ci.yml

name: CI

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  audit:
    name: Dependency audit
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4

      - name: Set up pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1  # v4
        with:
          run_install: false

      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
        with:
          node-version: 22

      - name: Audit (fail on high/critical)
        run: pnpm audit --audit-level high

  api-tests:
    name: API tests (Postgres)
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    steps:
      # Each integration file owns a complete schema. Concurrent schema cleanup
      # locks its tables, indexes and constraints together, exceeding the default
      # lock table as the billing schema grows. This is the disposable CI service.
      - name: Size PostgreSQL lock table for isolated test schemas
        env:
          POSTGRES_CONTAINER: ${{ job.services.postgres.id }}
        run: |
          docker exec "$POSTGRES_CONTAINER" psql -U postgres -c 'ALTER SYSTEM SET max_locks_per_transaction = 512'
          docker restart "$POSTGRES_CONTAINER"
          for attempt in $(seq 1 30); do
            if docker exec "$POSTGRES_CONTAINER" pg_isready -U postgres; then break; fi
            sleep 1
          done
          test "$(docker exec "$POSTGRES_CONTAINER" psql -U postgres -Atc 'SHOW max_locks_per_transaction')" = 512

      - name: Check out repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4

      - name: Set up pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1  # v4
        with:
          run_install: false

      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Generate Prisma client
        run: pnpm --filter @uoa/api prisma:generate

      # The integration suite serves the built auth/admin windows and imports
      # built team packages, so build everything before testing.
      - name: Build team
        run: pnpm -r --if-present build

      # Unit tests assume DB-less mode (several assert the no-database code
      # paths), so run the full suite without DATABASE_URL first — DB-backed
      # integration files skip themselves — then run the integration suite
      # against the Postgres service.
      - name: Run API tests (DB-less)
        run: pnpm --filter @uoa/api test

      - name: Run API integration tests (Postgres)
        run: pnpm --filter @uoa/api exec vitest run tests/integration
        env:
          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
          BILLING_FUNDING_DATABASE_TESTS: 'true'