ci.yml

name: CI

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]
  workflow_dispatch:

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version: "1.26"

      - name: Run tests
        run: |
          go mod tidy
          go test ./... -race -v -count=1

      - name: Lint Helm chart
        run: helm lint deploy/helm/identree/

      - name: Validate OpenAPI spec
        run: python3 -c "import yaml; yaml.safe_load(open('docs/openapi.yaml'))"

  # ── SQLStore tests against Postgres dialect ──────────────────────────────
  # The default `test` job above exercises the SQLStore against in-memory
  # SQLite. This job re-runs the same suite against a real Postgres so the
  # ?->$N placeholder rewriter, BIGINT vs INTEGER timestamps, SELECT FOR
  # UPDATE row locks, ON CONFLICT semantics, and the LISTEN/NOTIFY
  # broadcaster's TRUNCATE/RESTART behaviour all get production-shape coverage.
  sqlstore-postgres:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_HOST_AUTH_METHOD: trust
          POSTGRES_DB: identree
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version: "1.26"

      - name: Run SQLStore + LISTEN/NOTIFY tests against Postgres
        env:
          IDENTREE_TEST_BACKEND: postgres
          IDENTREE_TEST_POSTGRES_DSN: postgres://postgres@localhost:5432/identree?sslmode=disable
        # -p 1 because the Postgres tests share a single physical database
        # and rely on TRUNCATE-before-each-test for isolation.
        run: |
          go test ./internal/challenge/ -count=1 -p 1 -v
          # The broadcaster integration test exercises pg_listen + cluster_messages
          # overflow spooling — only meaningful against a real Postgres.
          go test ./internal/server/ -run 'TestPgListenBroadcaster' -count=1 -v

  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version: "1.26"

      - name: Install gosec
        run: go install github.com/securego/gosec/v2/cmd/gosec@v2.26.1

      - name: Run gosec
        run: gosec -exclude-generated -severity high -confidence high -quiet ./...

  build:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Build Docker image
        run: docker build -t identree:test .

  merge-screenshots:
    runs-on: ubuntu-latest
    needs: build
    if: github.ref == 'refs/heads/screenshots'
    steps:
      - name: Merge screenshots PR into dev
        env:
          GH_TOKEN: ${{ secrets.SCREENSHOTS_PAT }}
        run: |
          gh pr merge \
            --repo "${{ github.repository }}" \
            --squash --admin screenshots \
            || true