# PR gate: feature → stage (and stage → main promote PRs).
# Full gate against the MINIMAL synthetic database: service Postgres → migrate →
# db:seed:minimal → test:int → build. Build runs here (local service DB only) and
# NEVER in ci-stage.yml — `pnpm build` applies migrations to whatever DATABASE_URL
# it sees, so it is forbidden anywhere near stage/prod URLs.
name: CI (PR)

on:
  pull_request:
    branches: [stage, main]

concurrency:
  group: ci-pr-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  checks:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    services:
      postgres:
        # Matches production Neon major (17) and docker-compose.yml.
        image: postgres:17-alpine
        env:
          POSTGRES_USER: teqo
          POSTGRES_PASSWORD: teqo
          POSTGRES_DB: teqo_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U teqo"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 12
    env:
      # Tests load .env.test themselves (database teqo_test on localhost:5432).
      # These are only for the migrate/seed/build steps, which read the process env.
      DATABASE_URL: postgresql://teqo:teqo@localhost:5432/teqo_test
      PAYLOAD_SECRET: test-only-secret-not-used-in-production
      NEXT_PUBLIC_SITE_URL: http://localhost:3000
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint (zero warnings)
        run: pnpm lint

      - name: Format check (prettier)
        run: pnpm format:check

      - name: Typecheck
        run: pnpm typecheck

      - name: Dead code (knip)
        run: pnpm exec knip

      - name: Circular dependencies (madge)
        run: pnpm check:cycles

      - name: Unit tests
        run: pnpm test:unit

      - name: Migrate test database
        run: pnpm migrate

      - name: Seed minimal test database
        run: pnpm db:seed:minimal

      - name: Integration tests
        run: pnpm test:int

      - name: Build (against the local service database)
        run: pnpm build

  migration-lock:
    # At most ONE open PR may touch schema (migrations or generated types).
    # Two in flight guarantees a broken rebase and a poisoned drizzle snapshot
    # chain; the second PR must wait or rebase.
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Count open PRs touching schema files
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          count=$(gh pr list --state open --limit 100 --json number,files \
            --jq '[.[] | select(.files != null and ([.files[].path | test("^(src/migrations/|src/payload-types.ts$|payload-types.ts$)")] | any))] | length')
          echo "Open schema-touching PRs: $count"
          if [ "$count" -gt 1 ]; then
            echo "::error::More than one open PR touches src/migrations/ or payload-types.ts. Merge or close the other first."
            exit 1
          fi