ci.yml

name: Platform CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  coordinator-future-clock:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Assert service verification prerequisites
        run: |
          # Host artifacts require /usr/bin/node; setup-node supplies a tool-cache binary.
          runner_node="$(command -v node)"
          test -x "$runner_node"
          if [ "$(readlink -f /usr/bin/node)" != "$(readlink -f "$runner_node")" ]; then
            sudo ln -sfn "$runner_node" /usr/bin/node
          fi
          test -x /usr/bin/node
          test "$(/usr/bin/node -p 'process.execPath')" = "$(node -p 'process.execPath')"
          systemd-analyze --version && test -x /usr/bin/flock
      - name: Entire coordinator suite with wall clock advanced 365 days
        env:
          SHU_TEST_CLOCK_OFFSET_MS: '31536000000'
        run: |
          export NODE_OPTIONS="--import=${GITHUB_WORKSPACE}/.github/coordinator/test/fixture/shift-wall-clock.mjs"
          npm run test:coordinator
  coordinator-git243:
    # The orchestrator compatibility floor is Git 2.43. A newer runner's Git
    # previously hid a distinct-UID upload-pack ownership refusal.
    runs-on: ubuntu-24.04
    container: ubuntu:24.04
    timeout-minutes: 10
    steps:
      - name: Install and assert the Git 2.43 compatibility floor
        run: |
          apt-get update -qq
          apt-get install -y --no-install-recommends git ca-certificates util-linux
          test "$(git --version)" = "git version 2.43.0"
          git --version
          setpriv --reuid=65534 --regid=65534 --clear-groups id -u
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Real Git and distinct-UID episode, including scoped bundle transport
        run: node --test .github/coordinator/test/attempt-workspace.test.mjs .github/coordinator/test/workspace-result.test.mjs .github/coordinator/test/workspace-result-mutations.test.mjs .github/coordinator/test/shu241-scoped-build.test.mjs .github/coordinator/test/shu241-mutations.test.mjs
  fast-checks:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # The db suite (packages/db) runs against a real Postgres on every PR:
    # migrations apply to a scratch database and the store's integrity +
    # concurrency tests execute there — the same reason Opus asked for CI to
    # apply migrations to a scratch DB per PR.
    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: ci-only-placeholder
          POSTGRES_DB: studenthub_authz
        ports:
          - 55432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      DATABASE_URL: postgres://postgres:ci-only-placeholder@localhost:55432/studenthub_authz
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci --ignore-scripts
      - run: npm run typecheck
      # Deterministic coordinator dry-run package (dispatch disabled): pure JS,
      # no build step — runs directly via node --test.
      - name: Assert service verification prerequisites
        run: |
          # Host artifacts require /usr/bin/node; setup-node supplies a tool-cache binary.
          runner_node="$(command -v node)"
          test -x "$runner_node"
          if [ "$(readlink -f /usr/bin/node)" != "$(readlink -f "$runner_node")" ]; then
            sudo ln -sfn "$runner_node" /usr/bin/node
          fi
          test -x /usr/bin/node
          test "$(/usr/bin/node -p 'process.execPath')" = "$(node -p 'process.execPath')"
          systemd-analyze --version && test -x /usr/bin/flock
      - run: npm run test:coordinator
      # npm test is the no-external-dependencies suite; the db suite needs the
      # postgres service above, so it runs as its own explicit step (test:db).
      # Both are required for the PR to be green.
      - run: npm test
      - run: npm run test:db
      - run: npm run build
      - name: Validate Coolify Compose package
        env:
          SOURCE_REVISION: ${{ github.sha }}
          PLATFORM_DB_NAME: studenthub
          PLATFORM_DB_USER: studenthub
          PLATFORM_DB_PASSWORD: ci-only-placeholder
          PLATFORM_DATABASE_URL: postgresql://studenthub:ci-only-placeholder@platform-postgres:5432/studenthub
          OIDC_ISSUER: https://auth.example.test/application/o/studenthub/
          OIDC_CLIENT_ID: studenthub
          OIDC_CLIENT_SECRET: ci-only-placeholder
          OIDC_CALLBACK_URL: https://studenthub.example.test/login/callback
          OIDC_AUTHORIZATION_URL: https://auth.example.test/application/o/authorize/
          OIDC_TOKEN_URL: https://auth.example.test/application/o/token/
          OIDC_JWKS_URL: https://auth.example.test/application/o/studenthub/jwks/
          LOGIN_ALLOWED_RETURN_URLS: https://studenthub.example.test/
        run: docker compose -f deploy/coolify/compose.yaml config --quiet
  image-smoke:
    name: gateway-image-smoke
    runs-on: ubuntu-latest
    timeout-minutes: 15
    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: ci-only-placeholder
          POSTGRES_DB: studenthub_authz
        ports:
          - 55432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Build deployable gateway image
        run: docker build --file Dockerfile --build-arg SOURCE_REVISION="${GITHUB_SHA}" --tag gateway-image-smoke .
      - name: 'IMAGE_SMOKE: /health must return 200 from the built image'
        env:
          DATABASE_URL: postgres://postgres:ci-only-placeholder@localhost:55432/studenthub_authz
        run: bash deploy/coolify/image-smoke.sh gateway-image-smoke