ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_call:
    inputs:
      ref:
        description: Git ref to test (defaults to current SHA)
        required: false
        type: string

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  harness:
    name: Generator harness (pytest)
    runs-on: ubuntu-latest
    # The suite runs ~8-10 min on an M-series Mac but exceeded 30 min on a
    # GitHub x64 runner: every pgn generate/analyse call pays the
    # single-threaded Dhall normalization cost, and the suite makes about
    # ten of them.
    timeout-minutes: 60

    services:
      postgres:
        image: postgres:18
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      PGN_TEST_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres?sslmode=disable

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.ref || github.sha }}

      # pgn generation has exceeded the hosted runner's stock memory on this
      # suite. Keep extra swap as evaluator and GC headroom. /swapfile is taken
      # by the image's stock swap, so the extra file goes on /mnt.
      - name: Add swap headroom for pgn generate
        shell: bash
        run: |
          set -euo pipefail

          sudo fallocate -l 12G /mnt/swapfile
          sudo chmod 600 /mnt/swapfile
          sudo mkswap /mnt/swapfile
          sudo swapon /mnt/swapfile
          free -h

      - name: Install mise-managed tools
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0

      - name: Assert the pinned pgn version
        shell: bash
        run: |
          set -euo pipefail

          version="$(mise x -- pgn --version)"
          if [[ "$version" != "0.12.0" ]]; then
            echo "::error::Expected pgn 0.12.0 (mise.toml pin), got '$version'."
            exit 1
          fi

      - name: Sync the harness venv
        run: mise run install

      - name: Lint the harness and committed generated package
        run: mise run lint

      # Hosted runners cannot fit a full 7-artifact pgn generate (~31 GB peak
      # RSS measured locally); keep only the "python" artifact for this CI
      # checkout. The config-variant tests that need the other artifacts skip
      # under HARNESS_CI_REDUCED=1 and stay covered by local runs.
      - name: Reduce the fixture project to the python artifact
        shell: bash
        run: |
          set -euo pipefail

          mise exec -- python - <<'EOF'
          from pathlib import Path

          p = Path("tests/fixture-project/project1.pgn.yaml")
          head, sep, _ = p.read_text().partition("  # The variants below")
          assert sep, "variants marker not found in project1.pgn.yaml"
          _ = p.write_text(head.rstrip() + "\n")
          EOF
          cat tests/fixture-project/project1.pgn.yaml

      - name: Run the generator harness tests
        env:
          PYTHONUNBUFFERED: "1"
          HARNESS_CI_REDUCED: "1"
        run: mise x -- uv run pytest tests -v --durations=10

  contract:
    name: Generator contract (Exhaustive fixture)
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.ref || github.sha }}

      # Use the pinned directory-tree action for the same reproducible contract
      # evaluation path used by release validation.
      - name: Generate output from Dhall
        uses: nikita-volkov/dhall-directory-tree.github-action@60a18dc647d6daea805263ea0fed7bb8011f3bcd # v2
        with:
          dhall_file: fixtures/Exhaustive.dhall
          output_dir: contract-output

      - name: Assert the compile did not fail
        shell: bash
        run: |
          set -euo pipefail

          if [[ -f contract-output/error.yaml ]]; then
            echo "::error::Generator reported a hard failure (onUnsupported: Skip should have prevented this)."
            cat contract-output/error.yaml
            exit 1
          fi

          if [[ -f contract-output/warnings.yaml ]]; then
            echo "::notice::Generator emitted warnings (expected: the Exhaustive fixture covers PG types this generator does not support, dropped under onUnsupported: Skip)."
            cat contract-output/warnings.yaml
          fi

      - name: Build a synthetic consumer shell
        run: .github/scripts/build-contract-shell.sh contract-output contract-shell

      - name: Install mise-managed tools
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0

      - name: Create a venv and install contract tools
        run: |
          set -euo pipefail

          mise exec -- uv venv contract-shell/.venv
          mise exec -- uv pip install --python contract-shell/.venv/bin/python \
            "psycopg[binary]>=3.3.4,<4" \
            "basedpyright==1.39.9" \
            "ruff==0.15.20"

      - name: Ruff check the generated package
        shell: bash
        run: |
          set -euo pipefail

          mise exec -- contract-shell/.venv/bin/ruff check \
            --config "$PWD/pyproject.toml" \
            contract-shell/src
          mise exec -- contract-shell/.venv/bin/ruff format --check \
            --config "$PWD/pyproject.toml" \
            contract-shell/src

      - name: basedpyright strict on the generated package
        shell: bash
        run: |
          set -euo pipefail

          cat > contract-pyrightconfig.json <<'JSON'
          {
            "pythonVersion": "3.12",
            "typeCheckingMode": "strict",
            "include": ["contract-shell/src"],
            "venvPath": "contract-shell",
            "venv": ".venv",
            "reportMissingModuleSource": false
          }
          JSON

          output="$(mise exec -- contract-shell/.venv/bin/basedpyright --project contract-pyrightconfig.json --outputjson)" || true
          echo "$output" | jq .

          files=$(jq '.summary.filesAnalyzed' <<<"$output")
          errors=$(jq '.summary.errorCount' <<<"$output")
          warnings=$(jq '.summary.warningCount' <<<"$output")

          if [[ "$files" -eq 0 ]]; then
            echo "::error::basedpyright analyzed no files; bad include path?"
            exit 1
          fi
          if [[ "$errors" -ne 0 || "$warnings" -ne 0 ]]; then
            echo "::error::basedpyright strict reported issues (errors=$errors warnings=$warnings)."
            exit 1
          fi