build.yaml

---
name: Build and Test

permissions:
  contents: read

on:
  push:
    branches:
      - main
  pull_request:
  merge_group:

env:
  CARGO_TERM_COLOR: always
  RUST_TOOLCHAIN_VERSION: "1.93.0"

jobs:
  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
          components: clippy

      - name: Setup Rust Cache
        uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1

      - name: Build
        run: cargo build --release

      - name: Run unit tests
        run: cargo test --lib --bins

      - name: Clippy
        run: cargo clippy --all-targets -- -D warnings

  static-binary:
    name: Static (musl) Build
    runs-on: ubuntu-latest
    needs: [unit-tests]
    steps:
      - name: Install host dependencies
        uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0
        with:
          packages: musl-tools
          version: ubuntu-latest

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
          targets: x86_64-unknown-linux-musl

      - name: Setup Rust Cache
        uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1
        with:
          key: musl

      - name: Build static binary
        run: cargo build --release --target x86_64-unknown-linux-musl

      - name: Confirm binary is statically linked
        run: |
          file target/x86_64-unknown-linux-musl/release/postgresql-trino-gateway \
            | tee /tmp/file.out
          # `file` reports a fully-static musl binary as either
          # "statically linked" (older builds) or "static-pie linked"
          # (newer Rust + musl default — position-independent AND
          # statically linked). Both are fine; reject only "dynamically
          # linked".
          grep -qE 'statically linked|static-pie linked' /tmp/file.out
          ! grep -q 'dynamically linked' /tmp/file.out

  # Single required check for branch protection rules.
  finished:
    name: Finished Build and Test
    if: always()
    needs:
      - unit-tests
      - static-binary
    runs-on: ubuntu-latest
    steps:
      - name: Check job results
        run: |
          if [[ "${{ needs.unit-tests.result }}" != "success" ]] ||
             [[ "${{ needs.static-binary.result }}" != "success" ]]; then
            echo "One or more jobs failed"
            exit 1
          fi
          echo "All jobs passed"