Fix CI integration test failures

- Add proxy-body-size annotation to allow unlimited uploads via nginx
- Add requires_direct_s3 marker for tests needing direct MinIO access
- Exclude requires_direct_s3 tests from CI (can't access MinIO from outside K8s)
- Add auto-migration for tag ref_count triggers to ensure they exist

backend/app/database.py

@@ -170,6 +170,62 @@ def _run_migrations():
             END IF;
         END $$;
         """,
+        # Create ref_count trigger functions for tags (ensures triggers exist even if initial migration wasn't run)
+        """
+        CREATE OR REPLACE FUNCTION increment_artifact_ref_count()
+        RETURNS TRIGGER AS $$
+        BEGIN
+            UPDATE artifacts SET ref_count = ref_count + 1 WHERE id = NEW.artifact_id;
+            RETURN NEW;
+        END;
+        $$ LANGUAGE plpgsql;
+        """,
+        """
+        CREATE OR REPLACE FUNCTION decrement_artifact_ref_count()
+        RETURNS TRIGGER AS $$
+        BEGIN
+            UPDATE artifacts SET ref_count = ref_count - 1 WHERE id = OLD.artifact_id;
+            RETURN OLD;
+        END;
+        $$ LANGUAGE plpgsql;
+        """,
+        """
+        CREATE OR REPLACE FUNCTION update_artifact_ref_count()
+        RETURNS TRIGGER AS $$
+        BEGIN
+            IF OLD.artifact_id != NEW.artifact_id THEN
+                UPDATE artifacts SET ref_count = ref_count - 1 WHERE id = OLD.artifact_id;
+                UPDATE artifacts SET ref_count = ref_count + 1 WHERE id = NEW.artifact_id;
+            END IF;
+            RETURN NEW;
+        END;
+        $$ LANGUAGE plpgsql;
+        """,
+        # Create triggers for tags ref_count management
+        """
+        DO $$
+        BEGIN
+            -- Drop and recreate triggers to ensure they're current
+            DROP TRIGGER IF EXISTS tags_ref_count_insert_trigger ON tags;
+            CREATE TRIGGER tags_ref_count_insert_trigger
+                AFTER INSERT ON tags
+                FOR EACH ROW
+                EXECUTE FUNCTION increment_artifact_ref_count();
+
+            DROP TRIGGER IF EXISTS tags_ref_count_delete_trigger ON tags;
+            CREATE TRIGGER tags_ref_count_delete_trigger
+                AFTER DELETE ON tags
+                FOR EACH ROW
+                EXECUTE FUNCTION decrement_artifact_ref_count();
+
+            DROP TRIGGER IF EXISTS tags_ref_count_update_trigger ON tags;
+            CREATE TRIGGER tags_ref_count_update_trigger
+                AFTER UPDATE ON tags
+                FOR EACH ROW
+                WHEN (OLD.artifact_id IS DISTINCT FROM NEW.artifact_id)
+                EXECUTE FUNCTION update_artifact_ref_count();
+        END $$;
+        """,
         # Create ref_count trigger functions for package_versions
         """
         CREATE OR REPLACE FUNCTION increment_version_ref_count()

backend/tests/conftest.py

@@ -34,6 +34,10 @@ def pytest_configure(config):
         "markers",
         "slow: marks tests as slow running",
     )
+    config.addinivalue_line(
+        "markers",
+        "requires_direct_s3: marks tests that require direct S3/MinIO access (skipped in CI where S3 is not directly accessible)",
+    )
 
 
 import io

backend/tests/integration/test_integrity_verification.py

@@ -489,11 +489,15 @@ class TestArtifactIntegrityEndpoint:
         assert len(response.content) == expected_size
 
 
+@pytest.mark.requires_direct_s3
 class TestCorruptionDetection:
     """Tests for detecting corrupted S3 objects.
 
     These tests directly manipulate S3 objects to simulate corruption
     and verify that the system can detect hash mismatches.
+
+    Note: These tests require direct S3/MinIO access and are skipped in CI
+    where S3 is not directly accessible from the test runner.
     """
 
     @pytest.mark.integration

backend/tests/integration/test_large_uploads.py

@@ -101,6 +101,7 @@ class TestLargeFileUploads:
 
     @pytest.mark.integration
     @pytest.mark.slow
+    @pytest.mark.requires_direct_s3
     def test_upload_100mb_file(self, integration_client, test_package, sized_content):
         """Test uploading a 100MB file (triggers multipart upload)."""
         project, package = test_package

backend/tests/integration/test_upload_download_api.py

@@ -158,6 +158,7 @@ class TestUploadBasics:
         assert artifact["size"] == len(content)
 
     @pytest.mark.integration
+    @pytest.mark.requires_direct_s3
     def test_upload_creates_object_in_s3(self, integration_client, test_package):
         """Test upload creates object in S3 storage."""
         project, package = test_package
@@ -635,6 +636,7 @@ class TestUploadFailureCleanup:
     """Tests for cleanup when uploads fail."""
 
     @pytest.mark.integration
+    @pytest.mark.requires_direct_s3
     def test_upload_failure_invalid_project_no_orphaned_s3(
         self, integration_client, unique_test_id
     ):
@@ -657,6 +659,7 @@ class TestUploadFailureCleanup:
         )
 
     @pytest.mark.integration
+    @pytest.mark.requires_direct_s3
     def test_upload_failure_invalid_package_no_orphaned_s3(
         self, integration_client, test_project, unique_test_id
     ):
@@ -704,6 +707,7 @@ class TestS3StorageVerification:
     """Tests to verify S3 storage behavior."""
 
     @pytest.mark.integration
+    @pytest.mark.requires_direct_s3
     def test_s3_single_object_after_duplicates(
         self, integration_client, test_package, unique_test_id
     ):
@@ -759,6 +763,7 @@ class TestSecurityPathTraversal:
     """
 
     @pytest.mark.integration
+    @pytest.mark.requires_direct_s3
     def test_path_traversal_in_filename_stored_safely(
         self, integration_client, test_package
     ):