fix: migrations on CockroachDB v25+ (#3994)

I've added some output to the generated migrations files to make them
easier to recreate, hence the big diff.

These are important:

```
persistence/sql/migrations/20211004110001000000_change_client_primary_key.cockroach.down.sql
persistence/sql/migrations/20211004110001000000_change_client_primary_key.cockroach.up.sql
persistence/sql/migrations/20211004110003000000_change_client_primary_key.cockroach.down.sql
persistence/sql/migrations/20211004110003000000_change_client_primary_key.cockroach.up.sql

persistence/sql/migrations/20211011000001000000_change_jwk_primary_key.cockroach.down.sql
persistence/sql/migrations/20211011000001000000_change_jwk_primary_key.cockroach.up.sql
persistence/sql/migrations/20211011000003000000_change_jwk_primary_key.cockroach.down.sql
persistence/sql/migrations/20211011000003000000_change_jwk_primary_key.cockroach.up.sql

persistence/sql/src/20220210000001_nid/20220210000001000000_nid.cockroach.up.sql
```

Closes #3964 
Supersedes #3993 (thanks @hperl)

Author: alnr

.github/workflows/ci.yaml

@@ -70,7 +70,7 @@ jobs:
     steps:
       - run: |
           docker create --name cockroach -p 26257:26257 \
-            cockroachdb/cockroach:latest-v24.1 start-single-node --insecure
+            cockroachdb/cockroach:latest-v25.1 start-single-node --insecure
           docker start cockroach
         name: Start CockroachDB
       - uses: ory/ci/checkout@master
@@ -170,7 +170,7 @@ jobs:
     steps:
       - run: |
           docker create --name cockroach -p 26257:26257 \
-            cockroachdb/cockroach:latest-v24.1 start-single-node --insecure
+            cockroachdb/cockroach:latest-v25.1 start-single-node --insecure
           docker start cockroach
         name: Start CockroachDB
       - uses: ory/ci/checkout@master

Makefile

@@ -49,7 +49,7 @@ test-resetdb: node_modules
 	docker rm --force --volumes hydra_test_database_cockroach || true
 	docker run --rm --name hydra_test_database_mysql  -p 3444:3306 -e MYSQL_ROOT_PASSWORD=secret -d mysql:8.0
 	docker run --rm --name hydra_test_database_postgres -p 3445:5432 -e POSTGRES_PASSWORD=secret -e POSTGRES_DB=postgres -d postgres:16
-	docker run --rm --name hydra_test_database_cockroach -p 3446:26257 -d cockroachdb/cockroach:latest-v24.1 start-single-node --insecure
+	docker run --rm --name hydra_test_database_cockroach -p 3446:26257 -d cockroachdb/cockroach:latest-v25.1 start-single-node --insecure
 
 # Build local docker images
 .PHONY: docker

cmd/cli/handler_migrate.go

@@ -48,15 +48,13 @@ const (
 	genericDialectKey = "any"
 )
 
-var fragmentHeader = []byte(strings.TrimLeft(`
--- Migration generated by the command below; DO NOT EDIT.
--- hydra:generate hydra migrate gen
-`, "\n"))
+func fragmentHeader() []byte {
+	return fmt.Appendf(nil, "-- Migration generated by the command below; DO NOT EDIT.\n-- %s\n", strings.Join(os.Args, " "))
+}
 
-var blankFragment = []byte(strings.TrimLeft(`
--- This blank migration was generated to meet ory/x/popx validation criteria, see https://github.com/ory/x/pull/509; DO NOT EDIT.
--- hydra:generate hydra migrate gen
-`, "\n"))
+func blankFragment() []byte {
+	return fmt.Appendf(nil, "-- This is a blank migration. It is generated to ensure that all dialects are represented in the migration files.\n-- %s\n", strings.Join(os.Args, " "))
+}
 
 var mrx = regexp.MustCompile(`^(\d{14})000000_([^.]+)(\.[a-z0-9]+)?\.(up|down)\.sql$`)
 
@@ -91,7 +89,7 @@ func (m migration) generateMigrationFragments(source []byte) ([][]byte, error) {
 		return nil, errors.New("no migration chunks found")
 	}
 	for i := range chunks {
-		chunks[i] = append(fragmentHeader, chunks[i]...)
+		chunks[i] = append(fragmentHeader(), chunks[i]...)
 	}
 	return chunks, nil
 }
@@ -140,7 +138,7 @@ func (mg migrationGroup) generateSQL(sourceFS fs.FS, target string) error {
 	for _, m := range ms {
 		for i := dialectFragmentCounts[m.Dialect]; i < maxFragmentCount; i += 1 {
 			dst := filepath.Join(target, mg.fragmentName(m, i))
-			if err := os.WriteFile(dst, blankFragment, 0600); err != nil {
+			if err := os.WriteFile(dst, blankFragment(), 0600); err != nil {
 				return errors.WithStack(errors.Errorf("failed to write file %s", dst))
 			}
 		}

persistence/sql/migratest/migration_test.go

@@ -76,7 +76,7 @@ func TestMigrations(t *testing.T) {
 		for db, dsn := range map[string]string{
 			"postgres":  dockertest.RunTestPostgreSQL(t),
 			"mysql":     dockertest.RunTestMySQL(t),
-			"cockroach": dockertest.RunTestCockroachDB(t),
+			"cockroach": dockertest.RunTestCockroachDBWithVersion(t, "latest-v25.1"),
 		} {
 			wg.Add(1)
 			go func() {
@@ -90,7 +90,7 @@ func TestMigrations(t *testing.T) {
 					require.NoError(t, err)
 					require.NoError(t, c.Open())
 					require.NoError(t, c.RawQuery("CREATE DATABASE "+dbName).Exec())
-					dsn = regexp.MustCompile("/[a-z0-9]+\\?").ReplaceAllString(dsn, "/"+dbName+"?")
+					dsn = regexp.MustCompile(`/[a-z0-9]+\?`).ReplaceAllString(dsn, "/"+dbName+"?")
 					require.NoError(t, c.Close())
 
 					c, err = pop.NewConnection(&pop.ConnectionDetails{URL: dsn})

persistence/sql/migratest/testdata/20241609000001_testdata.sql

@@ -90,7 +90,7 @@ INSERT INTO hydra_oauth2_flow (login_challenge,
                                device_handled_at,
                                device_error)
 VALUES ('challenge-0018',
-        (SELECT id FROM networks LIMIT 1), '["requested_scope-0018_1","requested_scope-0018_2"]', 'verifier-0018', 'csrf-0018', 'subject-0018', 'http://request/0018', true, 'client-21', '2025-05-16 12:24', '{"display": "display-0018"}', NULL, '["requested_audience-0018_1","requested_audience-0018_2"]', '2025-05-16 12:24', 128, true, 15, '{}', 'acr-0018', '2025-05-16 12:24', true, 'force_subject_id-0018', '{"context": "0018"}', '["amr-0018-1","amr-0018-2"]', 'challenge-0018', 'verifier-0018', true, 'csrf-0018', '["granted_scope-0018_1","granted_scope-0018_2"]', true, 15, '{}', '{"session_access_token-0018": "0018"}', '{"session_id_token-0018": "0018"}', true, '["granted_audience-0018_1","granted_audience-0018_2"]', '2025-05-16 12:24', true, 'device-challenge-0018', 'device-request-id-0018', 'device-verifier-0018', 'device-csrf-0018', true, '2025-05-16 12:24', '{}' );
+        (SELECT id FROM networks LIMIT 1), '["requested_scope-0018_1","requested_scope-0018_2"]', 'verifier-0018', 'csrf-0018', 'subject-0018', 'http://request/0018', true, 'client-21', CURRENT_TIMESTAMP, '{"display": "display-0018"}', NULL, '["requested_audience-0018_1","requested_audience-0018_2"]', CURRENT_TIMESTAMP, 128, true, 15, '{}', 'acr-0018', CURRENT_TIMESTAMP, true, 'force_subject_id-0018', '{"context": "0018"}', '["amr-0018-1","amr-0018-2"]', 'challenge-0018', 'verifier-0018', true, 'csrf-0018', '["granted_scope-0018_1","granted_scope-0018_2"]', true, 15, '{}', '{"session_access_token-0018": "0018"}', '{"session_id_token-0018": "0018"}', true, '["granted_audience-0018_1","granted_audience-0018_2"]', '2025-05-16 12:24', true, 'device-challenge-0018', 'device-request-id-0018', 'device-verifier-0018', 'device-csrf-0018', true, '2025-05-16 12:24', '{}' );
 
 INSERT INTO hydra_oauth2_device_auth_codes (device_code_signature, user_code_signature, request_id, requested_at,
                                             client_id, scope, granted_scope, form_data, session_data, subject,

persistence/sql/migrations/20211004110001000000_change_client_primary_key.cockroach.down.sql

@@ -1 +1,3 @@
-ALTER TABLE hydra_client DROP CONSTRAINT "hydra_client_pkey", ADD CONSTRAINT "primary" PRIMARY KEY (pk_deprecated);
+ALTER TABLE hydra_client "hydra_client_pkey"
+    DROP COLUMN pk,
+    RENAME COLUMN pk_deprecated TO pk;

persistence/sql/migrations/20211004110001000000_change_client_primary_key.cockroach.up.sql

@@ -1,2 +1,3 @@
-ALTER TABLE hydra_client RENAME pk TO pk_deprecated;
-ALTER TABLE hydra_client ADD pk UUID NOT NULL DEFAULT gen_random_uuid();
+ALTER TABLE hydra_client 
+    RENAME pk TO pk_deprecated,
+    ADD COLUMN pk UUID NOT NULL DEFAULT gen_random_uuid();

persistence/sql/migrations/20211004110003000000_change_client_primary_key.cockroach.down.sql

@@ -1,2 +1,3 @@
-ALTER TABLE hydra_client DROP pk;
-ALTER TABLE hydra_client RENAME pk_deprecated TO pk;
+ALTER TABLE hydra_client
+    DROP CONSTRAINT "primary",
+    ADD CONSTRAINT "hydra_client_pkey" PRIMARY KEY (pk_deprecated);

persistence/sql/migrations/20211004110003000000_change_client_primary_key.cockroach.up.sql

@@ -1,2 +1,3 @@
-ALTER TABLE hydra_client DROP CONSTRAINT "primary";
-ALTER TABLE hydra_client ADD CONSTRAINT "hydra_client_pkey" PRIMARY KEY (pk);
+ALTER TABLE hydra_client
+    DROP CONSTRAINT "primary",
+    ADD CONSTRAINT "hydra_client_pkey" PRIMARY KEY (pk);

persistence/sql/migrations/20211011000001000000_change_jwk_primary_key.cockroach.down.sql

@@ -1 +1,3 @@
-ALTER TABLE hydra_jwk DROP CONSTRAINT "hydra_jwk", ADD CONSTRAINT "primary" PRIMARY KEY (pk_deprecated);
+ALTER TABLE hydra_jwk
+    DROP COLUMN pk,
+    RENAME pk_deprecated TO pk;