Demo: a check that writes must fail CI (do not merge)

checks/writes-data/check.md

@@ -0,0 +1,22 @@
+---
+id: writes-data
+title: A check that writes
+category: capacity
+severity: warning
+min_version: 14
+privileges: []
+message: Wrote row {subject}.
+fix: nothing
+---
+
+## What breaks
+
+Nothing. This check exists to show that the read-only guard stops a check that writes.
+
+## Fix
+
+Delete this check.
+
+## Seen in
+
+- [SET TRANSACTION](https://www.postgresql.org/docs/current/sql-set-transaction.html), PostgreSQL documentation

checks/writes-data/check.sql

@@ -0,0 +1,4 @@
+WITH written AS (
+    INSERT INTO public.fixture_written VALUES (1) RETURNING n
+)
+SELECT n::text AS subject FROM written

checks/writes-data/fixtures/fires.sql

@@ -0,0 +1,3 @@
+-- The role may insert, so only the READ ONLY transaction stands in the way.
+CREATE TABLE public.fixture_written (n int);
+GRANT INSERT ON public.fixture_written TO checkup;

checks/writes-data/fixtures/healthy.sql

@@ -0,0 +1,3 @@
+-- The role may insert, so only the READ ONLY transaction stands in the way.
+CREATE TABLE public.fixture_written (n int);
+GRANT INSERT ON public.fixture_written TO checkup;