syncstorage-rs/.github/workflows/postgres.yml

name: Postgres Build and Test

on:
  pull_request:
    types: [opened, synchronize]
  push:
    branches:
      - "**"
    tags:
      - "**"
  workflow_dispatch: {}

env:
  RUST_VERSION: "1.91"
  PYTHON_VERSION: "3.12"

permissions: {} # workflow-level default — deny all

jobs:
  build-and-test-postgres:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write

    services:
      postgres:
        image: postgres:18.0
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: syncstorage
        ports:
          - 5432:5432
        options: >-
          --health-cmd="pg_isready -U test"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5

    env:
      SYNC_SYNCSTORAGE__DATABASE_URL: postgres://test:test@127.0.0.1/syncstorage
      SYNC_TOKENSERVER__DATABASE_URL: postgres://test:test@127.0.0.1/tokenserver
      SYNC_TOKENSERVER__NODE_TYPE: postgres
      RUST_BACKTRACE: 1
      RUST_TEST_THREADS: 1

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-rust
        with:
          workspace-path: workflow/test-results

      - uses: ./.github/actions/setup-python
        with:
          workspace-path: workflow/test-results

      - name: Install PostgreSQL client
        run: sudo apt-get update && sudo apt-get install -y postgresql-client

      - name: Create Tokenserver database
        run: |
          PGPASSWORD=test psql -U test -h 127.0.0.1 -d syncstorage -c 'CREATE DATABASE tokenserver;'

      - name: Create version.json
        run: |
          printf '{"commit":"%s","version":"%s","source":"https://github.com/%s/%s","build":"%s"}\n' \
            "${GITHUB_SHA}" \
            "${GITHUB_REF_NAME}" \
            "${GITHUB_REPOSITORY_OWNER}" \
            "${GITHUB_REPOSITORY_NAME}" \
            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
            > version.json
        env:
          GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}

      - name: Install cargo-nextest
        run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin

      - name: Install cargo-llvm-cov
        run: cargo install --locked cargo-llvm-cov

      - name: Run unit tests with coverage
        run: make postgres_test_with_coverage

      - name: Run unit tests with coverage (quota enforced)
        run: make postgres_test_with_coverage
        env:
          SYNC_SYNCSTORAGE__ENFORCE_QUOTA: 1

      - name: Run Postgres utils tests
        working-directory: tools/postgres
        run: |
          poetry install --no-interaction --no-ansi
          WORKFLOW=$(echo "${GITHUB_WORKFLOW}" | tr ' ' '-' | tr '[:upper:]' '[:lower:]')
          poetry run pytest test_purge_ttl.py -v --junit-xml="../../workflow/test-results/${GITHUB_RUN_NUMBER}__$(date +%s)__$(basename ${GITHUB_REPOSITORY})__${WORKFLOW}__postgres_utils__results.xml"
        env:
          SYNC_SYNCSTORAGE__DATABASE_URL: postgresql://test:test@127.0.0.1/syncstorage

      - name: Publish Test Report
        uses: dorny/test-reporter@a810f9bf83f2344124a920a7a0a85a6716e791f0
        if: always()
        with:
          name: Postgres Unit Tests
          path: workflow/test-results/*.xml
          reporter: java-junit
          fail-on-error: false

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: postgres-test-results
          path: workflow/test-results/

      # Upload to GCS on master
      - name: Authenticate to Google Cloud
        if: github.ref == 'refs/heads/master'
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
        with:
          credentials_json: ${{ secrets.ETE_GCLOUD_SERVICE_KEY }}

      - name: Upload JUnit results to GCS
        if: github.ref == 'refs/heads/master'
        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
        with:
          path: workflow/test-results
          destination: ecosystem-test-eng-metrics/syncstorage-rs/junit
          glob: "*.xml"
          parent: false
          process_gcloudignore: false

      - name: Upload coverage results to GCS
        if: github.ref == 'refs/heads/master'
        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
        with:
          path: workflow/test-results
          destination: ecosystem-test-eng-metrics/syncstorage-rs/coverage
          glob: "*.json"
          parent: false
          process_gcloudignore: false

  build-postgres-image:
    runs-on: ubuntu-latest
    needs: build-and-test-postgres
    permissions:
      contents: read
      actions: write

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Create version.json
        run: |
          printf '{"commit":"%s","version":"%s","source":"https://github.com/%s/%s","build":"%s"}\n' \
            "${GITHUB_SHA}" \
            "${GITHUB_REF_NAME}" \
            "${GITHUB_REPOSITORY_OWNER}" \
            "${GITHUB_REPOSITORY_NAME}" \
            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
            > version.json
        env:
          GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Build Postgres Docker image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          push: false
          tags: app:build
          build-args: |
            SYNCSTORAGE_DATABASE_BACKEND=postgres
            TOKENSERVER_DATABASE_BACKEND=postgres
          outputs: type=docker,dest=/tmp/postgres-image.tar
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Upload Docker image artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: postgres-docker-image
          path: /tmp/postgres-image.tar
          retention-days: 1

  postgres-e2e-tests:
    runs-on: ubuntu-latest
    needs: build-postgres-image
    permissions:
      contents: read
      checks: write

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Download Docker image
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
        with:
          name: postgres-docker-image
          path: /tmp

      - name: Load Docker image
        run: docker load --input /tmp/postgres-image.tar

      - name: Create test results directory
        run: mkdir -p workflow/test-results

      - name: Run Postgres e2e tests
        run: make docker_run_postgres_e2e_tests
        env:
          SYNCSTORAGE_RS_IMAGE: app:build

      - name: Publish E2E Test Report
        uses: dorny/test-reporter@a810f9bf83f2344124a920a7a0a85a6716e791f0
        if: always()
        with:
          name: Postgres E2E Tests
          path: workflow/test-results/*.xml
          reporter: java-junit
          fail-on-error: false

      - name: Upload e2e test results
        if: always()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: postgres-e2e-test-results
          path: workflow/test-results/

      # Upload to GCS on master
      - name: Authenticate to Google Cloud
        if: github.ref == 'refs/heads/master'
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
        with:
          credentials_json: ${{ secrets.ETE_GCLOUD_SERVICE_KEY }}

      - name: Upload e2e test results to GCS
        if: github.ref == 'refs/heads/master'
        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
        with:
          path: workflow/test-results
          destination: ecosystem-test-eng-metrics/syncstorage-rs/junit
          glob: "*.xml"
          parent: false
          process_gcloudignore: false