ci.yml

name: CI

on:
  issue_comment:
    types: [created]

jobs:
  validate:
    # Run when a maintainer comments /test on a PR (manual trigger for external contributors).
    # Dependabot PRs: comment /test to run CI, or add a separate ci-dependabot workflow.
    if: |
      github.event_name == 'issue_comment' &&
      github.event.issue.pull_request &&
      contains(github.event.comment.body, '/test') &&
      (
        github.event.comment.author_association == 'OWNER' ||
        github.event.comment.author_association == 'MEMBER' ||
        github.event.comment.author_association == 'COLLABORATOR'
      )
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      statuses: write
    services:
      postgres:
        image: postgres:18.3
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        # Host port 5632: Metaboost test stack (dev Docker uses 5532; default Postgres is often 5432).
        ports:
          - 5632:5432
        options: >-
          --health-cmd "pg_isready -U postgres" --health-interval 10s
          --health-timeout 5s --health-retries 5
      valkey:
        image: valkey/valkey:7-alpine
        # Host port 6579: Metaboost test Valkey (dev Docker uses 6479; default Redis/Valkey is often 6379).
        ports:
          - 6579:6379
        options: >-
          --health-cmd "valkey-cli ping" --health-interval 10s --health-timeout
          5s --health-retries 5
    env:
      DB_HOST: localhost
      DB_PORT: 5632
      DB_APP_NAME: metaboost_app_test
      DB_APP_MIGRATOR_USER: metaboost_app_migrator
      DB_APP_MIGRATOR_PASSWORD: test
      DB_APP_READ_USER: metaboost_app_read
      DB_APP_READ_PASSWORD: test
      DB_APP_READ_WRITE_USER: metaboost_app_read_write
      DB_APP_READ_WRITE_PASSWORD: test
      DB_MANAGEMENT_NAME: metaboost_management_test
      DB_MANAGEMENT_MIGRATOR_USER: metaboost_management_migrator
      DB_MANAGEMENT_MIGRATOR_PASSWORD: test
      DB_MANAGEMENT_READ_USER: metaboost_management_read
      DB_MANAGEMENT_READ_PASSWORD: test
      DB_MANAGEMENT_READ_WRITE_USER: metaboost_management_read_write
      DB_MANAGEMENT_READ_WRITE_PASSWORD: test
      KEYVALDB_HOST: localhost
      KEYVALDB_PORT: 6579
      KEYVALDB_PASSWORD: "test"
      API_PORT: "3999"
      BRAND_NAME: metaboost-api-test
      AUTH_JWT_SECRET: "ci-test-jwt-secret-min-32-chars-long-for-validation"
    steps:
      - name: Add reaction to comment
        if: github.event_name == 'issue_comment'
        uses: actions/github-script@v9
        with:
          script: |
            await github.rest.reactions.createForIssueComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: context.payload.comment.id,
              content: 'rocket'
            });

      - name: Get PR details
        id: pr-comment
        uses: actions/github-script@v9
        with:
          script: |
            const pr = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.issue.number
            });
            core.setOutput('head_ref', pr.data.head.ref);
            core.setOutput('head_sha', pr.data.head.sha);
            core.setOutput('pr_number', context.issue.number);

      - uses: actions/checkout@v7
        with:
          ref: ${{ steps.pr-comment.outputs.head_sha }}

      - name: Validate linear migration files
        id: db-verify
        run: bash scripts/database/validate-linear-migrations.sh

      - name: Verify linear baseline 0003
        id: db-baseline-0003
        run: bash scripts/database/verify-linear-baseline.sh

      - name: Validate db init sync
        id: db-init-sync
        run: make check_k8s_postgres_init_sync

      - name: Verify bootstrap init contract in ephemeral Postgres
        id: db-bootstrap-contract
        run: bash scripts/database/ci-verify-bootstrap-contract.sh

      - name: Enforce no runtime CREATE EXTENSION
        id: db-runtime-extension-guard
        run: bash scripts/database/check-no-runtime-create-extension.sh

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: "npm"

      - name: Pin npm version
        run: npm install -g npm@11.13.0

      - name: Install dependencies
        id: install
        run: |
          set -euo pipefail
          for attempt in 1 2 3 4 5; do
            if npm ci; then
              break
            fi
            echo "npm ci failed (attempt $attempt/5); retrying in 15s..." >&2
            sleep 15
            if [[ "$attempt" -eq 5 ]]; then
              exit 1
            fi
          done

      - name: Build packages
        id: build-packages
        run: npm run build:packages

      - name: Lint
        id: lint
        run: npm run lint

      - name: Build apps
        id: build-apps
        run: npm run build:apps

      - name: i18n validate
        id: i18n-validate
        run: npm run i18n:validate

      - name: Type-check
        id: type-check
        run: npm run type-check

      - name: Create test database and run init
        id: db-init
        env:
          PGPASSWORD: postgres
          PGHOST: localhost
          PGPORT: "5632"
          PGUSER: postgres
        run: |
          psql -c "DROP DATABASE IF EXISTS metaboost_app_test;"
          psql -c "CREATE DATABASE metaboost_app_test;"
          psql -d postgres -c "
          DO \$\$
          BEGIN
            IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metaboost_app_migrator') THEN
              CREATE USER metaboost_app_migrator WITH PASSWORD 'test';
            ELSE
              ALTER USER metaboost_app_migrator WITH PASSWORD 'test';
            END IF;
            IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metaboost_management_migrator') THEN
              CREATE USER metaboost_management_migrator WITH PASSWORD 'test';
            ELSE
              ALTER USER metaboost_management_migrator WITH PASSWORD 'test';
            END IF;
            IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metaboost_app_read') THEN
              CREATE USER metaboost_app_read WITH PASSWORD 'test';
            END IF;
            IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metaboost_app_read_write') THEN
              CREATE USER metaboost_app_read_write WITH PASSWORD 'test';
            END IF;
            IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metaboost_management_read') THEN
              CREATE USER metaboost_management_read WITH PASSWORD 'test';
            END IF;
            IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metaboost_management_read_write') THEN
              CREATE USER metaboost_management_read_write WITH PASSWORD 'test';
            END IF;
          END \$\$;
          "
          psql -d metaboost_app_test -c "ALTER DATABASE metaboost_app_test OWNER TO metaboost_app_migrator;"
          psql -d metaboost_app_test -c "GRANT CONNECT ON DATABASE metaboost_app_test TO metaboost_app_migrator, metaboost_app_read, metaboost_app_read_write;"
          psql -d metaboost_app_test -c "GRANT USAGE, CREATE ON SCHEMA public TO metaboost_app_migrator;"
          DB_HOST=localhost DB_PORT=5632 DB_APP_NAME=metaboost_app_test DB_APP_MIGRATOR_USER=metaboost_app_migrator DB_APP_MIGRATOR_PASSWORD=test \
            bash scripts/database/run-linear-migrations.sh --database app
          psql -d metaboost_app_test -c "
          GRANT CONNECT ON DATABASE metaboost_app_test TO metaboost_app_read, metaboost_app_read_write;
          GRANT USAGE ON SCHEMA public TO metaboost_app_read, metaboost_app_read_write;
          GRANT SELECT ON ALL TABLES IN SCHEMA public TO metaboost_app_read;
          GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO metaboost_app_read;
          GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO metaboost_app_read_write;
          GRANT SELECT, USAGE, UPDATE ON ALL SEQUENCES IN SCHEMA public TO metaboost_app_read_write;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO metaboost_app_read;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON SEQUENCES TO metaboost_app_read;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO metaboost_app_read_write;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, USAGE, UPDATE ON SEQUENCES TO metaboost_app_read_write;
          "
          psql -c "DROP DATABASE IF EXISTS metaboost_management_test;"
          psql -c "CREATE DATABASE metaboost_management_test;"
          psql -d metaboost_management_test -c "ALTER DATABASE metaboost_management_test OWNER TO metaboost_management_migrator;"
          psql -d metaboost_management_test -c "GRANT CONNECT ON DATABASE metaboost_management_test TO metaboost_management_migrator, metaboost_management_read, metaboost_management_read_write;"
          psql -d metaboost_management_test -c "GRANT USAGE, CREATE ON SCHEMA public TO metaboost_management_migrator;"
          DB_HOST=localhost DB_PORT=5632 DB_MANAGEMENT_NAME=metaboost_management_test DB_MANAGEMENT_MIGRATOR_USER=metaboost_management_migrator DB_MANAGEMENT_MIGRATOR_PASSWORD=test \
            bash scripts/database/run-linear-migrations.sh --database management
          psql -d metaboost_management_test -c "
          GRANT CONNECT ON DATABASE metaboost_management_test TO metaboost_management_read, metaboost_management_read_write;
          GRANT USAGE ON SCHEMA public TO metaboost_management_read, metaboost_management_read_write;
          GRANT SELECT ON ALL TABLES IN SCHEMA public TO metaboost_management_read;
          GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO metaboost_management_read;
          GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON ALL TABLES IN SCHEMA public TO metaboost_management_read_write;
          GRANT SELECT, USAGE, UPDATE ON ALL SEQUENCES IN SCHEMA public TO metaboost_management_read_write;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO metaboost_management_read;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON SEQUENCES TO metaboost_management_read;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON TABLES TO metaboost_management_read_write;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, USAGE, UPDATE ON SEQUENCES TO metaboost_management_read_write;
          "

      - name: Test (skipped in CI; run locally)
        id: test
        if: always()
        run: |
          echo "::warning::Tests are intentionally skipped in GitHub Actions for this workflow."
          echo "::warning::Run tests locally before merge: make E2E_API_GATE_MODE=on e2e_test (or make E2E_API_GATE_MODE=on e2e_test_report for reports)"

      - name: Report success
        if: success()
        uses: actions/github-script@v9
        env:
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{
            github.run_id }}
          PR_NUMBER: ${{ steps.pr-comment.outputs.pr_number }}
        with:
          script: |
            const body = [
              '## ✅ CI Passed',
              '',
              'All checks completed successfully.',
              '',
              '| Check | Status |',
              '|-------|--------|',
              '| Linear migration files valid | ✅ |',
              '| Linear baseline 0003 (vs generator) | ✅ |',
              '| DB init sync valid | ✅ |',
              '| Bootstrap init contract verified | ✅ |',
              '| Runtime CREATE EXTENSION guard | ✅ |',
              '| Dependencies installed | ✅ |',
              '| Build packages | ✅ |',
              '| Lint | ✅ |',
              '| Build apps | ✅ |',
              '| i18n validate | ✅ |',
              '| Type-check | ✅ |',
              '| Test | ⏭️ Skipped in CI (run locally) |',
              '',
              '> Reminder: run `make E2E_API_GATE_MODE=on e2e_test` locally before merging (or `make E2E_API_GATE_MODE=on e2e_test_report` for reports).',
              '',
              `[View full run](${process.env.RUN_URL})`
            ].join('\n');

            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: parseInt(process.env.PR_NUMBER),
              body: body
            });

      - name: Set success commit status
        if: success()
        uses: actions/github-script@v9
        env:
          HEAD_SHA: ${{ steps.pr-comment.outputs.head_sha }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{
            github.run_id }}
        with:
          script: |
            await github.rest.repos.createCommitStatus({
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: process.env.HEAD_SHA,
              state: 'success',
              context: 'validate',
              description: 'All checks passed',
              target_url: process.env.RUN_URL
            });

      - name: Report failure
        if: failure()
        uses: actions/github-script@v9
        env:
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{
            github.run_id }}
          PR_NUMBER: ${{ steps.pr-comment.outputs.pr_number }}
          DB_VERIFY: ${{ steps.db-verify.outcome }}
          DB_BASELINE_0003: ${{ steps.db-baseline-0003.outcome }}
          DB_INIT_SYNC: ${{ steps.db-init-sync.outcome }}
          DB_BOOTSTRAP_CONTRACT: ${{ steps.db-bootstrap-contract.outcome }}
          DB_RUNTIME_EXTENSION_GUARD: ${{ steps.db-runtime-extension-guard.outcome }}
          INSTALL: ${{ steps.install.outcome }}
          BUILD_PACKAGES: ${{ steps.build-packages.outcome }}
          LINT: ${{ steps.lint.outcome }}
          BUILD_APPS: ${{ steps.build-apps.outcome }}
          I18N_VALIDATE: ${{ steps.i18n-validate.outcome }}
          TYPE_CHECK: ${{ steps.type-check.outcome }}
        with:
          script: |
            const status = (outcome) => {
              if (outcome === 'success') return '✅';
              if (outcome === 'failure') return '❌';
              return '⏭️';
            };

            const baselineFix =
              process.env.DB_BASELINE_0003 === 'failure'
                ? [
                    '',
                    '**Linear baseline 0003a/0003b:** Regenerate from the repo root, then commit:',
                    '```',
                    'make db_regen_linear_baseline',
                    'make db_verify_linear_baseline',
                    '```',
                    'Or: `bash scripts/database/generate-linear-baseline.sh` then verify as above.',
                    ''
                  ].join('\n')
                : '';

            const body = [
              '## ❌ CI Failed',
              '',
              'One or more checks failed. Please review and fix the issues.',
              '',
              '| Check | Status |',
              '|-------|--------|',
              `| Linear migration files valid | ${status(process.env.DB_VERIFY)} |`,
              `| Linear baseline 0003 (vs generator) | ${status(process.env.DB_BASELINE_0003)} |`,
              `| DB init sync valid | ${status(process.env.DB_INIT_SYNC)} |`,
              `| Bootstrap init contract verified | ${status(process.env.DB_BOOTSTRAP_CONTRACT)} |`,
              `| Runtime CREATE EXTENSION guard | ${status(process.env.DB_RUNTIME_EXTENSION_GUARD)} |`,
              `| Dependencies installed | ${status(process.env.INSTALL)} |`,
              `| Build packages | ${status(process.env.BUILD_PACKAGES)} |`,
              `| Lint | ${status(process.env.LINT)} |`,
              `| Build apps | ${status(process.env.BUILD_APPS)} |`,
              `| i18n validate | ${status(process.env.I18N_VALIDATE)} |`,
              `| Type-check | ${status(process.env.TYPE_CHECK)} |`,
              '| Test | ⏭️ Skipped in CI (run locally) |',
              '',
              'Legend: ✅ Passed | ❌ Failed | ⏭️ Skipped',
              '',
              baselineFix,
              '> Reminder: run `make E2E_API_GATE_MODE=on e2e_test` locally before merging (or `make E2E_API_GATE_MODE=on e2e_test_report` for reports).',
              '',
              `[View full run for details](${process.env.RUN_URL})`
            ].join('\n');

            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: parseInt(process.env.PR_NUMBER),
              body: body
            });

      - name: Set failure commit status
        if: failure()
        uses: actions/github-script@v9
        env:
          HEAD_SHA: ${{ steps.pr-comment.outputs.head_sha }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{
            github.run_id }}
        with:
          script: |
            await github.rest.repos.createCommitStatus({
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: process.env.HEAD_SHA,
              state: 'failure',
              context: 'validate',
              description: 'One or more checks failed',
              target_url: process.env.RUN_URL
            });