ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.sha }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Lint (Biome check — formatting + lint)
        run: pnpm lint
      - name: Lint (dependency-cruiser — domain/layer/plane boundaries, ADR-0028)
        run: pnpm lint:deps

  typecheck:
    name: Type Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Type check
        run: pnpm typecheck

  test:
    name: Test
    runs-on: ubuntu-latest
    # Backs the suites that need a real Postgres via STATE_TEST_DATABASE_URL:
    # examples/auth and examples/storage (tests/pg-harness.ts) and the target
    # extension's integration tests (src/__tests__/postgres-harness.ts).
    # Without it those harnesses find no Postgres and the suites silently skip.
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd="pg_isready -U postgres"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      # Build every package's dist up front. `pnpm test` builds deps via turbo
      # `^build`, but tests that resolve a framework package at *runtime* (the
      # integration suite spawns the built CLI, which resolves `@prisma/composer-node`
      # from its dist) need every dist present before the test process starts —
      # a plain build-first step is more robust than relying on task ordering
      # under CI concurrency.
      - name: Build packages
        run: pnpm build
      # `@prisma/dev` (the ORM's local-Postgres server — the local-dev
      # integration proofs' postgres-main daemon hosts it programmatically
      # via `startPrismaDevServer`) downloads its database engine binaries
      # on its first-ever invocation on a machine. A dev workstation
      # accumulates that cache across sessions; a CI runner starts genuinely
      # cold every time. Isolating the download in its own step gives it a
      # clear, attributable failure (network egress to the engine host, disk
      # space, ...) instead of surfacing buried inside a 5-service
      # `alchemy deploy` three provider frames deep. The script warms it
      # through the SAME programmatic `startPrismaDevServer` the proofs use —
      # NOT the `prisma dev` CLI, which fetches its subcommand from the
      # network at runtime (an upstream break there once reddened this step,
      # and every PR, with no change on our side). See the script's header.
      - name: Warm the prisma dev engine cache
        run: bun scripts/warm-prisma-dev-engine.ts
      - name: Test
        env:
          STATE_TEST_DATABASE_URL: postgres://postgres:postgres@localhost:5432/postgres
        run: pnpm test
      - name: Type-only tests (vitest --typecheck)
        run: pnpm turbo run test:types
      - name: Test scripts (cast-ratchet unit tests)
        run: pnpm test:scripts

  node-floor:
    name: Node 22.18 floor
    # The published packages declare `engines.node: >=22.18.0`, but every suite
    # above runs under bun, which ignores `engines.node` entirely, and
    # `.tool-versions` pins node 24.16.0 — so nothing else here ever executes
    # the floor version. This job does. It covers what a Node user hits first:
    # the two runtime features the floor rests on, the CLI's TypeScript entry
    # under a real node, `node --test` over the repo's TypeScript scripts, the
    # built binary a consumer installs, and every published entrypoint of
    # @prisma/composer and @prisma/composer-cli. It deliberately does NOT re-run the bun suites under
    # node — bun is the runner there, so doing so would prove nothing about
    # node.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      # Built on the toolchain `.tool-versions` pins (node 24.16.0) — the same
      # toolchain publish.yml builds the tarballs with. The floor is a claim
      # about CONSUMING that output, so node drops to 22.18.0 only after this.
      - name: Build packages
        run: pnpm build
      # mise is how this repo pins tools; there is no `actions/setup-node`
      # anywhere in .github. `.tool-versions` stays on 24.16.0 — this prepends
      # 22.18.0 to PATH for the steps below only.
      - name: Put node 22.18.0 first on PATH
        run: |
          mise install node@22.18.0
          echo "$(mise where node@22.18.0)/bin" >> "$GITHUB_PATH"
      # If that PATH order ever flips back to mise's 24.16.0, every step below
      # would quietly re-test the version CI already covers. Fail loudly here.
      - name: Confirm node is exactly the floor version
        run: |
          echo "node --version -> $(node --version)"
          test "$(node --version)" = "v22.18.0"
      # The two runtime features `>=22.18.0` rests on. Type stripping is what
      # sets the floor: it is unflagged in 22.18.0 exactly, and it is how the
      # CLI imports the user's `.ts` entry. `node:sqlite` (used by the streams
      # module's local stand-in, via @prisma/streams-local's `DatabaseSync`)
      # unflagged earlier, in 22.13.0, so the floor already covers it.
      - name: Check the runtime features the floor claims
        run: |
          printf 'const greeting: string = "type stripping works"\nconsole.log(greeting)\n' > "$RUNNER_TEMP/floor-check.mts"
          node "$RUNNER_TEMP/floor-check.mts"
          node -e "const { DatabaseSync } = require('node:sqlite'); new DatabaseSync(':memory:').exec('create table t(x)'); console.log('node:sqlite works')"
      # The one test in the repo that spawns a real `node` at the CLI's
      # TypeScript entry (src/bin.ts). bun runs the SUITE; the process under
      # test is the 22.18.0 node put on PATH above, which is what makes this
      # the proof for the CLI's front door.
      - name: CLI node-compat smoke test (spawns node at src/bin.ts)
        run: pnpm --filter @internal/cli exec bun test src/__tests__/node-compat.test.ts
      # `node --test` over scripts/*.test.ts — a real node executing TypeScript
      # test files directly, so type stripping again, across the script suite.
      - name: Repo script tests (node --test over TypeScript sources)
        run: pnpm test:scripts
      # What a consumer actually installs and runs in their first minutes.
      # `--help` writes to stderr, hence the redirect.
      - name: Smoke the published CLI binary
        run: |
          BIN=packages/9-public/composer-cli/dist/bin.mjs
          VERSION=$(node -p "require('./packages/9-public/composer-cli/package.json').version")
          node "$BIN" --version | grep -q "$VERSION"
          node "$BIN" --help 2>&1 | grep -q 'deploy <entry>'
      # The step above proves start-up, and start-up is exactly the part that
      # loads none of the deploy machinery: the CLI keeps its executors behind
      # `await import()` (check-family-static-graph.mjs enforces that), so
      # `--version` never touches alchemy, effect, or any provider. Until this
      # step, the constellation a real `deploy` evaluates had never been
      # imported on the floor version anywhere in CI, and a consumer running
      # `prisma-composer deploy` was the first to find out.
      - name: Import every published entrypoint on the floor
        run: pnpm check:floor-imports

  cast-ratchet:
    name: Cast ratchet
    # PR-only: the ratchet compares HEAD against the PR base. On push to main
    # there is no diff to measure.
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          # Full history so the merge-base commit is present for the worktree scan.
          fetch-depth: 0
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      # The PR base sha is already in history (fetch-depth: 0); point origin/main
      # at it so the script needs no authenticated network fetch.
      - name: Establish origin/main baseline ref
        run: git update-ref refs/remotes/origin/main ${{ github.event.pull_request.base.sha }}
      - name: Cast ratchet (no new bare `as` casts vs base)
        run: pnpm lint:casts

  npm-effect-resolution:
    name: npm install effect dedupe
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Build the public packages
        run: pnpm turbo run build --filter=@prisma/composer --filter=@prisma/composer-cli --filter=@prisma/composer-prisma-cloud
      # Regression check for TML-3158: packs the public packages and installs
      # the tarballs with real npm against the real registry; fails if more
      # than one `effect` resolves or alchemy's position resolves a copy
      # without `Schedule.either`. pnpm never surfaces this — only a
      # standalone npm install does.
      - name: Check npm resolves a single pinned effect
        run: pnpm check:npm-effect-resolution

  cli-engine-pin:
    name: cli-engine pin and externality
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      # Both public packages: the pin check packs @prisma/composer-cli for the
      # peer/externality half AND @prisma/composer for the engine-free-library
      # half.
      - name: Build the public packages
        run: pnpm turbo run build --filter=@prisma/composer --filter=@prisma/composer-cli
      # The engine is released in tandem with composer-cli and must be
      # exact-pinned identically across the manifests, left external in the CLI
      # tarball, and absent from the library tarball. See the script's header.
      - name: Check the cli-engine pin and externality
        run: pnpm check:cli-engine-pin
      # Same built package, second invariant: nothing statically reachable
      # from the family or testing entrypoints may import alchemy or effect.
      - name: Check the family and testing static graphs
        run: pnpm check:family-static-graph

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      # typecheck/test don't depend on ^build, so nothing else exercises the
      # example artifact builds (esp. storefront's `next build`). This does.
      - name: Build
        run: pnpm turbo run build
      - name: Check working tree is clean
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "Build left the working tree dirty:"
            git status --porcelain
            exit 1
          fi