ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    # Default types are opened/synchronize/reopened, which miss title-only
    # edits entirely. labeled/unlabeled added so changing the prerelease:*
    # label alone re-triggers the version-suggestion job below.
    types: [opened, edited, reopened, synchronize, labeled, unlabeled]
  schedule:
    # Weekly cargo-audit sweep to catch newly-disclosed CVEs in deps that
    # haven't otherwise changed. Off-peak minute, not :00/:30.
    - cron: "17 6 * * 1"

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Build
        run: cargo build

      - name: Run tests
        # --lib --bins excludes tests/live_db.rs: that's a live-database
        # integration test requiring a running PostgreSQL instance, covered
        # by the dedicated live-db-integration job below.
        run: cargo test --lib --bins

      - name: Clippy
        run: cargo clippy --all-targets -- -D warnings

      - name: Check formatting
        run: cargo fmt --all -- --check

  validate-manifest:
    name: Validate .tabularium manifest
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Validate against the live registry schema
        run: npx --yes @tabularium/cli validate .tabularium --registry https://registry.tabularis.dev --kind driver

  pr-title:
    name: PR title (Conventional Commits)
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    steps:
      - uses: amannn/action-semantic-pull-request@v6
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  version-suggestion:
    name: Version suggestion
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      # Classify the PR title's Conventional Commits type + breaking-change
      # flag into a version-bump class. Requires the prerelease:* label to
      # know which channel (alpha/beta/rc/stable) to suggest — see README's
      # "Contributing: PR Titles & Versioning" for the full convention.
      - name: Classify PR title and resolve prerelease channel
        id: classify
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
          PR_BODY: ${{ github.event.pull_request.body }}
          PR_LABELS: ${{ toJson(github.event.pull_request.labels) }}
        run: |
          PATTERN='^([a-zA-Z]+)(\(([^)]+)\))?(!)?: (.+)$'
          if [[ "$PR_TITLE" =~ $PATTERN ]]; then
            TYPE="${BASH_REMATCH[1]}"
            BANG="${BASH_REMATCH[4]}"
          else
            echo "::error::PR title does not match Conventional Commits format (type: subject) — cannot classify."
            exit 1
          fi

          BREAKING=false
          [ -n "$BANG" ] && BREAKING=true
          if echo "$PR_BODY" | grep -qiE "^BREAKING[ -]CHANGE:"; then
            BREAKING=true
          fi

          case "$TYPE" in
            feat) CLASS=minor ;;
            fix|refactor|perf) CLASS=patch ;;
            docs|style|chore|test|ci|build) CLASS=none ;;
            *) CLASS=none ;;
          esac
          [ "$BREAKING" = true ] && CLASS=major

          CHANNEL=$(echo "$PR_LABELS" | jq -r '[.[] | select(.name | startswith("prerelease:")) | .name][0] // ""' | sed 's/^prerelease://')
          if [ -z "$CHANNEL" ]; then
            echo "::error::No prerelease:alpha|beta|rc|stable label found on this PR. Add one so the version suggestion knows which channel to target — see README's 'Contributing: PR Titles & Versioning'."
            exit 1
          fi
          case "$CHANNEL" in
            alpha|beta|rc|stable) ;;
            *) echo "::error::Unrecognized prerelease label value '$CHANNEL' — expected alpha, beta, rc, or stable."; exit 1 ;;
          esac

          echo "type=$TYPE" >> "$GITHUB_OUTPUT"
          echo "breaking=$BREAKING" >> "$GITHUB_OUTPUT"
          echo "class=$CLASS" >> "$GITHUB_OUTPUT"
          echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"

      - name: Resolve baseline version
        id: baseline
        run: |
          git fetch origin main --tags --quiet
          TAG=$(git -C . describe --tags --abbrev=0 origin/main 2>/dev/null || true)
          if [ -n "$TAG" ]; then
            BASELINE="${TAG#v}"
          else
            BASELINE=$(git show origin/main:.tabularium | jq -r .version)
          fi
          echo "version=$BASELINE" >> "$GITHUB_OUTPUT"

      - name: Compute suggestion, manage comment
        uses: actions/github-script@v9
        with:
          script: |
            const classification = "${{ steps.classify.outputs.class }}";
            const channel = "${{ steps.classify.outputs.channel }}";
            const type = "${{ steps.classify.outputs.type }}";
            const breaking = "${{ steps.classify.outputs.breaking }}" === "true";
            const baselineStr = "${{ steps.baseline.outputs.version }}";
            const marker = "<!-- version-suggestion-bot";

            function parseVersion(v) {
              const m = v.match(/^(\d+)\.(\d+)\.(\d+)(?:-([a-zA-Z]+)\.(\d+))?$/);
              if (!m) throw new Error(`Cannot parse version: ${v}`);
              return {
                major: Number(m[1]), minor: Number(m[2]), patch: Number(m[3]),
                stage: m[4] || null, stageNum: m[5] ? Number(m[5]) : null,
              };
            }
            function formatVersion(v) {
              const base = `${v.major}.${v.minor}.${v.patch}`;
              return v.stage ? `${base}-${v.stage}.${v.stageNum}` : base;
            }
            function bumpStable(v, cls) {
              const out = { major: v.major, minor: v.minor, patch: v.patch, stage: null, stageNum: null };
              if (cls === "major") { out.major += 1; out.minor = 0; out.patch = 0; }
              else if (cls === "minor") { out.minor += 1; out.patch = 0; }
              else if (cls === "patch") { out.patch += 1; }
              return out;
            }
            function computeNextVersion(baselineStr, classification, channelLabel) {
              const baseline = parseVersion(baselineStr);
              if (channelLabel === "stable") {
                if (baseline.stage) {
                  return formatVersion({ major: baseline.major, minor: baseline.minor, patch: baseline.patch, stage: null, stageNum: null });
                }
                return formatVersion(bumpStable(baseline, classification));
              }
              if (baseline.stage === channelLabel) {
                return formatVersion({ ...baseline, stageNum: baseline.stageNum + 1 });
              }
              let base = { major: baseline.major, minor: baseline.minor, patch: baseline.patch };
              if (!baseline.stage) {
                const bumped = bumpStable(baseline, classification);
                base = { major: bumped.major, minor: bumped.minor, patch: bumped.patch };
              }
              return formatVersion({ ...base, stage: channelLabel, stageNum: 1 });
            }

            const prNumber = context.payload.pull_request.number;

            // Find our most recent, not-yet-minimized comment on this PR.
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: prNumber,
              per_page: 100,
            });
            const ours = comments.filter(c => c.body.includes(marker));
            const previous = ours.length ? ours[ours.length - 1] : null;

            let previousClassification = null;
            if (previous) {
              const m = previous.body.match(/classification=([\w-]+:[\w-]+:[\w-]+)/);
              previousClassification = m ? m[1] : null;
            }
            const currentClassification = `${type}:${classification}:${channel}`;

            if (classification === "none") {
              if (previous && previousClassification !== currentClassification) {
                // Was suggesting something (or saying "none" for a different
                // reason/channel), now saying "none" for this reason — say so
                // once, then stop.
                await minimizePrevious();
                await github.rest.issues.createComment({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: prNumber,
                  body: `No release needed for this PR (\`${type}\`).\n\n${marker} classification=${currentClassification} -->`,
                });
              }
              // Otherwise: never suggested anything, or already said "none" — stay silent.
              return;
            }

            if (previous && previousClassification === currentClassification) {
              // Meaningful classification hasn't changed since the last comment.
              return;
            }

            async function minimizePrevious() {
              if (!previous) return;
              // REST comment objects expose node_id directly — no separate
              // lookup needed to get the GraphQL node id.
              await github.graphql(
                `mutation($id: ID!) { minimizeComment(input: { subjectId: $id, classifier: OUTDATED }) { clientMutationId } }`,
                { id: previous.node_id }
              );
            }

            const suggested = computeNextVersion(baselineStr, classification, channel);
            const tag = `v${suggested}`;

            await minimizePrevious();

            const breakingNote = breaking ? " (breaking change)" : "";
            const body = [
              `### Version suggestion`,
              ``,
              `Based on this PR's title (\`${type}\`${breakingNote}) and the \`prerelease:${channel}\` label:`,
              ``,
              `| | |`,
              `|---|---|`,
              `| Current | \`${baselineStr}\` |`,
              `| Suggested next tag | \`${tag}\` |`,
              ``,
              `This is informational only — no tag or release is created automatically yet.`,
              ``,
              `${marker} classification=${currentClassification} -->`,
            ].join("\n");

            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: prNumber,
              body,
            });

  markdownlint:
    name: Markdown lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Run markdownlint
        run: npx --yes markdownlint-cli "**/*.md"

  audit:
    name: Security audit
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
      # rustsec/audit-check only files a tracking issue for informational
      # warnings (e.g. "unmaintained") on cron-scheduled runs, not push/PR
      # runs — which is why this permission gap went unnoticed until the
      # first scheduled run hit an unmaintained-crate warning.
      issues: write
    steps:
      - uses: actions/checkout@v7

      - uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # RUSTSEC-2026-0235: vulnerable rkyv 0.7.46, pulled in transitively
          # by rust_decimal's own optional "rkyv" feature declaration in its
          # Cargo.toml — we never enable that feature (only "db-tokio-postgres"
          # and "serde"), and confirmed no rkyv symbols are linked into the
          # release binary (`nm -D target/release/postgresql-plugin | grep
          # rkyv` — no output). cargo-audit scans the full Cargo.lock graph
          # regardless of which optional features are active, so this is a
          # lockfile-only entry with no reachable code path in what we ship.
          # Re-check this ignore whenever rust_decimal is upgraded, in case a
          # newer release changes what's declared as optional.
          ignore: RUSTSEC-2026-0235

  live-db-integration:
    name: Live PostgreSQL integration
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        ports:
          - 54320:5432
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: password
          POSTGRES_DB: testdb
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@v7

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Build
        run: cargo build

      - name: Run live-database integration test
        env:
          POSTGRES_PLUGIN_BIN: ${{ github.workspace }}/target/debug/postgresql-plugin
          PGHOST: 127.0.0.1
          PGPORT: 54320
          PGUSER: postgres
          PGPASSWORD: password
          PGDATABASE: testdb
        run: cargo test --test live_db -- --test-threads=1