ci: repair OSS pull request checks

[esafak]

Why?

The OSS pull-request workflows fail before the feature changes can be validated because of stale action runtimes, a Go toolchain mismatch, fork-inaccessible Pro checks, and unavailable CockroachDB image/startup configuration.

This PR will...

• Pin Node 24-compatible GitHub Actions.
• Align the Go matrix with Go 1.26.4.
• Keep fork PRs safe when Pro credentials are unavailable.
• Use a public, test-compatible CockroachDB image and explicit startup.
• Keep generated CI workflows synchronized with their sources.

Testing

• Existing CI generation and workflow consistency checks pass on the source branch.
• The follow-up scoped-correctness PR is intentionally stacked on this branch.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f8c70e23-1568-402c-9201-b679aec72794

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking opportunity to preserve credential-independent SDK test coverage on fork pull requests.

The CI repair paths are consistent with repository toolchain and database configuration, but the no-token SDK fallback unnecessarily suppresses several locally runnable tests.

Files Needing Attention: .github/workflows/ci-sdk.yml

Prompt To Fix All With AI

### Issue 1
.github/workflows/ci-sdk.yml:48
**Credential-free tests are skipped**

For fork pull requests without `ATLAS_TOKEN`, this fallback also skips several tests that use local file or SQLite inputs and do not require Atlas Cloud credentials, unnecessarily reducing OSS test coverage.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "ci: start CockroachDB with public image" | Re-trigger Greptile}

[greptile-apps]

Credential-free tests are skipped

For fork pull requests without ATLAS_TOKEN, this fallback also skips several tests that use local file or SQLite inputs and do not require Atlas Cloud credentials, unnecessarily reducing OSS test coverage.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/ci-sdk.yml
Line: 48

Comment:
**Credential-free tests are skipped**

For fork pull requests without `ATLAS_TOKEN`, this fallback also skips several tests that use local file or SQLite inputs and do not require Atlas Cloud credentials, unnecessarily reducing OSS test coverage.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[esafak]

Thanks for flagging this. I independently reproduced the no-token path with the same Atlas v1.3.3-7c4a0e6-canary binary, a clean HOME, and local SQLite/file inputs. The three lint subtests fail with the Atlas Pro entitlement message, and TestMigrate_Diff fails because migrate diff --dry-run is Pro-gated. These tests therefore cannot run successfully on fork PRs without ATLAS_TOKEN; the existing targeted skip is intentional and should remain.

[greptile-apps]

Thanks for reproducing this with the same canary binary and clean environment. That confirms the three lint subtests and TestMigrate_Diff are genuinely Pro-gated without ATLAS_TOKEN, so the targeted skip is intentional and preserves the appropriate fork-PR behavior. This finding does not apply.

Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.