ci.yml

# SPDX-FileCopyrightText: 2026 Quality Runtime contributors
# SPDX-License-Identifier: Apache-2.0

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    services:
      # The version `docs/development.md` tells a developer to run, and the one
      # the concurrency suite has actually been exercised against.
      postgres:
        image: postgres:18
        env:
          POSTGRES_PASSWORD: postgres
          # The suite wipes this database, and refuses a name not ending `_test`.
          POSTGRES_DB: qualityruntime_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
      - run: bun install --frozen-lockfile
      - run: bun run check
      # MinIO is a step rather than a service because the image needs a command
      # of its own, which `services:` cannot give it. The client is a second
      # image for the reason `docs/development.md` gives: the server image is
      # not guaranteed to carry one.
      #
      # From quay.io and pinned, both deliberately — `docs/development.md`
      # says why, and changing either of these without reading it is how CI
      # stops being able to pull a store at all.
      - name: Start an S3-compatible store
        run: |
          docker run -d --name qualityruntime-storage -p 9000:9000 \
            -e MINIO_ROOT_USER=qualityruntime -e MINIO_ROOT_PASSWORD=qualityruntime \
            quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z server /data
          # `if` rather than `curl … && break`: a failing poll inside a `&&`
          # list is the whole command failing, and the step runs under `set -e`.
          ready=
          for attempt in $(seq 1 30); do
            if curl -sf http://localhost:9000/minio/health/live >/dev/null; then
              ready=yes
              break
            fi
            sleep 1
          done
          if [ -z "$ready" ]; then
            echo "The store never became ready."
            docker logs qualityruntime-storage
            exit 1
          fi
          docker run --rm --network host --entrypoint sh quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z -c \
            "mc alias set local http://localhost:9000 qualityruntime qualityruntime \
             && mc mb --ignore-existing local/qualityruntime"
      # PGlite runs PostgreSQL in-process and an S3 answering in memory stands
      # in for a bucket, so almost nothing here needs either of the above. The
      # exceptions are the two suites that cannot be honest without them: the
      # concurrency suite, because PGlite is a single connection and a lock
      # cannot be exercised on one (ADR 0020), and the storage integration
      # suite, because a signature is only correct if a real server says so
      # (ADR 0021). Without these a change breaking either would pass CI.
      - run: bun run test
        env:
          TEST_DATABASE_URL: postgres://postgres:postgres@localhost:5432/qualityruntime_test
          TEST_STORAGE_ENDPOINT: http://localhost:9000
          TEST_STORAGE_BUCKET: qualityruntime
          TEST_STORAGE_ACCESS_KEY_ID: qualityruntime
          TEST_STORAGE_SECRET_ACCESS_KEY: qualityruntime

  dco:
    # Trust is PR-level: the GitHub App is the only identity that can open a PR
    # as itself. Commit author fields are self-reported and must not gate this.
    if: >
      github.event_name == 'pull_request' &&
      github.event.pull_request.user.login != 'quality-runtime[bot]'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Check Developer Certificate of Origin sign-off
        env:
          BASE: ${{ github.event.pull_request.base.sha }}
          HEAD: ${{ github.event.pull_request.head.sha }}
        run: |
          # Fail loudly rather than passing an unchecked range if either end
          # of the range is missing (e.g. an unexpected fork checkout).
          for end in "$BASE" "$HEAD"; do
            git cat-file -e "$end^{commit}" 2>/dev/null || {
              echo "Cannot resolve $end in this checkout"
              exit 1
            }
          done
          status=0
          for sha in $(git rev-list --no-merges "$BASE..$HEAD"); do
            if ! git log -1 --format='%B' "$sha" | grep -qiE '^Signed-off-by: .+ <.+@.+>'; then
              echo "Missing Signed-off-by: $(git log -1 --format='%h %s' "$sha")"
              status=1
            fi
          done
          exit $status