Support --restrict-key (#727)

Fixes #678

Use `--restrict-key` for `pgdump` > `17.6` so that we can generate
deterministic dumps.

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: sofuture

pkg/dbmate/version.go

@@ -1,4 +1,4 @@
 package dbmate
 
 // Version of dbmate
-const Version = "2.29.2"
+const Version = "2.29.3"

pkg/driver/postgres/postgres.go

@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"io"
 	"net/url"
+	"os/exec"
+	"regexp"
 	"runtime"
 	"strconv"
 	"strings"
@@ -16,6 +18,50 @@ import (
 	"github.com/lib/pq"
 )
 
+// pgDumpVersion represents a parsed pg_dump version
+type pgDumpVersion struct {
+	major int
+	minor int
+}
+
+// pgDumpVersionRegexp matches pg_dump version output like "pg_dump (PostgreSQL) 17.6 (Debian 17.6-1.pgdg120+1)"
+var pgDumpVersionRegexp = regexp.MustCompile(`\(PostgreSQL\) (\d+)\.(\d+)`)
+
+// getPgDumpVersion returns the version of pg_dump, or nil if it cannot be determined
+func getPgDumpVersion() *pgDumpVersion {
+	cmd := exec.Command("pg_dump", "--version")
+	output, err := cmd.Output()
+	if err != nil {
+		return nil
+	}
+
+	matches := pgDumpVersionRegexp.FindStringSubmatch(string(output))
+	if len(matches) < 3 {
+		return nil
+	}
+
+	major, err := strconv.Atoi(matches[1])
+	if err != nil {
+		return nil
+	}
+
+	minor, err := strconv.Atoi(matches[2])
+	if err != nil {
+		return nil
+	}
+
+	return &pgDumpVersion{major: major, minor: minor}
+}
+
+// supportsRestrictKey returns true if pg_dump supports --restrict-key (added in PostgreSQL 17.6)
+func (v *pgDumpVersion) supportsRestrictKey() bool {
+	if v == nil {
+		return false
+	}
+	// --restrict-key was added in PostgreSQL 17.6
+	return v.major > 17 || (v.major == 17 && v.minor >= 6)
+}
+
 func init() {
 	dbmate.RegisterDriver(NewDriver, "postgres")
 	dbmate.RegisterDriver(NewDriver, "postgresql")
@@ -199,8 +245,17 @@ func (drv *Driver) schemaMigrationsDump(db *sql.DB) ([]byte, error) {
 // DumpSchema returns the current database schema
 func (drv *Driver) DumpSchema(db *sql.DB) ([]byte, error) {
 	// load schema
-	args := append([]string{"--format=plain", "--encoding=UTF8", "--schema-only",
-		"--no-privileges", "--no-owner"}, connectionArgsForDump(drv.databaseURL)...)
+	args := []string{"--format=plain", "--encoding=UTF8", "--schema-only",
+		"--no-privileges", "--no-owner"}
+
+	// PostgreSQL 17.6+ adds \restrict/\unrestrict commands to pg_dump output with a random key
+	// by default, making the output non-deterministic. Use a fixed key for reproducible output.
+	// See: https://github.com/amacneil/dbmate/issues/678
+	if version := getPgDumpVersion(); version.supportsRestrictKey() {
+		args = append(args, "--restrict-key=dbmate")
+	}
+
+	args = append(args, connectionArgsForDump(drv.databaseURL)...)
 	schema, err := dbutil.RunCommand("pg_dump", args...)
 	if err != nil {
 		return nil, err

pkg/driver/postgres/postgres_test.go

@@ -100,6 +100,50 @@ func TestGetDriver(t *testing.T) {
 	require.Equal(t, "schema_migrations", drv.migrationsTableName)
 }
 
+func TestPgDumpVersionRegexp(t *testing.T) {
+	cases := []struct {
+		input         string
+		expectedMajor int
+		expectedMinor int
+	}{
+		{"pg_dump (PostgreSQL) 17.6 (Debian 17.6-1.pgdg120+1)", 17, 6},
+		{"pg_dump (PostgreSQL) 16.0", 16, 0},
+		{"pg_dump (PostgreSQL) 15.12", 15, 12},
+	}
+
+	for _, c := range cases {
+		t.Run(c.input, func(t *testing.T) {
+			matches := pgDumpVersionRegexp.FindStringSubmatch(c.input)
+			require.Len(t, matches, 3)
+			require.Equal(t, fmt.Sprintf("%d", c.expectedMajor), matches[1])
+			require.Equal(t, fmt.Sprintf("%d", c.expectedMinor), matches[2])
+		})
+	}
+}
+
+func TestPgDumpVersionSupportsRestrictKey(t *testing.T) {
+	cases := []struct {
+		name     string
+		version  *pgDumpVersion
+		expected bool
+	}{
+		{"nil version", nil, false},
+		{"PostgreSQL 16.0", &pgDumpVersion{major: 16, minor: 0}, false},
+		{"PostgreSQL 17.0", &pgDumpVersion{major: 17, minor: 0}, false},
+		{"PostgreSQL 17.5", &pgDumpVersion{major: 17, minor: 5}, false},
+		{"PostgreSQL 17.6", &pgDumpVersion{major: 17, minor: 6}, true},
+		{"PostgreSQL 17.7", &pgDumpVersion{major: 17, minor: 7}, true},
+		{"PostgreSQL 18.0", &pgDumpVersion{major: 18, minor: 0}, true},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.version.supportsRestrictKey()
+			require.Equal(t, c.expected, result)
+		})
+	}
+}
+
 func defaultConnString() string {
 	switch runtime.GOOS {
 	case "linux":