api-contract-tests.yml

name: API Contract Tests

# This workflow tests your API against the OpenAPI spec using Schemathesis.
# It only runs the "examples" phase (fast & deterministic).
# For thorough fuzzing, run locally: make schemathesis

on:
  pull_request:
    paths:
      - '**.go'
      - 'go.mod'
      - 'go.sum'
      - 'openapi.yaml'
      - 'cmd/**'
      - 'internal/**'
      - 'pkg/**'
      - '.github/workflows/api-contract-tests.yml'

concurrency:
  group: api-contract-tests-${{ github.head_ref }}
  cancel-in-progress: true

jobs:
  api-contract-tests:
    name: API Contract Tests
    runs-on: ubuntu-24.04
    timeout-minutes: 10

    services:
      postgres:
        image: pgvector/pgvector:pg18
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: test_db
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      DATABASE_URL: postgres://postgres:postgres@localhost:5432/test_db?sslmode=disable
      API_KEY: test-api-key-for-ci
      PORT: 8080

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: '1.26.3'

      - name: Cache Go modules
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Install dependencies
        run: go mod download

      - name: Install goose
        run: go install github.com/pressly/goose/v3/cmd/goose@v3.27.1

      - name: Validate migrations
        run: make migrate-validate

      - name: Initialize database schema
        run: make init-db

      - name: Run River migrations
        run: |
          go install github.com/riverqueue/river/cmd/river@v0.35.0
          make river-migrate

      - name: Build application
        run: make build

      - name: Start API server
        run: |
          ./bin/hub-api &
          API_PID=$!
          echo "API_PID=$API_PID" >> $GITHUB_ENV

          # Wait for server to be healthy (up to ~60s)
          for i in {1..30}; do
            if curl -s http://localhost:8080/health | grep -q "OK"; then
              echo "Server is ready"
              break
            fi
            echo "Waiting for server... ($i/30)"
            sleep 2
          done

          # Verify we actually became ready
          if ! curl -s http://localhost:8080/health | grep -q "OK"; then
            echo "Server failed to start. Checking logs..."
            ps aux | grep api || true
            exit 1
          fi

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.13'

      - name: Install Schemathesis
        run: python -m pip install schemathesis==4.4.4

      - name: Run API contract tests
        env:
          SCHEMATHESIS_BASE_URL: http://localhost:8080
          SCHEMATHESIS_WAIT_FOR_SCHEMA: '2'
        run: |
          schemathesis run ./openapi.yaml \
            --generation-database=:memory: \
            --max-examples=100 \
            --checks=not_a_server_error,status_code_conformance,content_type_conformance,response_schema_conformance \
            --phases examples \
            -H "Authorization: Bearer test-api-key-for-ci" \
            --exclude-operation-id semantic-search-feedback-records \
            --exclude-operation-id similar-feedback-records

      - name: Run API contract tests (search endpoints)
        env:
          SCHEMATHESIS_BASE_URL: http://localhost:8080
          SCHEMATHESIS_WAIT_FOR_SCHEMA: '2'
        run: |
          schemathesis run ./openapi.yaml \
            --generation-database=:memory: \
            --max-examples=100 \
            --checks=status_code_conformance,content_type_conformance,response_schema_conformance \
            --phases examples \
            -H "Authorization: Bearer test-api-key-for-ci" \
            --include-operation-id semantic-search-feedback-records \
            --include-operation-id similar-feedback-records

      - name: Stop API server
        if: always()
        run: |
          if [ ! -z "$API_PID" ]; then
            kill $API_PID || true
          fi
          pkill -f "./bin/hub-api" || true