ci.yml

name: CI

on:
  pull_request:
    types: [opened, synchronize, reopened, labeled]
  push:
    branches: [main]  # Runs on main after merge
  workflow_dispatch:
    inputs:
      pg_version:
        description: 'PostgreSQL version(s) to test'
        required: false
        default: '17'
        type: choice
        options:
          - '17'
          - '18'
          - '17, 18'

env:
  CARGO_TERM_COLOR: always
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  azure_example_smoke:
    name: Example Smoke Checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Run example smoke checks
        run: |
          for smoke_check in examples/*/scripts/smoke_check.sh; do
            echo "Running $smoke_check"
            bash "$smoke_check"
          done

  format:
    name: Format Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust nightly
        run: |
          rustup toolchain install nightly --profile minimal --component rustfmt
          rustup default nightly

      - name: Check formatting
        run: cargo fmt --package pg_durable -- --check

  prepare:
    name: Prepare Matrix
    runs-on: ubuntu-latest
    outputs:
      pg_versions: ${{ steps.set-matrix.outputs.pg_versions }}
    steps:
      - id: set-matrix
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo 'pg_versions=[${{ github.event.inputs.pg_version }}]' >> "$GITHUB_OUTPUT"
          elif [ "${{ github.event_name }}" = "pull_request" ]; then
            if [ "${{ contains(github.event.pull_request.labels.*.name, 'test-pg18') }}" = "true" ]; then
              echo 'pg_versions=[17, 18]' >> "$GITHUB_OUTPUT"
            else
              echo 'pg_versions=[17]' >> "$GITHUB_OUTPUT"
            fi
          else
            echo 'pg_versions=[17, 18]' >> "$GITHUB_OUTPUT"
          fi

  test:
    name: Clippy & Tests (PG${{ matrix.pg_version }})
    runs-on: ubuntu-latest
    needs: [azure_example_smoke, format, prepare]
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        pg_version: ${{ fromJson(needs.prepare.outputs.pg_versions) }}
    # PG18 failures are non-blocking while compatibility is being established
    continue-on-error: ${{ matrix.pg_version == 18 }}
    steps:
      - uses: actions/checkout@v4

      - name: Free disk space and show usage
        run: |
          echo "Disk usage before cleanup"
          df -h
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/.ghcup
          docker system prune -af || true
          echo "Disk usage after cleanup"
          df -h

      - name: Install Rust nightly
        run: |
          rustup toolchain install nightly --profile minimal --component clippy
          rustup default nightly

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
              pkg-config \
              libssl-dev \
              libclang-dev \
              clang \
              bison \
              flex \
              libreadline-dev \
              zlib1g-dev \
              libxml2-dev \
              libxslt1-dev \
              libicu-dev

      - name: Cache cargo-pgrx tool
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/.crates2.json
            ~/.cargo/bin/cargo-pgrx
          key: ${{ runner.os }}-cargo-pgrx-0.16.1-v1

      - name: Cache Cargo dependency sources
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-deps-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-deps-

      - name: Cache PostgreSQL build
        uses: actions/cache@v5
        with:
          path: |
            ~/.pgrx/config.toml
            ~/.pgrx/${{ matrix.pg_version }}.*
          key: ${{ runner.os }}-pgrx-pg${{ matrix.pg_version }}

      # Always remove stale data directories to prevent flaky tests
      # from leftover state. The data dir is cheap to recreate (~1s).
      - name: Remove cached data directory
        run: rm -rf "$HOME/.pgrx/data-${{ matrix.pg_version }}"

      - name: Install cargo-pgrx
        run: |
          if ! command -v cargo-pgrx &> /dev/null || ! cargo pgrx --version | grep -q "0.16.1"; then
            cargo install cargo-pgrx --version 0.16.1 --locked
          else
            echo "cargo-pgrx 0.16.1 already installed, skipping"
          fi

      - name: Initialize pgrx
        run: |
          if [ ! -d "$HOME/.pgrx/${{ matrix.pg_version }}."* ]; then
            cargo pgrx init --pg${{ matrix.pg_version }} download
          else
            echo "PostgreSQL ${{ matrix.pg_version }} already initialized, skipping download"
          fi

      # Include an http feature for the broadest clippy coverage. No time for multiple feature combos.
      - name: Run clippy
        run: cargo clippy --no-default-features --features pg${{ matrix.pg_version }},http-allow-test-domains -- -D warnings

      # pgspot SQL security gate (pg17 only; the install SQL is the shipped DDL).
      # http-allow-test-domains is a test-only feature that emits no extra DDL, so
      # the scanned surface matches the shipped build while reusing this job's build.
      - name: Generate extension install SQL
        if: matrix.pg_version == 17
        run: |
          cargo pgrx schema pg${{ matrix.pg_version }} \
            --no-default-features \
            --features pg${{ matrix.pg_version }},http-allow-test-domains \
            -o /tmp/pg_durable-install.sql

      - name: Run pgspot SQL security gate
        if: matrix.pg_version == 17
        run: scripts/pgspot-gate.sh /tmp/pg_durable-install.sql

      # Include an http feature to allow http unit tests to run. No time for multiple feature combos.
      - name: Run unit tests
        run: cargo pgrx test pg${{ matrix.pg_version }} --features http-allow-test-domains

      - name: Run E2E tests (default-build phases)
        id: e2e_default_build_phases
        run: ./scripts/test-e2e-local.sh --clean --default-build-phases --pg-version ${{ matrix.pg_version }}

      - name: Run upgrade tests
        id: upgrade_tests
        run: ./scripts/test-upgrade.sh --pg-version ${{ matrix.pg_version }}

      - name: Upload PostgreSQL logs on E2E failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: postgresql-logs-pg${{ matrix.pg_version }}
          path: |
            ~/.pgrx/${{ matrix.pg_version }}.log
            ~/.pgrx/data-${{ matrix.pg_version }}/log/*.log
          if-no-files-found: warn

      - name: Run pg_regress tests
        id: pg_regress
        run: make test-regress PG_VERSION=pg${{ matrix.pg_version }}

      - name: Upload pg_regress results on failure
        if: steps.pg_regress.outcome == 'failure'
        uses: actions/upload-artifact@v4
        with:
          name: pg_regress-results-pg${{ matrix.pg_version }}
          path: |
            regression.out
            regression.diffs
          if-no-files-found: ignore

      - name: Stop PostgreSQL after pg_regress
        if: steps.pg_regress.outcome != 'skipped'
        run: ./scripts/pg-stop.sh --pg-version ${{ matrix.pg_version }}