# postgres

> Postgres migrations that do not lock tables or break running code, run in order, and never change after they ran, and schemas with row security, explicit grants, and an index under every foreign key.

Postgres migrations that do not lock tables or break running code, run in order, and never change after they ran, and schemas with row security, explicit grants, and an index under every foreign key. It requires [`sql`](/reference/configurations/sql/).

## Checks

| Check                                                                             | Stage    | Level         | What it does                                                                                                               |
| --------------------------------------------------------------------------------- | -------- | ------------- | -------------------------------------------------------------------------------------------------------------------------- |
| [`postgres/squawk`](/reference/checks/postgres/squawk/)                           | `commit` | `recommended` | Checks every migration for changes that lock or rewrite a table, or break the running application.                         |
| [`postgres/migration-order`](/reference/checks/postgres/migration-order/)         | `commit` | `recommended` | Checks that every migration has a version, that no two share one, and that a new migration sorts after the committed ones. |
| [`postgres/edited-migrations`](/reference/checks/postgres/edited-migrations/)     | `commit` | `recommended` | Checks that no migration at or before postgres.frozen\_through differs from its committed text.                            |
| [`postgres/row-level-security`](/reference/checks/postgres/row-level-security/)   | `commit` | `recommended` | Checks that every table in a client schema turns on row level security.                                                    |
| [`postgres/grants`](/reference/checks/postgres/grants/)                           | `commit` | `recommended` | Reports a migration that grants all privileges.                                                                            |
| [`postgres/definer-search-path`](/reference/checks/postgres/definer-search-path/) | `commit` | `recommended` | Checks that every SECURITY DEFINER function sets its search\_path.                                                         |
| [`postgres/foreign-key-indexes`](/reference/checks/postgres/foreign-key-indexes/) | `commit` | `recommended` | Checks that an index, a primary key, or a unique key leads with every foreign key column.                                  |

## Settings

| Setting                                                                                           | What it sets                                                                                                                          |
| ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| [`postgres.client_schemas`](/reference/gspot-toml/#postgres.client_schemas)                       | The schemas clients reach, where every table needs row level security.                                                                |
| [`postgres.frozen_through`](/reference/gspot-toml/#postgres.frozen_through)                       | The last migration version that has run everywhere (none, all, or a version); Squawk skips those migrations, and they may not change. |
| [`postgres.migrations_folder`](/reference/gspot-toml/#postgres.migrations_folder)                 | The migrations folder, relative to the repository root; without it, the checks use the migration files of this configuration.         |
| [`tools.squawk.assume_in_transaction`](/reference/gspot-toml/#tools.squawk.assume_in_transaction) | Whether the migration runner wraps every migration in a transaction; the supabase configuration turns it on.                          |

## Selected when

gspot selects it in a scope with file `prisma/schema.prisma` matches `(?:^|\n)[\t ]*provider[\t ]*=[\t ]*"postgresql"`, or dependencies `pg`, `postgres`, `psycopg`, `asyncpg`, `@neondatabase/serverless`. A configuration that requires it selects it too: [`supabase`](/reference/configurations/supabase/).

## Defaults set for other configurations

| Setting                  | Value        |
| ------------------------ | ------------ |
| `tools.sqlfluff.dialect` | `"postgres"` |

## Rules for coding agents

| Rule file                                                   | Installed when |
| ----------------------------------------------------------- | -------------- |
| `.gspot/configurations/database/postgres/rules/POSTGRES.md` | Always         |

## Tools and versions

| Tool   | Version  |
| ------ | -------- |
| squawk | `2.64.0` |

## Files gspot writes

gspot writes `.gspot/configurations/database/postgres/squawk.toml`.