ci.yml

name: CI

on:
    workflow_dispatch:
    push:
        branches: [main, master]
        paths:
            - 'src/**'
            - 'tests/**'
            - 'packages/**'
            - 'examples/**'
            - 'bun.lockb'
            - 'tsconfig*.json'
            - '.github/workflows/ci.yml'
    pull_request:
        branches: [main, master]
        paths:
            - 'src/**'
            - 'tests/**'
            - 'packages/**'
            - 'examples/**'
            - 'bun.lockb'
            - 'tsconfig*.json'
            - '.github/workflows/ci.yml'

jobs:
    build:
        runs-on: ubuntu-24.04

        services:
            postgres:
                image: postgres:17-alpine
                ports:
                    - 15432:5432
                env:
                    POSTGRES_USER: noorm_test
                    POSTGRES_PASSWORD: noorm_test
                    POSTGRES_DB: noorm_test
                options: >-
                    --health-cmd "pg_isready -U noorm_test"
                    --health-interval 5s
                    --health-timeout 5s
                    --health-retries 5

            mysql:
                image: mysql:8.0
                ports:
                    - 13306:3306
                env:
                    MYSQL_ROOT_PASSWORD: noorm_test
                    MYSQL_DATABASE: noorm_test
                    MYSQL_USER: noorm_test
                    MYSQL_PASSWORD: noorm_test
                options: >-
                    --health-cmd "mysqladmin ping -h localhost"
                    --health-interval 5s
                    --health-timeout 5s
                    --health-retries 5

            mssql:
                image: mcr.microsoft.com/mssql/server:2022-latest
                ports:
                    - 11433:1433
                env:
                    ACCEPT_EULA: 'Y'
                    SA_PASSWORD: 'NoOrm_Test123!'
                    MSSQL_PID: Developer
                options: >-
                    --health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P 'NoOrm_Test123!' -C -Q 'SELECT 1' || exit 1"
                    --health-interval 10s
                    --health-timeout 5s
                    --health-retries 10
                    --health-start-period 30s

        steps:
            - uses: actions/checkout@v4

            - uses: actions/setup-node@v4
              with:
                  node-version: '24'

            - uses: oven-sh/setup-bun@v2
              with:
                  bun-version: '1.3.11'

            - name: Create PostgreSQL dest database and deploy schema
              run: |
                  PG_CTR=$(docker ps -q --filter "ancestor=postgres:17-alpine")
                  docker exec "$PG_CTR" psql -U noorm_test -c "CREATE DATABASE noorm_test_dest;" 2>/dev/null || true
                  for f in tests/fixtures/sql/postgres/001_tables.sql tests/fixtures/sql/postgres/002_views.sql; do
                    docker cp "$f" "$PG_CTR:/tmp/$(basename $f)"
                    docker exec "$PG_CTR" psql -U noorm_test -d noorm_test_dest -f "/tmp/$(basename $f)"
                  done

            - name: Create MySQL dest database
              run: |
                  docker exec $(docker ps -q --filter "ancestor=mysql:8.0") \
                    mysql -uroot -pnoorm_test -e "CREATE DATABASE IF NOT EXISTS noorm_test_dest;"
                  docker exec $(docker ps -q --filter "ancestor=mysql:8.0") \
                    mysql -uroot -pnoorm_test -e "GRANT ALL ON noorm_test_dest.* TO 'noorm_test'@'%';"

            - name: Create MSSQL test databases
              run: |
                  docker exec $(docker ps -q --filter "ancestor=mcr.microsoft.com/mssql/server:2022-latest") \
                    /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P 'NoOrm_Test123!' -C \
                    -Q "IF NOT EXISTS (SELECT name FROM sys.databases WHERE name = 'noorm_test') CREATE DATABASE [noorm_test]; IF NOT EXISTS (SELECT name FROM sys.databases WHERE name = 'noorm_test_dest') CREATE DATABASE [noorm_test_dest];"

            - run: bun install --frozen-lockfile
            - run: bun run lint
            - run: bun run typecheck
            - run: bun run build
            # Split test runs to prevent cross-contamination from mock.module
            # Tests using mock.module run separately from those that don't
            #
            # TODO: Remove this split once the runner image regression is resolved.
            # GitHub Actions runner ubuntu24/20260406.80 introduced PG connection
            # state corruption when transfer tests run in the same bun process as
            # the full core suite. Transfer tests pass in isolation. Investigate
            # root cause (likely bun test beforeAll error handling or PG pool
            # lifecycle change) and reunify into a single "Run core tests" step.
            # See: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260406.80
            - name: Run core tests (non-transfer)
              env:
                  CI: 'false'
                  FORCE_COLOR: 'true'
              run: |
                  bun test --serial $(find tests/utils tests/core tests/sdk -name '*.test.ts' | grep -v tests/core/transfer | sort | tr '\n' ' ')
            - name: Run transfer tests (isolated)
              env:
                  CI: 'false'
                  FORCE_COLOR: 'true'
              run: bun test --serial tests/core/transfer
            - name: Run CLI tests
              env:
                  CI: 'false'
                  FORCE_COLOR: 'true'
              run: bun test --serial tests/cli
            - name: Run integration tests
              env:
                  CI: 'false'
                  FORCE_COLOR: 'true'
              run: bun test --serial tests/integration

    # ───────────────────────────────────────────────────────────────────
    # examples/todo-db is a reference CI target: a real Postgres schema
    # with soft-deletes, JSONB, TVFs, transactional SPs, cron/feature-flag
    # seeds, and an SDK-driven test suite that asserts on the resulting
    # state. This job treats it as a stress test for CLI ↔ SDK
    # coordination — each `noorm ci` / `noorm db` / `noorm change` step
    # below is exactly what an operator would type inside a real pipeline
    # that has no access to an operator keychain.
    #
    # The SDK integration tests run last with NOORM_TEST_PREBUILT=1, which
    # tells the test harness to skip its own local bootstrap path and
    # instead connect to the database state produced by the steps above.
    # That's the coordination we actually care about: can the SDK
    # transparently consume state generated by the CLI in a CI session?
    # ───────────────────────────────────────────────────────────────────
    example-todo-db:
        runs-on: ubuntu-24.04
        needs: build

        services:
            postgres:
                image: postgres:17-alpine
                ports:
                    - 15432:5432
                env:
                    POSTGRES_USER: noorm_test
                    POSTGRES_PASSWORD: noorm_test
                    POSTGRES_DB: noorm_test
                options: >-
                    --health-cmd "pg_isready -U noorm_test"
                    --health-interval 5s
                    --health-timeout 5s
                    --health-retries 5

        # Job-level env is visible to every step. NOORM_CONNECTION_* is
        # read by both the CLI (during ci init / db create / db reset /
        # change ff) and the SDK (during createContext), so setting it
        # once here keeps the bootstrap steps flag-free. NOORM_name /
        # NOORM_type / NOORM_isTest are mixed-case on purpose — the
        # config loader only lowercases all-caps keys, so these land
        # onto config.name / config.type / config.isTest as written.
        env:
            NOORM_CONNECTION_DIALECT: postgres
            NOORM_CONNECTION_HOST: localhost
            NOORM_CONNECTION_PORT: '15432'
            NOORM_CONNECTION_USER: noorm_test
            NOORM_CONNECTION_PASSWORD: noorm_test
            NOORM_CONNECTION_DATABASE: todo_db_example_test
            NOORM_name: todo_db_example_test
            NOORM_type: remote
            NOORM_isTest: 'true'

        steps:
            - uses: actions/checkout@v4

            - uses: actions/setup-node@v4
              with:
                  node-version: '24'

            - uses: oven-sh/setup-bun@v2
              with:
                  bun-version: '1.3.11'

            - run: bun install --frozen-lockfile

            # Builds packages/cli/dist/index.js + packages/sdk/dist/index.js
            # via tsup. The wrapper below execs the CLI bundle; the tests
            # import the SDK bundle as @noormdev/sdk (workspace link).
            - run: bun run build:packages

            - name: Expose `noorm` CLI on PATH
              run: |
                  BIN_DIR="$GITHUB_WORKSPACE/.ci-bin"
                  mkdir -p "$BIN_DIR"
                  cat > "$BIN_DIR/noorm" <<EOF
                  #!/usr/bin/env bash
                  exec node "$GITHUB_WORKSPACE/packages/cli/dist/index.js" "\$@"
                  EOF
                  chmod +x "$BIN_DIR/noorm"
                  echo "$BIN_DIR" >> $GITHUB_PATH

            # ────────────────────────────────────────────────────────────
            # Bootstrap the example project the way a real CI pipeline
            # would. Every step below runs from examples/todo-db/ so the
            # CLI discovers the committed .noorm/settings.yml + sql/ +
            # changes/ and operates against the example's project root.
            # ────────────────────────────────────────────────────────────

            - name: noorm ci identity new  —  mint ephemeral keypair
              working-directory: examples/todo-db
              run: |
                  OUT=$(noorm ci identity new \
                      --name todo-db-ci \
                      --email ci@noorm.local \
                      --json)
                  PRIV=$(echo "$OUT" | jq -r '.data.privateKey // .privateKey')
                  # Mask the key in any subsequent log output, then export
                  # NOORM_IDENTITY_* so every later step (ci init, db *,
                  # change ff, bun test) can decrypt state.enc.
                  echo "::add-mask::$PRIV"
                  echo "NOORM_IDENTITY_PRIVATE_KEY=$PRIV" >> "$GITHUB_ENV"
                  echo "NOORM_IDENTITY_NAME=todo-db-ci" >> "$GITHUB_ENV"
                  echo "NOORM_IDENTITY_EMAIL=ci@noorm.local" >> "$GITHUB_ENV"

            - name: noorm ci init  —  bootstrap state.enc from env
              working-directory: examples/todo-db
              run: noorm ci init --name todo_db_example_test --force --json

            - name: noorm db create  —  create target database
              working-directory: examples/todo-db
              run: noorm db create --json

            - name: noorm db reset  —  teardown + rebuild schema + seeds
              working-directory: examples/todo-db
              run: noorm db reset --yes --json

            - name: noorm change ff  —  apply forward changes
              working-directory: examples/todo-db
              run: noorm change ff --yes --json

            # ────────────────────────────────────────────────────────────
            # SDK side. NOORM_TEST_PREBUILT=1 tells the test harness to
            # skip its tmp/ bootstrap and connect the SDK directly against
            # the state the steps above just produced. Any failure here is
            # a CLI↔SDK coordination failure, not a test-fixture bug.
            # ────────────────────────────────────────────────────────────

            - name: Run SDK integration tests against prebuilt schema
              working-directory: examples/todo-db
              env:
                  CI: 'false'
                  FORCE_COLOR: 'true'
                  NOORM_TEST_PREBUILT: '1'
              run: bun test

    # ───────────────────────────────────────────────────────────────────
    # examples/llm-memory-db-mssql is a second e2e target: a 38-table
    # LLM-memory schema on SQL Server 2022 that exercises the
    # MSSQL-specific surface — table-valued parameters, schema-bound
    # validators, role-scoped views, named-procedure calls — plus a
    # meta-test that drives `noorm mcp serve` end-to-end. Same shape as
    # example-todo-db: bootstrap state.enc with `noorm ci`, build the
    # schema, apply the committed change, then run the SDK suite.
    #
    # Two notable deviations from the todo-db pattern:
    #
    # 1. We use `noorm run build` instead of `noorm db reset` because
    #    schema-bound validator UDFs in `sql/03_validators/` lock the
    #    tables they reference, blocking the teardown step (gap #5 in
    #    examples/llm-memory-db-mssql/mssql-problems.md).
    #
    # 2. The test bootstrap is `config: 'test'` with `requireTest: true`,
    #    so the CI config must be named `test` and carry isTest=true.
    # ───────────────────────────────────────────────────────────────────
    example-llm-memory-db-mssql:
        runs-on: ubuntu-24.04
        needs: build

        services:
            mssql:
                image: mcr.microsoft.com/mssql/server:2022-latest
                ports:
                    - 11433:1433
                env:
                    ACCEPT_EULA: 'Y'
                    SA_PASSWORD: 'NoOrm_Test123!'
                    MSSQL_PID: Developer
                options: >-
                    --health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P 'NoOrm_Test123!' -C -Q 'SELECT 1' || exit 1"
                    --health-interval 10s
                    --health-timeout 5s
                    --health-retries 10
                    --health-start-period 30s

        # Job-level env shared by every CLI step + the SDK test process.
        # NOORM_name=test + NOORM_isTest=true line up with the
        # `config: 'test', requireTest: true` call in
        # examples/llm-memory-db-mssql/tests/helpers/test-context.ts.
        env:
            NOORM_CONNECTION_DIALECT: mssql
            NOORM_CONNECTION_HOST: localhost
            NOORM_CONNECTION_PORT: '11433'
            NOORM_CONNECTION_USER: SA
            NOORM_CONNECTION_PASSWORD: 'NoOrm_Test123!'
            NOORM_CONNECTION_DATABASE: noorm_llm_test
            NOORM_name: test
            NOORM_type: remote
            NOORM_isTest: 'true'

        steps:
            - uses: actions/checkout@v4

            - uses: actions/setup-node@v4
              with:
                  node-version: '24'

            - uses: oven-sh/setup-bun@v2
              with:
                  bun-version: '1.3.11'

            - run: bun install --frozen-lockfile
            - run: bun run build:packages

            - name: Expose `noorm` CLI on PATH
              run: |
                  BIN_DIR="$GITHUB_WORKSPACE/.ci-bin"
                  mkdir -p "$BIN_DIR"
                  cat > "$BIN_DIR/noorm" <<EOF
                  #!/usr/bin/env bash
                  exec node "$GITHUB_WORKSPACE/packages/cli/dist/index.js" "\$@"
                  EOF
                  chmod +x "$BIN_DIR/noorm"
                  echo "$BIN_DIR" >> $GITHUB_PATH

            - name: noorm ci identity new  —  mint ephemeral keypair
              working-directory: examples/llm-memory-db-mssql
              run: |
                  OUT=$(noorm ci identity new \
                      --name llm-memory-db-mssql-ci \
                      --email ci@noorm.local \
                      --json)
                  PRIV=$(echo "$OUT" | jq -r '.data.privateKey // .privateKey')
                  echo "::add-mask::$PRIV"
                  echo "NOORM_IDENTITY_PRIVATE_KEY=$PRIV" >> "$GITHUB_ENV"
                  echo "NOORM_IDENTITY_NAME=llm-memory-db-mssql-ci" >> "$GITHUB_ENV"
                  echo "NOORM_IDENTITY_EMAIL=ci@noorm.local" >> "$GITHUB_ENV"

            - name: noorm ci init  —  bootstrap state.enc from env
              working-directory: examples/llm-memory-db-mssql
              run: noorm ci init --name test --force --json

            - name: noorm db create  —  create target database
              working-directory: examples/llm-memory-db-mssql
              run: noorm db create --json

            - name: noorm run build  —  build schema (types, tables, validators, views, procs)
              working-directory: examples/llm-memory-db-mssql
              run: noorm run build --json

            - name: noorm change ff  —  apply forward changes
              working-directory: examples/llm-memory-db-mssql
              run: noorm change ff --yes --json

            - name: Typecheck example
              working-directory: examples/llm-memory-db-mssql
              run: bun run typecheck

            - name: Run example test suite
              working-directory: examples/llm-memory-db-mssql
              env:
                  CI: 'false'
                  FORCE_COLOR: 'true'
              run: bun test

    cli-e2e:
        runs-on: ubuntu-24.04
        needs: build
        steps:
            - uses: actions/checkout@v4

            - uses: actions/setup-node@v4
              with:
                  node-version: '24'

            - uses: oven-sh/setup-bun@v2
              with:
                  bun-version: '1.3.11'

            - run: bun install --frozen-lockfile
            - run: bun run build

            # Test: Valid SQL should build successfully (exit 0)
            - name: Test valid SQL build
              env:
                  NOORM_CONNECTION_DIALECT: sqlite
                  NOORM_CONNECTION_DATABASE: ./tmp/ci-success.db
                  NOORM_PATHS_SQL: ./tests/fixtures/ci/success/sql
                  NOORM_IDENTITY: ci
              run: |
                  mkdir -p ./tmp
                  node dist/cli/index.js -H run build
                  echo "Success: Valid SQL built successfully"

            # Test: Invalid SQL should fail (exit 2)
            - name: Test invalid SQL build (expect failure)
              env:
                  NOORM_CONNECTION_DIALECT: sqlite
                  NOORM_CONNECTION_DATABASE: ./tmp/ci-failure.db
                  NOORM_PATHS_SQL: ./tests/fixtures/ci/failure/sql
                  NOORM_IDENTITY: ci
              run: |
                  mkdir -p ./tmp
                  set +e
                  node dist/cli/index.js -H run build
                  EXIT_CODE=$?
                  set -e
                  if [ $EXIT_CODE -eq 2 ]; then
                      echo "Success: CLI correctly returned exit code 2 for failed build"
                  else
                      echo "Failure: Expected exit code 2, got $EXIT_CODE"
                      exit 1
                  fi