fix(ci): add PostgreSQL for packages/internal integration tests

- Add test-internal-integration job with PostgreSQL container
- Remove packages/internal from test-integration matrix (it now needs DB)
- Remove CI skip condition from advisory-lock.integration.test.ts

Author: brandonkachen

.github/workflows/ci.yml

@@ -171,7 +171,6 @@ jobs:
             cli,
             common,
             packages/agent-runtime,
-            packages/internal,
             sdk,
             web,
           ]
@@ -318,4 +317,92 @@ jobs:
               echo "No integration tests found in packages/billing"
             fi
 
+  # Internal package integration tests (requires PostgreSQL for advisory lock tests)
+  # DATABASE_URL is set at job level to override any secrets injection
+  test-internal-integration:
+    needs: [build-and-check]
+    name: test-integration-packages/internal
+    runs-on: ubuntu-latest
+    env:
+      DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/testdb
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: testdb
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.3.5'
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            */node_modules
+            packages/*/node_modules
+          key: ${{ runner.os }}-deps-${{ hashFiles('**/bun.lock*') }}
+          restore-keys: |
+            ${{ runner.os }}-deps-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Set environment variables
+        env:
+          SECRETS_CONTEXT: ${{ toJSON(secrets) }}
+        run: |
+          VAR_NAMES=$(bun scripts/generate-ci-env.ts)
+          echo "$SECRETS_CONTEXT" | jq -r --argjson vars "$VAR_NAMES" '
+            to_entries | .[] | select(.key as $k | $vars | index($k)) | .key + "=" + .value
+          ' >> $GITHUB_ENV
+          echo "CODEBUFF_GITHUB_ACTIONS=true" >> $GITHUB_ENV
+          echo "NEXT_PUBLIC_CB_ENVIRONMENT=test" >> $GITHUB_ENV
+          echo "NEXT_PUBLIC_INFISICAL_UP=true" >> $GITHUB_ENV
+          echo "CODEBUFF_GITHUB_TOKEN=${{ secrets.CODEBUFF_GITHUB_TOKEN }}" >> $GITHUB_ENV
+
+      - name: Build SDK before integration tests
+        run: cd sdk && bun run build
+
+      # Override any DATABASE_URL injected from secrets with our test container URL
+      - name: Override DATABASE_URL for test container
+        run: echo "DATABASE_URL=postgresql://postgres:postgres@127.0.0.1:5432/testdb" >> $GITHUB_ENV
+
+      - name: Setup database schema
+        uses: nick-fields/retry@v3
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/testdb
+        with:
+          timeout_minutes: 2
+          max_attempts: 3
+          command: cd packages/internal && bun run db:migrate
+
+      - name: Run internal integration tests
+        uses: nick-fields/retry@v3
+        with:
+          timeout_minutes: 15
+          max_attempts: 3
+          command: |
+            cd packages/internal
+            TEST_FILES=$(find src -name '*.integration.test.ts' 2>/dev/null | sort)
+            if [ -n "$TEST_FILES" ]; then
+              echo "$TEST_FILES" | xargs -I {} bun test --timeout=60000 {}
+            else
+              echo "No integration tests found in packages/internal"
+            fi
+
   # E2E tests for web intentionally omitted for now.

packages/internal/src/db/__tests__/advisory-lock.integration.test.ts

@@ -54,14 +54,11 @@ const DEFAULT_TEST_DATABASE_URL =
   'postgresql://postgres:postgres@127.0.0.1:5432/testdb'
 const TEST_DATABASE_URL = process.env.DATABASE_URL || DEFAULT_TEST_DATABASE_URL
 
-// Skip tests if:
-// 1. Running in GitHub Actions CI (which doesn't have a real Postgres for packages/internal)
-// 2. DATABASE_URL is not configured locally and RUN_INTEGRATION_TESTS is not set
-// Note: CI injects DATABASE_URL as a secret, but there's no actual database running
-// for packages/internal integration tests (only packages/billing has Postgres in CI)
-const SKIP_INTEGRATION_TESTS = 
-  process.env.CODEBUFF_GITHUB_ACTIONS === 'true' ||
-  (!process.env.DATABASE_URL && !process.env.RUN_INTEGRATION_TESTS)
+// Skip tests if DATABASE_URL is not configured and RUN_INTEGRATION_TESTS is not set.
+// In CI, the test-internal-integration job provides a PostgreSQL container and sets DATABASE_URL.
+// Locally, you can either set DATABASE_URL or RUN_INTEGRATION_TESTS=true.
+const SKIP_INTEGRATION_TESTS =
+  !process.env.DATABASE_URL && !process.env.RUN_INTEGRATION_TESTS
 
 // Create test database connection
 let testClient: ReturnType<typeof postgres> | null = null