test(19.3-05): build tags, S3 tag guard, DiskExtension and public_url

- manifest_tags_test.go: build.tags load, trim, dedupe and validation
  errors naming build.tags; SaveManifest keeps tags and plugin order;
  goBuildArgs puts one -tags before -o
- s3_test.go: s3:// refused without summercms_s3 naming the tag, opens
  with it (both build modes, any scheme case)
- diskext_test.go: RESEARCH probe rows and table consistency
- url_test.go: public_url base joining, File.URL and thumbnails,
  malformed values refused naming the key
- store_test.go: Postgres regression table through Store
- gate: attach names in both tag modes, Store regression in docker

modules/lagoon/attach/s3_test.go

@@ -0,0 +1,68 @@
+package attach
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestOpenBucketS3 (plan 05 of phase 19.3, D-13) has no build constraint: it
+// runs in both modes and branches on s3Enabled. Without the summercms_s3 tag
+// an s3:// bucket_url (any case of the scheme) fails boot naming the tag and
+// where to set it; with the tag the bucket opens on dummy AWS credentials
+// (s3blob connects lazily, so nothing leaves the host) and closes.
+func TestOpenBucketS3(t *testing.T) {
+	t.Setenv("AWS_ACCESS_KEY_ID", "unit-access-key")
+	t.Setenv("AWS_SECRET_ACCESS_KEY", "unit-secret-key")
+	t.Setenv("AWS_REGION", "eu-central-1")
+	t.Setenv("AWS_EC2_METADATA_DISABLED", "true")
+	t.Cleanup(func() {
+		setPublicPathPrefix(defaultPublicPathPrefix)
+		setPublicURLBase("")
+	})
+	if S3BuildTag != "summercms_s3" {
+		t.Fatalf("S3BuildTag = %q", S3BuildTag)
+	}
+
+	for _, raw := range []string{
+		"s3://unit-bucket?region=eu-central-1",
+		"S3://unit-bucket?region=eu-central-1",
+		"s3://unit-bucket?region=auto&endpoint=https://storage.example.com&use_path_style=true",
+	} {
+		t.Run(raw, func(t *testing.T) {
+			cfg := openTestConfig(t, "uploads:\n  bucket_url: \""+raw+"\"\n")
+			bucket, err := OpenBucket(t.Context(), cfg)
+			if !s3Enabled {
+				if err == nil {
+					_ = bucket.Close()
+					t.Fatal("s3:// opened without the summercms_s3 tag")
+				}
+				for _, want := range []string{"storage.uploads.bucket_url", S3BuildTag, "build.tags", "summer.yaml", "-tags " + S3BuildTag, "GOFLAGS=-tags=" + S3BuildTag} {
+					if !strings.Contains(err.Error(), want) {
+						t.Fatalf("error %q does not name %q", err, want)
+					}
+				}
+				if strings.Contains(err.Error(), "unit-bucket") || strings.Contains(err.Error(), "unit-secret") {
+					t.Fatalf("error %q repeats the bucket URL", err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("OpenBucket with the tag: %v", err)
+			}
+			if err := bucket.Close(); err != nil {
+				t.Fatalf("close: %v", err)
+			}
+		})
+	}
+
+	// Other schemes never reach the tag check.
+	for _, raw := range []string{"mem://", "file:///tmp/x", "fileblob:///tmp/x", "s3x://b", "gs://bucket", "s3:no-slashes"} {
+		if err := checkS3Driver(raw); err != nil {
+			t.Fatalf("checkS3Driver(%q) = %v", raw, err)
+		}
+	}
+	err := checkS3Driver("s3://b")
+	if s3Enabled != (err == nil) {
+		t.Fatalf("checkS3Driver(s3://b) = %v with s3Enabled %t", err, s3Enabled)
+	}
+}