked like a dependency problem
  rather than a decision.

The POSTGRES_PASSWORD in the workflow is a throwaway for an ephemeral per-job
container reachable only from the runner, and is commented as such.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Krishcalin

.github/workflows/ci.yml

@@ -10,9 +10,38 @@ jobs:
   test:
     runs-on: ubuntu-latest
     strategy:
+      # Report every leg. A failure on one Python version is information, not a
+      # reason to stop testing the others.
+      fail-fast: false
       matrix:
         python-version: ["3.8", "3.10", "3.12"]
 
+    # PostgreSQL for the server store tests (Q1: PostgreSQL only).
+    #
+    # Without this the store tests SKIP, and a skipped test in CI reads exactly
+    # like a passing one on the summary page — which is the same
+    # looks-clean-but-was-never-checked failure the whole product is built to
+    # avoid. tests/test_server_store.py refuses to skip when CI=true, so a
+    # service that fails to start is a red build rather than a quiet one.
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: otfleet
+          # Ephemeral, per-job container reachable only from this runner.
+          POSTGRES_PASSWORD: ci-throwaway
+          POSTGRES_DB: otfleet
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U otfleet -d otfleet"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    env:
+      OT_TEST_DSN: postgresql://otfleet:ci-throwaway@localhost:5432/otfleet
+
     steps:
       - uses: actions/checkout@v4
 
@@ -31,3 +60,14 @@ jobs:
       - name: Run tests
         working-directory: ot_scanner
         run: python -m pytest tests/ -v --tb=short
+
+      - name: Confirm the store tests actually ran
+        working-directory: ot_scanner
+        # Belt and braces on top of the in-test guard: if the Postgres service
+        # is unreachable these deselect to zero and the run would otherwise be
+        # green having tested no SQL at all.
+        run: |
+          python -m pytest tests/test_server_store.py -q \
+            | tee /tmp/store.txt
+          grep -qE "[0-9]+ passed" /tmp/store.txt
+          ! grep -q "skipped" /tmp/store.txt

ot_scanner/requirements-dev.txt

@@ -1 +1,12 @@
+# Test dependencies for the whole repository — scanner, collector AND server.
+#
+# The suite in ot_scanner/tests/ covers all three, so running it needs the
+# server's dependencies too. Without them the server tests do not fail, they
+# ERROR at import, which reads as a broken checkout rather than a missing
+# install.
 pytest>=7.0
+
+# Server (ot_server/). Kept here rather than referenced with -r so a single
+# `pip install -r requirements-dev.txt` from ot_scanner/ sets up everything.
+fastapi>=0.110
+psycopg[binary]>=3.1

ot_scanner/tests/test_server_store.py

@@ -26,6 +26,19 @@
 sys.path.insert(0, _ROOT)
 
 DSN = os.environ.get("OT_TEST_DSN")
+
+# A SKIPPED test in CI reads exactly like a passing one on the summary page.
+# That is the same looks-clean-but-was-never-checked failure this whole product
+# is built to avoid, so the skip is allowed on a developer machine and REFUSED
+# in CI: if the Postgres service did not come up, the build goes red rather than
+# quietly green having exercised no SQL at all.
+_IN_CI = os.environ.get("CI", "").lower() in ("1", "true", "yes")
+if _IN_CI and not DSN:
+    raise RuntimeError(
+        "OT_TEST_DSN is unset in CI. The PostgreSQL store tests would skip, and "
+        "a skipped test on the summary page is indistinguishable from a passing "
+        "one. Start the postgres service or remove this suite deliberately.")
+
 pytestmark = pytest.mark.skipif(
     not DSN, reason="set OT_TEST_DSN to run the PostgreSQL store tests")
 

ot_server/requirements.txt

@@ -0,0 +1,11 @@
+# OT Sensor Fleet — analysis server runtime (OTS-SRS-001 Phase 3+).
+#
+# Deliberately NOT the collector's dependencies. A collector is an appliance in
+# a substation and carries as little as it can (dpkt alone, see
+# ot_scanner/collector/manifest.py RUNTIME_REQUIRES); the server is an operator-
+# hosted service and may carry a web framework and a database driver.
+#
+# Verified to install on Python 3.8, which the CI matrix still covers.
+fastapi>=0.110
+uvicorn>=0.27
+psycopg[binary]>=3.1        # Q1: PostgreSQL only