name: CI

on:
  pull_request:
  push:
    branches: [main]

jobs:
  frozen-install:
    name: Frozen lockfile install
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Node.js 24
        uses: actions/setup-node@v4
        with:
          node-version: '24'
      - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
        run: corepack enable
      - name: Install dependencies (frozen lockfile)
        run: pnpm install --frozen-lockfile
      - name: Verify workspace groups
        run: pnpm -r list --depth -1

  # E00-S02-T08: the static assertions of tests/secrets-not-embedded.test.mjs
  # gate every PR (the docker-gated layer-scan probe inside the same file runs
  # where a Docker daemon is available and skips cleanly otherwise).
  secrets-not-embedded:
    name: Secrets not embedded (E00-S02-T08)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Node.js 24
        uses: actions/setup-node@v4
        with:
          node-version: '24'
      - name: Run secrets-not-embedded test suite
        run: node --test tests/secrets-not-embedded.test.mjs

  # E00-S03-T02: the static assertions of tests/database-postgres-imports.test.mjs
  # gate every PR — the scan proves pg/Kysely imports live only in
  # packages/database-postgres and the mutation probes prove the scan catches
  # a driver import injected into any other package.
  database-postgres-imports:
    name: Database-postgres import isolation (E00-S03-T02)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Node.js 24
        uses: actions/setup-node@v4
        with:
          node-version: '24'
      - name: Run database-postgres import isolation suite
        run: node --test tests/database-postgres-imports.test.mjs

  # E00-S03-T03: the static assertions of tests/database-postgres-ledger.test.mjs
  # gate every PR — the suite locks in the migration ledger (schema_migrations
  # table DDL, idempotent parameterized record, driver-boundary re-export)
  # with mutation probes, and the docker-gated real-stack probe (migrate an
  # empty database and confirm the ledger exists) runs where a Docker daemon
  # is available and skips cleanly otherwise. The job installs the frozen
  # workspace because the real-stack probe executes the committed ledger
  # module from the host (it imports `pg` through the package's own links).
  database-postgres-ledger:
    name: Migration ledger (E00-S03-T03)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Node.js 24
        uses: actions/setup-node@v4
        with:
          node-version: '24'
      - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
        run: corepack enable
      - name: Install dependencies (frozen lockfile)
        run: pnpm install --frozen-lockfile
      - name: Run migration ledger test suite
        run: node --test tests/database-postgres-ledger.test.mjs

  # E00-S03-T04: the static assertions of tests/database-postgres-lock.test.mjs
  # gate every PR — the suite locks in the migration advisory lock (session-
  # scoped pg_advisory_lock/pg_try_advisory_lock over a stable keyed hash on a
  # dedicated connection, re-entrant-safe in-flight acquire so concurrent
  # acquire() calls share one connection, driver-boundary re-export) with
  # mutation probes, and the docker-gated real-stack concurrent probe (a
  # second runner waits or fails while the first holds the lock; concurrent
  # acquire() checks out exactly one connection; the lock releases when the
  # holding session ends) runs where a Docker daemon is available and skips
  # cleanly otherwise. The job installs the frozen workspace because the
  # real-stack probe executes the committed lock module from the host (it
  # imports `pg` through the package's own links).
  database-postgres-lock:
    name: Migration advisory lock (E00-S03-T04)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Node.js 24
        uses: actions/setup-node@v4
        with:
          node-version: '24'
      - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
        run: corepack enable
      - name: Install dependencies (frozen lockfile)
        run: pnpm install --frozen-lockfile
      - name: Run migration advisory lock test suite
        run: node --test tests/database-postgres-lock.test.mjs

  # E00-S03-T01: the static assertions of tests/compose-config.test.mjs (db
  # image pinned to postgres:18.6-bookworm, health gate, volume persistence,
  # build platforms) gate every PR (the docker-gated real-stack probes inside
  # the same file run where a Docker daemon is available and skip cleanly
  # otherwise).
  compose-config:
    name: Compose config (E00-S03-T01)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Node.js 24
        uses: actions/setup-node@v4
        with:
          node-version: '24'
      - name: Run compose-config test suite
        run: node --test tests/compose-config.test.mjs