feat(mentorship-sync): implement mentorship-sync CronJob with fixture source for DEV

[mlehotskylf]

Summary

Implements the mentorship-sync K8s CronJob that pulls Mentorship program data from ANALYTICS.GOLD_FACT.MENTORSHIP_PROGRAMS in Snowflake and upserts initiative_type = mentorship rows into CF Postgres.

What's included:

• snowflake.Client — connects via RSA key-pair JWT auth, selects PROGRAM_ID, PROGRAM_NAME, PROGRAM_STATUS, OWNER_LF_USERNAME from the gold model
• snowflake.FixtureSource — reads a JSON file for DEV/local testing (no Snowflake credentials needed)
• mentorshipSource interface — both implementations satisfy it; selected by MENTORSHIP_SYNC_FIXTURE_FILE env var
• MentorshipRepository — upserts initiative rows, resolves owner_id by upserting a stub user row keyed on OWNER_LF_USERNAME (satisfies NOT NULL FK), atomic beneficiary replacement (delete-then-insert in a transaction)
• Migration 002 — adds UNIQUE (jobspring_project_id) constraint required for ON CONFLICT upsert
• Dockerfile.mentorship-sync with testdata embedded for DEV fixture use
• Helm CronJob template + values (mentorshipSyncCronJob) in the backend chart
• CI: ci-backend.yml and ci-release.yml updated to build and push ghcr.io/linuxfoundation/lfx-crowdfunding-mentorship-sync

Companion PRs:

• lfx-v2-argocd#959 — enables the CronJob in dev/staging/prod
• lfx-secrets-management#273 — syncs SNOWFLAKE_PRIVATE_KEY to AWS Secrets Manager

Additional changes (post-review)

Default status=published on initiative list endpoints (behaviour change — intentional)

GET /v1/initiatives and GET /v1/me/initiatives now default to status=published when the ?status query param is omitted. Previously an absent param meant no status filter, so all statuses were returned. Callers can still request other statuses explicitly (e.g. ?status=submitted). This aligns the API with the expected public-facing behaviour where unapproved initiatives should not be visible by default.

Helm chart: mentorshipSyncCronJob.image.tag is now required when enabled

Previously, omitting mentorshipSyncCronJob.image.tag silently fell back to the main API image.tag, which would pull from the wrong image repository. A validate.yaml guard now aborts helm install/upgrade with a clear error when the CronJob is enabled but its dedicated image tag is unset.

Syncer: OwnerLFUsername is trimmed before validation and upsert

strings.TrimSpace was previously only used in the guard condition; the untrimmed value was passed to UpsertProgram. The trimmed value is now assigned back to p.OwnerLFUsername so whitespace-padded usernames from Snowflake are cleaned before being persisted.

Context

OWNER_LF_USERNAME is sourced from data:lfid in the Jobspring bronze model (added in lf-dbt#2504). On each sync, a stub users row is created via INSERT ... ON CONFLICT (username) DO NOTHING to satisfy the initiatives.owner_id NOT NULL FK without touching existing user profiles.

Status values from Snowflake are Title-case (Published, Hidden, Pending, Rejected). The syncer lowercases all values and additionally maps the legacy Jobspring hide → hidden.

Beneficiaries (SELECTED_MENTEES) are not yet fetched — the query will be extended in a follow-up once the gold model exposes them as structured columns. UpsertBeneficiaries is skipped when Beneficiaries is nil (Snowflake path) to avoid deleting existing rows.

Test Plan

• cd backend && make test — all packages pass
• go build ./cmd/mentorship-sync/... — binary compiles
• Run locally with MENTORSHIP_SYNC_FIXTURE_FILE — syncer completes with total=3 upserted=3 errors=0
• Run locally against real Snowflake (ANALYTICS.GOLD_FACT.MENTORSHIP_PROGRAMS) — total=1485 upserted=1485 errors=0 in ~18s
• Migration 002 applies cleanly — UNIQUE constraint created
• status = hidden normalised from Snowflake Hidden and legacy hide
• GET /v1/initiatives without ?status returns only published initiatives
• helm template with mentorshipSyncCronJob.enabled=true and no image.tag aborts with a clear error

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Implements the backend pieces needed to run a new mentorship-sync CronJob that sources Mentorship program data from Snowflake (or a JSON fixture in DEV) and upserts mentorship initiatives plus beneficiary rows into the Crowdfunding Postgres database.

Changes:

• Added a Snowflake client and a DEV-only JSON fixture source behind a shared FetchPrograms shape.
• Added mentorship domain models and a MentorshipRepository contract + Postgres implementation.
• Added the mentorship-sync command (syncer, entrypoint), fixture data, and a dedicated Dockerfile.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
docs/superpowers/plans/2026-06-12-mentorship-sync.md	Implementation plan and task checklist for the mentorship-sync workstream.
backend/internal/infrastructure/snowflake/fixture_source.go	JSON fixture-backed Snowflake source for DEV/local runs.
backend/internal/infrastructure/snowflake/fixture_source_test.go	Unit tests for fixture source parsing and missing-file behavior.
backend/internal/infrastructure/snowflake/client.go	Snowflake client for fetching mentorship programs via SQL.
backend/internal/infrastructure/snowflake/client_test.go	Mock-driver unit test asserting query/table reference and scan mapping.
backend/internal/infrastructure/db/mentorship_repository.go	Postgres repository for program upsert + beneficiary replacement.
backend/internal/infrastructure/db/mentorship_repository_test.go	Compile-time interface conformance test for mentorship repository.
backend/internal/domain/repository.go	Adds MentorshipRepository interface to domain contracts.
backend/internal/domain/models/mentorship_sync.go	Adds mentorship sync domain models (MentorshipProgram, MentorshipBeneficiary).
backend/go.mod	Adds Snowflake driver dependency graph to module metadata.
backend/go.sum	Adds checksums for new dependencies (Snowflake driver and transitive deps).
backend/Dockerfile.mentorship-sync	Builds a standalone mentorship-sync container image and embeds fixture data.
backend/cmd/mentorship-sync/testdata/programs.json	DEV fixture dataset (active/pending/hidden) including beneficiaries.
backend/cmd/mentorship-sync/syncer.go	Sync orchestration logic (fetch → upsert program → upsert beneficiaries).
backend/cmd/mentorship-sync/syncer_test.go	Unit tests for syncer behavior (counts, status normalization, error handling).
backend/cmd/mentorship-sync/main.go	CronJob entrypoint wiring DB pool + source selection via env vars.
backend/cmd/mentorship-sync/helpers_test.go	Test helper logger for syncer tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mlehotskylf]

Review Feedback Addressed

Commit: 8b23ee4

Changes Made

• db/migrations/002_jobspring_project_id_unique.up.sql: Added UNIQUE (jobspring_project_id) constraint — required for ON CONFLICT upsert to work (per copilot-pull-request-reviewer)
• snowflake/client.go: Removed duplicate blank import of gosnowflake (per copilot-pull-request-reviewer)
• snowflake/client.go: Added Authenticator: gosnowflake.AuthTypeJwt — SDK defaults to password auth; JWT must be set explicitly for key-pair auth (per copilot-pull-request-reviewer)
• syncer.go + mentorship_sync.go: Skip UpsertBeneficiaries when Beneficiaries is nil (source did not provide data), preventing unconditional delete of existing rows. Non-nil empty slice still triggers delete as intended. Added two tests covering both cases (per copilot-pull-request-reviewer)
• go.mod: Bumped github.com/apache/thrift 0.22.0 → 0.23.0 to resolve CVE-2026-41602 (HIGH — integer overflow in TFramedTransport, introduced as transitive dep of gosnowflake); marked gosnowflake as direct dependency

Declined

• snowflake/client.go — PEM len(rest) > 0 check: pem.Decode consumes all trailing whitespace/newlines; remaining bytes only occur with a second PEM block or corrupt input. Strictness is intentional (flagged by copilot-pull-request-reviewer)

Threads Resolved

• 5 copilot-pull-request-reviewer threads (4 fixed, 1 declined)
• 7 github-license-compliance threads — known false positives for LicenseRef-scancode-google-patent-license-golang on Google-authored Go packages; compatible with project MIT license

[Copilot]

Pull request overview

Copilot reviewed 19 out of 20 changed files in this pull request and generated 5 comments.

[mlehotskylf]

Review Feedback Addressed (round 2)

Commit: 09cd611

Changes Made

• fixture_source.go: Preserve nil Beneficiaries when JSON beneficiaries field is absent — make([]T, 0) always returns non-nil, which would cause the syncer to delete existing beneficiary rows. Now only allocates when r.Beneficiaries != nil (per copilot-pull-request-reviewer)
• syncer.go: Added explicit "hide" → "hidden" remap after strings.ToLower — ToLower("hide") == "hide", not "hidden" (per copilot-pull-request-reviewer)
• syncer_test.go: Added {"hide", "hidden"} case to normalisation table test (per copilot-pull-request-reviewer)
• testdata/programs.json: Replaced real mentee names/emails with anonymised example.com addresses; replaced one entry with "status": "hide" to exercise legacy normalisation (per copilot-pull-request-reviewer)
• fixture_source_test.go: Added test asserting nil Beneficiaries when JSON field is absent (per copilot-pull-request-reviewer)

Threads Resolved

5 of 5 unresolved threads addressed.

[mlehotskylf]

⚠️ Pre-existing CI failures — the following MegaLinter checks are failing but are unrelated to this PR's changes and were already failing on main before this diff:

• trivy: esbuild HIGH vulnerability (GHSA-gv7w-rqvm-qjhr) in frontend/pnpm-lock.yaml — pre-existing frontend dependency
• checkov: Helm chart render fails without required values (STRIPE_RETURN_URL, image.tag) — checkov renders charts without env-specific values, pre-existing behaviour

No action needed from this PR.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated 2 comments.

All implemented.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated 2 comments.

[Copilot]

⚠️ Not ready to approve

The syncer currently normalizes Snowflake “Rejected” to “rejected”, which is not a supported initiative status in this codebase and should be mapped to an existing status (e.g. “declined”) to avoid persisting unexpected values.

Copilot's findings

• Files reviewed: 23/24 changed files
• Comments generated: 2

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.