ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  HUSKY: 0

# set default permissions for the entire workflow
permissions:
  contents: read

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
      - name: Enable pnpm
        run: corepack enable
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Check code quality
        run: pnpm run check
      - name: Audit dependencies
        run: pnpm run audit:deps

  fallow:
    name: Fallow
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
      - name: Enable pnpm
        run: corepack enable
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Run fallow check
        run: npx fallow dead-code

  spec-consistency:
    name: Spec Consistency
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Check spec matches website
        run: |
          curl -sL \
            https://raw.githubusercontent.com/idempot-dev/website/main/docs/specs/idempotency.feature \
            -o /tmp/website.feature
          tail -n +5 tests/spec/idempotency.feature > /tmp/local.feature
          diff /tmp/local.feature /tmp/website.feature || {
            echo "::error::Spec file diverged from website. Run: pnpm run spec:sync"
            exit 1
          }

  test:
    name: Test (Node.js ${{ matrix.node-version }})
    needs: [lint, commitlint, fallow, spec-consistency]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: ["22", "24"]
    services:
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: idempot
          POSTGRES_PASSWORD: idempot
          POSTGRES_DB: test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U idempot"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      mysql:
        image: mysql:8
        env:
          MYSQL_ROOT_PASSWORD: rootpass
          MYSQL_USER: idempot
          MYSQL_PASSWORD: idempot
          MYSQL_DATABASE: test
        ports:
          - 3306:3306
        options: >-
          --health-cmd "mysqladmin ping -h localhost"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ matrix.node-version }}
      - name: Enable pnpm
        run: corepack enable
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Set environment variables
        run: |
          echo "PGHOST=localhost" >> $GITHUB_ENV
          echo "PGPORT=5432" >> $GITHUB_ENV
          echo "PGUSER=idempot" >> $GITHUB_ENV
          echo "PGPASSWORD=idempot" >> $GITHUB_ENV
          echo "PGDATABASE=test" >> $GITHUB_ENV
          echo "MYSQL_HOST=localhost" >> $GITHUB_ENV
          echo "MYSQL_PORT=3306" >> $GITHUB_ENV
          echo "MYSQL_USER=idempot" >> $GITHUB_ENV
          echo "MYSQL_PASSWORD=idempot" >> $GITHUB_ENV
          echo "MYSQL_DATABASE=test" >> $GITHUB_ENV
      - name: Run tests with coverage verification
        run: pnpm run test:verify-coverage

  commitlint:
    name: Commitlint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
      - name: Enable pnpm
        run: corepack enable
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Validate commit messages
        run: pnpm exec commitlint --from origin/main --to HEAD

  bun:
    name: Bun
    needs: [lint, commitlint, fallow]
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: idempot
          POSTGRES_PASSWORD: idempot
          POSTGRES_DB: test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U idempot"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      mysql:
        image: mysql:8
        env:
          MYSQL_ROOT_PASSWORD: rootpass
          MYSQL_USER: idempot
          MYSQL_PASSWORD: idempot
          MYSQL_DATABASE: test
        ports:
          - 3306:3306
        options: >-
          --health-cmd "mysqladmin ping -h localhost"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: latest
      - name: Enable pnpm
        run: corepack enable
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Run Bun tests
        run: pnpm run test:bun
      - name: Run Bun SQL integration tests
        run: bun test tests/runtime/bun/bun-sql-integration.test.js

  deno:
    name: Deno
    needs: [lint, commitlint, fallow]
    runs-on: ubuntu-latest
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
      - name: Enable pnpm
        run: corepack enable
      - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
        with:
          deno-version: v2.x
      - name: Run Deno tests
        run: pnpm run test:deno

  spec-compliance:
    name: Spec Compliance (Cucumber)
    needs: [spec-consistency, lint, commitlint]
    runs-on: ubuntu-latest
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
      - name: Enable pnpm
        run: corepack enable
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Run cucumber spec tests
        run: pnpm run test:spec

  validate-workflows:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
        with:
          advanced-security: false
          annotations: true