ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

# Read-only by default; the one job that needs more (changes) grants it
# job-scoped.
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  # Detect whether the change touches anything other than *.md / docs/**.
  # PRs that touch only docs skip the heavy jobs below; pushes to main
  # always run. Fails open: if detection fails, treat as a code change.
  changes:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      code: ${{ steps.out.outputs.code }}
    steps:
      - name: Detect non-docs changes
        if: github.event_name == 'pull_request'
        id: filter
        continue-on-error: true
        uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3.0.3
        with:
          # 'every' makes a file count as code only when it satisfies all
          # three patterns (is anything AND not-md AND not-docs). The
          # default 'some' ORs the patterns independently, so '**' alone
          # matches every file and the exclusions are dead.
          predicate-quantifier: every
          filters: |
            code:
              - '**'
              - '!**/*.md'
              - '!docs/**'
      - name: Resolve code-change flag
        id: out
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          FILTER_OUTCOME: ${{ steps.filter.outcome }}
          FILTER_CODE: ${{ steps.filter.outputs.code }}
        run: |
          set -euo pipefail
          if [ "$EVENT_NAME" != "pull_request" ]; then
            code=true
          elif [ "$FILTER_OUTCOME" != "success" ]; then
            echo "::warning::paths-filter failed; running CI instead of skipping"
            code=true
          else
            code="$FILTER_CODE"
          fi
          echo "code=$code" >> "$GITHUB_OUTPUT"
          echo "event=$EVENT_NAME code=$code"

  lint:
    needs: changes
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: go.mod
      # Pin the same golangci-lint major used locally (v2 config format);
      # the action's default binary lags and cannot load a v2 config.
      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: v2.12.2

  build:
    needs: changes
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: go.mod
      - run: make build
      # The no-cgo promise is a contract: the Wasm parser keeps `go install`
      # toolchain-free. One accidental import of the cgo escape hatch
      # (pg_query_go's parser) would silently start requiring a C toolchain
      # on every contributor's machine.
      - name: Build with CGO disabled
        run: go build ./...
        env:
          CGO_ENABLED: "0"

  # The integration suite runs against every Aurora-supported PostgreSQL
  # major (see docs/postgresql-version-support.md): the version floor is a
  # promise CI enforces, not documentation. These are vanilla PostgreSQL
  # images — real Aurora engine-version validation is a separate gate that
  # cannot run in public CI.
  #
  # Each job runs one long-lived server (make db-up + make test-db) rather
  # than per-test containers: dozens of concurrent container starts
  # oversubscribe the runner and get containers killed mid-test, and the
  # throwaway-schema harness keeps tests isolated on a shared server
  # anyway. TLS tests are the exception — they still start their own
  # containers because they control the server's TLS posture.
  test:
    name: test (PostgreSQL ${{ matrix.pg }})
    needs: changes
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        pg: ["14", "15", "16", "17", "18"]
    env:
      PG_VERSION: ${{ matrix.pg }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: go.mod
      - name: Start the test database
        run: make db-up
      - name: Test against the long-lived database
        run: make test-db

  # AWS-boundary tests against Ministack's RDS/Aurora control plane.
  # Ministack is MIT-licensed and tokenless, so this tier runs on every
  # code PR — including forks. It is a signal job, deliberately NOT in
  # all-green's required set: no production code makes AWS API calls yet,
  # so an emulator or infrastructure failure here should not block a
  # merge. Promote it to the required set when the first AWS-facing
  # feature (Secrets Manager DSN resolution) lands. The Ministack
  # container mounts the runner's Docker socket to start the sibling
  # PostgreSQL container backing the provisioned cluster; that is safe
  # only on an ephemeral GitHub-hosted runner — the guard step enforces
  # it instead of trusting the runs-on label to never change.
  aws-boundary:
    needs: changes
    if: needs.changes.outputs.code == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Refuse non-GitHub-hosted runners
        env:
          RUNNER_ENV: ${{ runner.environment }}
        run: |
          if [ "$RUNNER_ENV" != "github-hosted" ]; then
            echo "aws-boundary mounts the Docker socket; it must only run on ephemeral GitHub-hosted runners (got: $RUNNER_ENV)"
            exit 1
          fi
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: go.mod
      - run: make test-aws-boundary

  # Single required status for branch protection ("all-green" is the
  # context to require). Succeeds when nothing failed — including
  # docs-only PRs where the heavy jobs were skipped.
  all-green:
    if: always()
    needs: [changes, lint, build, test]
    runs-on: ubuntu-latest
    steps:
      - name: Check job results
        env:
          RESULTS: ${{ toJSON(needs) }}
        run: |
          echo "$RESULTS"
          if echo "$RESULTS" | grep -Eq '"result": *"(failure|cancelled)"'; then
            echo "a required job failed or was cancelled"
            exit 1
          fi