[w1am]

GitHub runners now ship Docker Engine 29, which rejects API versions below 1.40. Testcontainers 1.20.6 sends 1.32, so every test job fails with client version 1.32 is too old. 1.21.4 defaults to API 1.44

Summary by CodeRabbit

• Chores
  • Updated the test environment’s container tooling and licensing configuration for cluster-based checks. These changes affect test setup only; no end-user features or behavior have changed.

[coderabbitai]

Caution

Review failed

The pull request is closed.

No actionable comments were generated in the recent review.

Walkthrough

The Testcontainers version changes from 1.20.6 to 1.21.4. The test workflow passes a license key to the Docker Compose cluster setup, and vars.env maps that key to the EventStore licensing variable.

Changes: Test Infrastructure Updates

Layer / File(s)	Summary
Update Testcontainers version gradle.properties	The testcontainersVersion value changes from 1.20.6 to 1.21.4.
Configure cluster license key .github/workflows/tests.yml, vars.env	The cluster setup step receives KURRENTDB_LICENSE_KEY from the KURRENTDB_TEST_LICENSE_KEY secret. vars.env sets EVENTSTORE_LICENSING__LICENSE_KEY from that variable, or uses an empty string if it is unset.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: Minimal · up to 9b954

CI uses the updated Testcontainers version and passes the cluster license when available. No introduced merge-blocking issue was established.

Security architecture risk: Low · up to 9b954

The credential is delivered to the existing test cluster without adding services or an identified access-control bypass. No introduced vulnerability was established, but the license's effective privileges and the selected container images' licensing behavior remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — Each cluster job delivers the credential to three database containers on its runner. The credential remains accessible through container configuration to processes with Docker-daemon authority on that runner; its entitlements beyond licensing these test containers are not established.

Security Findings and Attack Paths

• inferred — The examined fork-PR secret-exposure path does not establish an introduced vulnerability: the public repository's callers use pull_request, for which GitHub withholds secrets from forks. This counterevidence does not establish the license's privileges or prove arbitrary same-repository code harmless.

Trust Boundaries and Controls

• observed — The secret crosses from the CI secret store into a step environment and then into database-container environments. The workflow checks out the event revision and authenticates to the registry before Compose startup, so trusted runs execute repository-controlled Compose configuration in an already credential-bearing job.

Resilience and Maintainability Implications

• inferred — Compose shutdown has no always condition, so startup failure, test failure or cancellation can bypass explicit cleanup and leave credential-bearing containers until hosted-runner disposal. The hosted job boundary limits this residual lifetime; the evidence does not establish persistent cross-job exposure.

Pre-merge checks: 3

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 6d964b25-9f83-4742-a8ae-c3fb1c3f8c16

Commits

Reviewing files that changed from the base of the PR and between bb9bde6 and 1c0a58d.

Files selected for processing: 1

• gradle.properties

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.