proxysql_integration_tests.yml

name: ProxySQL Integration Tests

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  schedule:
    - cron: '0 3 * * *'
  workflow_dispatch:

jobs:
  proxysql-test:
    name: ProxySQL + MySQL ${{ matrix.mysql-version }}
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        mysql-version:
          - '8.4.4'
          - '9.1.0'
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      MYSQL_VERSION: ${{ matrix.mysql-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5 mysql-client socat

      - name: Install ProxySQL
        run: |
          # Download deb and extract binary without installing the package
          PROXYSQL_VERSION="3.0.6"
          wget -nv -O /tmp/proxysql.deb \
            "https://github.com/sysown/proxysql/releases/download/v${PROXYSQL_VERSION}/proxysql_${PROXYSQL_VERSION}-ubuntu22_amd64.deb"
          mkdir -p /tmp/proxysql-extract
          dpkg-deb -x /tmp/proxysql.deb /tmp/proxysql-extract
          sudo cp /tmp/proxysql-extract/usr/bin/proxysql /usr/local/bin/proxysql
          sudo chmod +x /usr/local/bin/proxysql
          which proxysql

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Cache MySQL tarball
        uses: actions/cache@v4
        with:
          path: /tmp/mysql-tarball
          key: mysql-${{ matrix.mysql-version }}-linux-x86_64-v1

      - name: Download and unpack MySQL
        run: |
          SHORT_VER=$(echo "$MYSQL_VERSION" | grep -oP '^\d+\.\d+')
          TARBALL="mysql-${MYSQL_VERSION}-linux-glibc2.17-x86_64.tar.xz"
          mkdir -p /tmp/mysql-tarball
          if [ ! -f "/tmp/mysql-tarball/$TARBALL" ]; then
            curl -L -f -o "/tmp/mysql-tarball/$TARBALL" \
              "https://dev.mysql.com/get/Downloads/MySQL-${SHORT_VER}/$TARBALL" \
              || curl -L -f -o "/tmp/mysql-tarball/$TARBALL" \
              "https://downloads.mysql.com/archives/get/p/23/file/$TARBALL"
          fi
          mkdir -p "$SANDBOX_BINARY"
          ./dbdeployer unpack "/tmp/mysql-tarball/$TARBALL" --sandbox-binary="$SANDBOX_BINARY"

      - name: Run ProxySQL integration tests
        run: |
          export PATH="$PWD:$PATH"
          export MYSQL_VERSION_1="$MYSQL_VERSION"
          export MYSQL_VERSION_2=""
          ./test/proxysql-integration-tests.sh "$SANDBOX_BINARY"

      - name: Cleanup before R/W split test
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" proxysql 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true
          sleep 3

      - name: Test R/W split verification (#66)
        run: |
          echo "=== Deploy replication + ProxySQL for R/W split test ==="
          ./dbdeployer deploy replication "$MYSQL_VERSION" \
            --sandbox-binary="$SANDBOX_BINARY" \
            --with-proxysql

          SANDBOX_DIR=~/sandboxes/rsandbox_$(echo "$MYSQL_VERSION" | tr '.' '_')

          echo "=== Add query rules for R/W split ==="
          # Route SELECTs to reader hostgroup (HG 1), writes stay on HG 0
          ${SANDBOX_DIR}/proxysql/use -e "INSERT INTO mysql_query_rules (rule_id, active, match_pattern, destination_hostgroup, apply) VALUES (1, 1, '^SELECT', 1, 1);" 2>&1 | { grep -v -E "Warning|Deprecated" || true; }
          ${SANDBOX_DIR}/proxysql/use -e "LOAD MYSQL QUERY RULES TO RUNTIME;" 2>&1 | { grep -v -E "Warning|Deprecated" || true; }
          ${SANDBOX_DIR}/proxysql/use -e "LOAD MYSQL SERVERS TO RUNTIME;" 2>&1 | { grep -v -E "Warning|Deprecated" || true; }
          ${SANDBOX_DIR}/proxysql/use -e "SAVE MYSQL QUERY RULES TO DISK;" 2>&1 | { grep -v -E "Warning|Deprecated" || true; }

          # Allow ProxySQL to apply rules and establish connections before testing
          sleep 3

          echo "=== Baseline: record current query digest counts per hostgroup ==="
          HG0_BEFORE=$(${SANDBOX_DIR}/proxysql/use -BN -e "SELECT COALESCE(SUM(count_star),0) FROM stats_mysql_query_digest WHERE hostgroup=0;" 2>&1 | { grep -v -E "Warning|Deprecated" || true; })
          HG1_BEFORE=$(${SANDBOX_DIR}/proxysql/use -BN -e "SELECT COALESCE(SUM(count_star),0) FROM stats_mysql_query_digest WHERE hostgroup=1;" 2>&1 | { grep -v -E "Warning|Deprecated" || true; })
          echo "HG0 queries before: $HG0_BEFORE"
          echo "HG1 queries before: $HG1_BEFORE"

          echo "=== Run a write (INSERT) through ProxySQL ==="
          ${SANDBOX_DIR}/proxysql/use_proxy -e "CREATE DATABASE IF NOT EXISTS rw_split_test;" 2>&1 | { grep -v -E "Warning|Deprecated" || true; }
          ${SANDBOX_DIR}/proxysql/use_proxy -e "CREATE TABLE IF NOT EXISTS rw_split_test.t1 (id INT AUTO_INCREMENT PRIMARY KEY, val VARCHAR(100));" 2>&1 | { grep -v -E "Warning|Deprecated" || true; }
          ${SANDBOX_DIR}/proxysql/use_proxy -e "INSERT INTO rw_split_test.t1 (val) VALUES ('rw_split_write_1');" 2>&1 | { grep -v -E "Warning|Deprecated" || true; }

          echo "=== Run reads (SELECTs) through ProxySQL ==="
          for i in $(seq 1 5); do
            ${SANDBOX_DIR}/proxysql/use_proxy -BN -e "SELECT val FROM rw_split_test.t1;" > /dev/null 2>&1 || true
          done

          # Give ProxySQL time to flush stats to query digest
          sleep 2

          echo "=== Check query counts increased ==="
          # Wait for HG0 (writer) query count to increase with retries
          for i in $(seq 1 10); do
            HG0_AFTER=$(${SANDBOX_DIR}/proxysql/use -BN -e "SELECT COALESCE(SUM(count_star),0) FROM stats_mysql_query_digest WHERE hostgroup=0;" 2>&1 | { grep -v -E "Warning|Deprecated" || true; })
            [ "$HG0_AFTER" -gt "$HG0_BEFORE" ] && break
            sleep 2
          done
          # Wait for HG1 (reader) query count to increase with retries
          for i in $(seq 1 10); do
            HG1_AFTER=$(${SANDBOX_DIR}/proxysql/use -BN -e "SELECT COALESCE(SUM(count_star),0) FROM stats_mysql_query_digest WHERE hostgroup=1;" 2>&1 | { grep -v -E "Warning|Deprecated" || true; })
            [ "$HG1_AFTER" -gt "$HG1_BEFORE" ] && break
            sleep 2
          done
          echo "HG0 queries after: $HG0_AFTER (was $HG0_BEFORE)"
          echo "HG1 queries after: $HG1_AFTER (was $HG1_BEFORE)"

          # Writes should have routed to HG0
          [ "$HG0_AFTER" -gt "$HG0_BEFORE" ] || { echo "FAIL: expected HG0 (writer) query count to increase"; exit 1; }
          echo "OK: HG0 (writer) received queries"

          # Reads should have routed to HG1 via query rules
          [ "$HG1_AFTER" -gt "$HG1_BEFORE" ] || { echo "FAIL: expected HG1 (reader) query count to increase"; exit 1; }
          echo "OK: HG1 (reader) received queries — R/W split is working"

          echo "=== Verify written data is readable through proxy ==="
          RESULT=$(${SANDBOX_DIR}/proxysql/use_proxy -BN -e "SELECT val FROM rw_split_test.t1 WHERE val='rw_split_write_1';" 2>&1 | grep -v -E "Warning|Deprecated") || true
          echo "Result: $RESULT"
          echo "$RESULT" | grep -q "rw_split_write_1" || { echo "FAIL: written data not readable through proxy"; exit 1; }
          echo "OK: R/W split write+read data flow verified"

          echo "=== Cleanup ==="
          ./dbdeployer delete all --skip-confirm

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" proxysql 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true

  proxysql-pxc:
    name: ProxySQL + PXC (${{ matrix.pxc-version }})
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - pxc-version: '8.0.27-18.1'
            pxc-tarball-glibc: '2.17'
            pxc-download-series: 'Percona-XtraDB-Cluster-LATEST'
            pxc-download-version: 'Percona-XtraDB-Cluster-8.0.27'
          - pxc-version: '8.4.8-8.1'
            pxc-tarball-glibc: '2.35'
            pxc-download-series: 'Percona-XtraDB-Cluster-84'
            pxc-download-version: 'Percona-XtraDB-Cluster-8.4.8'
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      PXC_VERSION: ${{ matrix.pxc-version }}
      PXC_TARBALL_GLIBC: ${{ matrix.pxc-tarball-glibc }}
      PXC_DOWNLOAD_SERIES: ${{ matrix.pxc-download-series }}
      PXC_DOWNLOAD_VERSION: ${{ matrix.pxc-download-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5 libldap-2.5-0 socat

      - name: Provide LDAP compatibility shim
        run: |
          sudo ldconfig
          LDAP_LIB=$(ldconfig -p | awk '
            /libldap[^ ]*\.so\./ && $NF !~ /libldap_r-2\.4\.so\.2$/ {
              print $NF
              exit
            }')
          if [ -z "$LDAP_LIB" ] || [ ! -e "$LDAP_LIB" ]; then
            LDAP_LIB=$(find /usr/lib /lib -type f -name 'libldap*.so*' ! -name 'libldap_r-2.4.so.2' | sort | head -1)
          fi
          if [ -z "$LDAP_LIB" ] || [ ! -e "$LDAP_LIB" ]; then
            echo "Unable to locate a libldap shared object" >&2
            ldconfig -p | grep ldap >&2 || true
            find /usr/lib /lib -name 'libldap*.so*' | sort >&2 || true
            exit 1
          fi
          sudo ln -sf "$LDAP_LIB" /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2
          sudo ln -sf "$LDAP_LIB" /lib/x86_64-linux-gnu/libldap_r-2.4.so.2
          sudo ldconfig

      - name: Install ProxySQL
        run: |
          PROXYSQL_VERSION="3.0.6"
          wget -nv -O /tmp/proxysql.deb \
            "https://github.com/sysown/proxysql/releases/download/v${PROXYSQL_VERSION}/proxysql_${PROXYSQL_VERSION}-ubuntu22_amd64.deb"
          mkdir -p /tmp/proxysql-extract
          dpkg-deb -x /tmp/proxysql.deb /tmp/proxysql-extract
          sudo cp /tmp/proxysql-extract/usr/bin/proxysql /usr/local/bin/proxysql
          sudo chmod +x /usr/local/bin/proxysql
          which proxysql

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Download and unpack PXC
        run: |
          TARBALL="Percona-XtraDB-Cluster_${PXC_VERSION}_Linux.x86_64.glibc${PXC_TARBALL_GLIBC}-minimal.tar.gz"
          URL="https://downloads.percona.com/downloads/${PXC_DOWNLOAD_SERIES}/${PXC_DOWNLOAD_VERSION}/binary/tarball/$TARBALL"
          mkdir -p "$SANDBOX_BINARY"
          curl -L -f --retry 5 --retry-all-errors --retry-delay 2 -o "/tmp/$TARBALL" "$URL"
          ./dbdeployer unpack "/tmp/$TARBALL" --sandbox-binary="$SANDBOX_BINARY"

      - name: Test PXC with ProxySQL
        run: |
          VERSION=$(ls "$SANDBOX_BINARY" | head -1)
          test -x "$SANDBOX_BINARY/$VERSION/bin/mysql"
          export PATH="$SANDBOX_BINARY/$VERSION/bin:$PATH"
          ./dbdeployer deploy replication "$VERSION" --topology=pxc --with-proxysql --sandbox-binary="$SANDBOX_BINARY"
          SBDIR=$(ls -d ~/sandboxes/pxc_msb_*)
          echo "Waiting for PXC nodes to be ready (ProxySQL + PXC)..."
          for i in $(seq 1 30); do
            "$SBDIR/check_nodes" && break
            sleep 2
          done
          "$SBDIR/check_nodes"
          for i in $(seq 1 30); do
            "$SBDIR/n1" -BN -e "SHOW STATUS LIKE 'wsrep_ready';" 2>/dev/null | grep -qi 'ON' && break
            echo "  Waiting for wsrep_ready on n1... ($i/30)"
            sleep 2
          done
          BACKENDS=$($SBDIR/proxysql/use -BN -e "SELECT COUNT(*) FROM mysql_servers" 2>&1 | grep -v -E "Warning|Deprecated")
          [ "$BACKENDS" = "3" ] || { echo "FAIL: expected 3 PXC backends, got $BACKENDS"; exit 1; }
          RESULT=""
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/proxysql/use_proxy -BN -e "CREATE DATABASE IF NOT EXISTS proxysql_pxc_test; USE proxysql_pxc_test; CREATE TABLE IF NOT EXISTS t1 (id INT PRIMARY KEY, val VARCHAR(50)); INSERT INTO t1 VALUES (1, 'pxc_proxy_test'); SELECT val FROM t1 WHERE id=1;" 2>&1 | grep -v -E "Warning|Deprecated") || true
            echo "$RESULT" | grep -q "pxc_proxy_test" && break
            sleep 2
          done
          echo "$RESULT" | grep -q "pxc_proxy_test" || { echo "FAIL: ProxySQL did not return the inserted PXC row"; exit 1; }

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" proxysql 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true

  proxysql-galera:
    name: ProxySQL + MariaDB Galera (${{ matrix.mariadb-galera-version }})
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - mariadb-galera-version: '10.11.16'
            legacy-openssl: true
          - mariadb-galera-version: '11.8.6'
            legacy-openssl: true
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      MARIADB_GALERA_VERSION: ${{ matrix.mariadb-galera-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5 libldap-2.5-0 socat

      - name: Install legacy OpenSSL 1.0
        if: ${{ matrix.legacy-openssl }}
        run: |
          echo "deb [trusted=yes] http://archive.ubuntu.com/ubuntu bionic-security main" | sudo tee /etc/apt/sources.list.d/bionic-security.list
          sudo apt-get update
          sudo apt-get install -y libssl1.0.0

      - name: Provide LDAP compatibility shim
        run: |
          sudo ldconfig
          LDAP_LIB=$(ldconfig -p | awk '
            /libldap[^ ]*\.so\./ && $NF !~ /libldap_r-2\.4\.so\.2$/ {
              print $NF
              exit
            }')
          if [ -z "$LDAP_LIB" ] || [ ! -e "$LDAP_LIB" ]; then
            LDAP_LIB=$(find /usr/lib /lib -type f -name 'libldap*.so*' ! -name 'libldap_r-2.4.so.2' | sort | head -1)
          fi
          if [ -z "$LDAP_LIB" ] || [ ! -e "$LDAP_LIB" ]; then
            echo "Unable to locate a libldap shared object" >&2
            ldconfig -p | grep ldap >&2 || true
            find /usr/lib /lib -name 'libldap*.so*' | sort >&2 || true
            exit 1
          fi
          sudo ln -sf "$LDAP_LIB" /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2
          sudo ln -sf "$LDAP_LIB" /lib/x86_64-linux-gnu/libldap_r-2.4.so.2
          sudo ldconfig

      - name: Install ProxySQL
        run: |
          PROXYSQL_VERSION="3.0.6"
          wget -nv -O /tmp/proxysql.deb \
            "https://github.com/sysown/proxysql/releases/download/v${PROXYSQL_VERSION}/proxysql_${PROXYSQL_VERSION}-ubuntu22_amd64.deb"
          mkdir -p /tmp/proxysql-extract
          dpkg-deb -x /tmp/proxysql.deb /tmp/proxysql-extract
          sudo cp /tmp/proxysql-extract/usr/bin/proxysql /usr/local/bin/proxysql
          sudo chmod +x /usr/local/bin/proxysql
          which proxysql

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Download and unpack MariaDB Galera tarball
        run: |
          TARBALL="mariadb-${MARIADB_GALERA_VERSION}-linux-systemd-x86_64.tar.gz"
          URL="https://archive.mariadb.org/mariadb-${MARIADB_GALERA_VERSION}/bintar-linux-systemd-x86_64/$TARBALL"
          mkdir -p "$SANDBOX_BINARY"
          curl -L -f --retry 5 --retry-all-errors --retry-delay 2 -o "/tmp/$TARBALL" "$URL"
          ./dbdeployer unpack "/tmp/$TARBALL" --sandbox-binary="$SANDBOX_BINARY"

      - name: Test MariaDB Galera with ProxySQL
        run: |
          VERSION=$(ls "$SANDBOX_BINARY" | head -1)
          test -x "$SANDBOX_BINARY/$VERSION/bin/mysql"
          export PATH="$SANDBOX_BINARY/$VERSION/bin:$PATH"
          ./dbdeployer deploy replication "$VERSION" --topology=galera --with-proxysql --sandbox-binary="$SANDBOX_BINARY"
          SBDIR=$(ls -d ~/sandboxes/galera_msb_*)
          echo "Waiting for Galera nodes to be ready (ProxySQL + Galera)..."
          for i in $(seq 1 30); do
            "$SBDIR/check_nodes" && break
            sleep 2
          done
          "$SBDIR/check_nodes"
          for i in $(seq 1 30); do
            "$SBDIR/n1" -BN -e "SHOW STATUS LIKE 'wsrep_ready';" 2>/dev/null | grep -qi 'ON' && break
            echo "  Waiting for wsrep_ready on n1... ($i/30)"
            sleep 2
          done
          BACKENDS=$($SBDIR/proxysql/use -BN -e "SELECT COUNT(*) FROM mysql_servers" 2>&1 | grep -v -E "Warning|Deprecated")
          [ "$BACKENDS" = "3" ] || { echo "FAIL: expected 3 Galera backends, got $BACKENDS"; exit 1; }
          RESULT=""
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/proxysql/use_proxy -BN -e "CREATE DATABASE IF NOT EXISTS proxysql_galera_test; USE proxysql_galera_test; CREATE TABLE IF NOT EXISTS t1 (id INT PRIMARY KEY, val VARCHAR(50)); INSERT INTO t1 VALUES (1, 'galera_proxy_test'); SELECT val FROM t1 WHERE id=1;" 2>&1 | grep -v -E "Warning|Deprecated") || true
            echo "$RESULT" | grep -q "galera_proxy_test" && break
            sleep 2
          done
          echo "$RESULT" | grep -q "galera_proxy_test" || { echo "FAIL: ProxySQL did not return the inserted Galera row"; exit 1; }

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" proxysql 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true

  # Test ProxySQL + PostgreSQL wiring
  proxysql-postgresql:
    name: ProxySQL + PostgreSQL
    runs-on: ubuntu-22.04
    env:
      GO111MODULE: on
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Add PostgreSQL apt repo
        run: |
          sudo apt-get update
          sudo apt-get install -y curl ca-certificates
          sudo install -d /usr/share/postgresql-common/pgdg
          sudo curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc
          echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | sudo tee /etc/apt/sources.list.d/pgdg.list
          sudo apt-get update

      - name: Install ProxySQL
        run: |
          PROXYSQL_VERSION="3.0.6"
          wget -nv -O /tmp/proxysql.deb \
            "https://github.com/sysown/proxysql/releases/download/v${PROXYSQL_VERSION}/proxysql_${PROXYSQL_VERSION}-ubuntu22_amd64.deb"
          mkdir -p /tmp/proxysql-extract
          dpkg-deb -x /tmp/proxysql.deb /tmp/proxysql-extract
          sudo cp /tmp/proxysql-extract/usr/bin/proxysql /usr/local/bin/proxysql
          sudo chmod +x /usr/local/bin/proxysql
          which proxysql

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Download and unpack PostgreSQL debs (no system install)
        run: |
          # Install libpq5 only — psql links against it dynamically at runtime.
          # We do NOT install postgresql-16 itself, since that would create
          # /usr/share/postgresql/16/ on the runner and mask issue #112.
          sudo apt-get install -y libpq5

          # Documented user flow: download the debs, then unpack via dbdeployer.
          apt-get download postgresql-16 postgresql-client-16 libpq5
          ./dbdeployer unpack --provider=postgresql \
            postgresql-16_*.deb postgresql-client-16_*.deb libpq5_*.deb
          ls ~/opt/postgresql/

          # Sanity: confirm no system PG install snuck in via dependencies.
          if [ -d "/usr/share/postgresql/16" ]; then
            echo "FAIL: /usr/share/postgresql/16/ exists — system PG install is masking issue #112"
            exit 1
          fi

      - name: Test replication with --with-proxysql
        run: |
          PG_FULL=$(ls ~/opt/postgresql/ | head -1)
          echo "=== Deploying PostgreSQL $PG_FULL replication + ProxySQL ==="
          ./dbdeployer deploy replication "$PG_FULL" --provider=postgresql --with-proxysql
          SBDIR=$(ls -d ~/sandboxes/postgresql_repl_*)

          echo "=== Check ProxySQL is running ==="
          $SBDIR/proxysql/status

          echo "=== Check ProxySQL has pgsql_servers configured ==="
          $SBDIR/proxysql/use -e "SELECT * FROM pgsql_servers;" || true

          echo "=== Functional test: verify PostgreSQL replication works ==="
          $SBDIR/primary/use -c "CREATE TABLE proxy_test(id serial, val text); INSERT INTO proxy_test(val) VALUES ('pg_proxysql_test');"
          # Wait for replication with retries
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/replica1/use -c "SELECT val FROM proxy_test;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "pg_proxysql_test" && break
            echo "  Waiting for replication... ($i/10)"
            sleep 2
          done
          echo "$RESULT"
          echo "$RESULT" | grep -q "pg_proxysql_test" || { echo "FAIL: PG replication not working after 20s"; exit 1; }
          echo "OK: PostgreSQL replication verified with ProxySQL deployed"

          echo "=== ProxySQL proxy connection test (pgsql auth WIP) ==="
          $SBDIR/proxysql/use_proxy -c "SELECT 1;" || echo "WARN: ProxySQL pgsql proxy connection failed (expected - auth config WIP)"

      - name: Cleanup
        if: always()
        run: |
          for dir in ~/sandboxes/postgresql_*; do
            [ -d "$dir/proxysql" ] && bash "$dir/proxysql/stop" 2>/dev/null || true
            [ -d "$dir" ] && bash "$dir/stop" 2>/dev/null || true
            rm -rf "$dir"
          done 2>/dev/null || true
          pkill -9 -u "$USER" proxysql 2>/dev/null || true
          pkill -9 -u "$USER" postgres 2>/dev/null || true