docs: the optimistic attempt and the table-size guard #207
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Read-only by default; the one job that needs more (changes) grants it | |
| # job-scoped. | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Detect whether the change touches anything other than *.md / docs/**. | |
| # PRs that touch only docs skip the heavy jobs below; pushes to main | |
| # always run. Fails open: if detection fails, treat as a code change. | |
| changes: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: read | |
| outputs: | |
| code: ${{ steps.out.outputs.code }} | |
| steps: | |
| - name: Detect non-docs changes | |
| if: github.event_name == 'pull_request' | |
| id: filter | |
| continue-on-error: true | |
| uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3.0.3 | |
| with: | |
| # 'every' makes a file count as code only when it satisfies all | |
| # three patterns (is anything AND not-md AND not-docs). The | |
| # default 'some' ORs the patterns independently, so '**' alone | |
| # matches every file and the exclusions are dead. | |
| predicate-quantifier: every | |
| filters: | | |
| code: | |
| - '**' | |
| - '!**/*.md' | |
| - '!docs/**' | |
| - name: Resolve code-change flag | |
| id: out | |
| shell: bash | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| FILTER_OUTCOME: ${{ steps.filter.outcome }} | |
| FILTER_CODE: ${{ steps.filter.outputs.code }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$EVENT_NAME" != "pull_request" ]; then | |
| code=true | |
| elif [ "$FILTER_OUTCOME" != "success" ]; then | |
| echo "::warning::paths-filter failed; running CI instead of skipping" | |
| code=true | |
| else | |
| code="$FILTER_CODE" | |
| fi | |
| echo "code=$code" >> "$GITHUB_OUTPUT" | |
| echo "event=$EVENT_NAME code=$code" | |
| lint: | |
| needs: changes | |
| if: needs.changes.outputs.code == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version-file: go.mod | |
| # Pin the same golangci-lint major used locally (v2 config format); | |
| # the action's default binary lags and cannot load a v2 config. | |
| - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 | |
| with: | |
| version: v2.12.2 | |
| build: | |
| needs: changes | |
| if: needs.changes.outputs.code == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version-file: go.mod | |
| - run: make build | |
| # The no-cgo promise is a contract: the Wasm parser keeps `go install` | |
| # toolchain-free. One accidental import of the cgo escape hatch | |
| # (pg_query_go's parser) would silently start requiring a C toolchain | |
| # on every contributor's machine. | |
| - name: Build with CGO disabled | |
| run: go build ./... | |
| env: | |
| CGO_ENABLED: "0" | |
| # The integration suite runs against every Aurora-supported PostgreSQL | |
| # major (see docs/postgresql-version-support.md): the version floor is a | |
| # promise CI enforces, not documentation. These are vanilla PostgreSQL | |
| # images — real Aurora engine-version validation is a separate gate that | |
| # cannot run in public CI. | |
| # | |
| # Each job runs one long-lived server (make db-up + make test-db) rather | |
| # than per-test containers: dozens of concurrent container starts | |
| # oversubscribe the runner and get containers killed mid-test, and the | |
| # throwaway-schema harness keeps tests isolated on a shared server | |
| # anyway. TLS tests are the exception — they still start their own | |
| # containers because they control the server's TLS posture. | |
| test: | |
| name: test (PostgreSQL ${{ matrix.pg }}) | |
| needs: changes | |
| if: needs.changes.outputs.code == 'true' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| pg: ["14", "15", "16", "17", "18"] | |
| env: | |
| PG_VERSION: ${{ matrix.pg }} | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version-file: go.mod | |
| - name: Start the test database | |
| run: make db-up | |
| - name: Test against the long-lived database | |
| run: make test-db | |
| # Artifact smoke test: the demo tour in check mode drives the built | |
| # bin/pg-sprite through every planner route, the declarative diff, the | |
| # offline commands, and real executions against the compose database, | |
| # asserting on --json fields and exit codes (demo/tour.sh; see | |
| # demo/README.md). Go tests cover the code, not the artifact — this is | |
| # the one job that exercises the shipped CLI binary end-to-end. | |
| demo: | |
| name: smoke test (built pg-sprite artifact) | |
| needs: changes | |
| if: needs.changes.outputs.code == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version-file: go.mod | |
| - name: Smoke-test the built binary (demo tour, check mode) | |
| run: make demo-check | |
| # AWS-boundary tests against Ministack's RDS/Aurora control plane. | |
| # Ministack is MIT-licensed and tokenless, so this tier runs on every | |
| # code PR — including forks. It is a signal job, deliberately NOT in | |
| # all-green's required set: no production code makes AWS API calls yet, | |
| # so an emulator or infrastructure failure here should not block a | |
| # merge. Promote it to the required set when the first AWS-facing | |
| # feature (Secrets Manager DSN resolution) lands. The Ministack | |
| # container mounts the runner's Docker socket to start the sibling | |
| # PostgreSQL container backing the provisioned cluster; that is safe | |
| # only on an ephemeral GitHub-hosted runner — the guard step enforces | |
| # it instead of trusting the runs-on label to never change. | |
| aws-boundary: | |
| needs: changes | |
| if: needs.changes.outputs.code == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Refuse non-GitHub-hosted runners | |
| env: | |
| RUNNER_ENV: ${{ runner.environment }} | |
| run: | | |
| if [ "$RUNNER_ENV" != "github-hosted" ]; then | |
| echo "aws-boundary mounts the Docker socket; it must only run on ephemeral GitHub-hosted runners (got: $RUNNER_ENV)" | |
| exit 1 | |
| fi | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version-file: go.mod | |
| - run: make test-aws-boundary | |
| # Single required status for branch protection ("all-green" is the | |
| # context to require). Succeeds when nothing failed — including | |
| # docs-only PRs where the heavy jobs were skipped. | |
| all-green: | |
| if: always() | |
| needs: [changes, lint, build, test, demo] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check job results | |
| env: | |
| RESULTS: ${{ toJSON(needs) }} | |
| run: | | |
| echo "$RESULTS" | |
| if echo "$RESULTS" | grep -Eq '"result": *"(failure|cancelled)"'; then | |
| echo "a required job failed or was cancelled" | |
| exit 1 | |
| fi |