mirror of
https://github.com/fsolla/teqo.git
synced 2026-11-13 23:25:18 +00:00
76a03fac91
Checkout fixed the missing .git, but `gh pr list` then failed with "GraphQL: Resource not accessible by integration (repository.pullRequests)" — the default token needs an explicit permission grant.
109 lines
3.4 KiB
YAML
109 lines
3.4 KiB
YAML
# PR gate: feature → stage (and stage → main promote PRs).
|
|
# Full gate against the MINIMAL synthetic database: service Postgres → migrate →
|
|
# db:seed:minimal → test:int → build. Build runs here (local service DB only) and
|
|
# NEVER in ci-stage.yml — `pnpm build` applies migrations to whatever DATABASE_URL
|
|
# it sees, so it is forbidden anywhere near stage/prod URLs.
|
|
name: CI (PR)
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [stage, main]
|
|
|
|
concurrency:
|
|
group: ci-pr-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
checks:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
services:
|
|
postgres:
|
|
# Matches production Neon major (17) and docker-compose.yml.
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_USER: teqo
|
|
POSTGRES_PASSWORD: teqo
|
|
POSTGRES_DB: teqo_test
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U teqo"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 12
|
|
env:
|
|
# Tests load .env.test themselves (database teqo_test on localhost:5432).
|
|
# These are only for the migrate/seed/build steps, which read the process env.
|
|
DATABASE_URL: postgresql://teqo:teqo@localhost:5432/teqo_test
|
|
PAYLOAD_SECRET: test-only-secret-not-used-in-production
|
|
NEXT_PUBLIC_SITE_URL: http://localhost:3000
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Lint (zero warnings)
|
|
run: pnpm lint
|
|
|
|
- name: Format check (prettier)
|
|
run: pnpm format:check
|
|
|
|
- name: Typecheck
|
|
run: pnpm typecheck
|
|
|
|
- name: Dead code (knip)
|
|
run: pnpm exec knip
|
|
|
|
- name: Circular dependencies (madge)
|
|
run: pnpm check:cycles
|
|
|
|
- name: Unit tests
|
|
run: pnpm test:unit
|
|
|
|
- name: Migrate test database
|
|
run: pnpm migrate
|
|
|
|
- name: Seed minimal test database
|
|
run: pnpm db:seed:minimal
|
|
|
|
- name: Integration tests
|
|
run: pnpm test:int
|
|
|
|
- name: Build (against the local service database)
|
|
run: pnpm build
|
|
|
|
migration-lock:
|
|
# At most ONE open PR may touch schema (migrations or generated types).
|
|
# Two in flight guarantees a broken rebase and a poisoned drizzle snapshot
|
|
# chain; the second PR must wait or rebase.
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
# gh pr list against the default GITHUB_TOKEN.
|
|
contents: read
|
|
pull-requests: read
|
|
steps:
|
|
# gh expands --json files via git, so it needs the repo checked out.
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Count open PRs touching schema files
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
count=$(gh pr list --state open --limit 100 --json number,files \
|
|
--jq '[.[] | select(.files != null and ([.files[].path | test("^(src/migrations/|src/payload-types.ts$|payload-types.ts$)")] | any))] | length')
|
|
echo "Open schema-touching PRs: $count"
|
|
if [ "$count" -gt 1 ]; then
|
|
echo "::error::More than one open PR touches src/migrations/ or payload-types.ts. Merge or close the other first."
|
|
exit 1
|
|
fi
|