ci.yml

name: CI
permissions:
  contents: read
  pull-requests: write

on:
  pull_request:
    branches: ["*"]
  push:
    branches: ["main", "master"]

env:
  CARGO_TERM_COLOR: always
  MIX_ENV: test
  ECTO_LIBSQL_BUILD: "true"

jobs:
  rust-checks:
    name: Rust Checks
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-latest, macos-latest]
        rust: [stable]

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.rust }}
          components: rustfmt, clippy

      - name: Cache Rust dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.toml') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Check Rust formatting
        run: cargo fmt --check --manifest-path native/ecto_libsql/Cargo.toml

      - name: Run Clippy
        run: cargo clippy --manifest-path native/ecto_libsql/Cargo.toml --all-targets --all-features -- -D warnings

      - name: Run Rust tests
        run: cargo test --manifest-path native/ecto_libsql/Cargo.toml --all-features

      - name: Install cargo-deny if not present
        run: |
          if ! command -v cargo-deny &> /dev/null; then
            echo "cargo-deny not found, installing..."
            cargo install cargo-deny --locked
          else
            echo "cargo-deny already installed: $(cargo-deny --version)"
          fi

      - name: Check licences and security advisories
        working-directory: native/ecto_libsql
        run: cargo deny check licenses advisories

  rust-fuzz:
    name: Rust Fuzz Testing
    runs-on: ubuntu-latest
    needs: [rust-checks]

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Rust nightly
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: llvm-tools-preview

      - name: Cache Rust dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            native/ecto_libsql/target/
            native/ecto_libsql/fuzz/target/
          key: ${{ runner.os }}-fuzz-${{ hashFiles('**/Cargo.toml') }}
          restore-keys: |
            ${{ runner.os }}-fuzz-

      - name: Run fuzz tests (30 seconds each)
        working-directory: native/ecto_libsql
        run: |
          for target in $(cargo +nightly fuzz list); do
            echo "Running $target..."
            cargo +nightly fuzz run "$target" -- -max_total_time=30
          done

          echo "All fuzz tests passed!"

  elixir-tests-latest:
    name: Elixir ${{ matrix.elixir }} / OTP ${{ matrix.otp }} / ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-latest, macos-latest]
        elixir: ["1.18.0"]
        otp: ["27.0"]

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Set up Elixir
        uses: erlef/setup-beam@v1
        with:
          elixir-version: ${{ matrix.elixir }}
          otp-version: ${{ matrix.otp }}

      - name: Cache Mix dependencies
        uses: actions/cache@v5
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-mix-${{ matrix.elixir }}-${{ matrix.otp }}-${{ hashFiles('mix.exs', '**/Cargo.toml') }}
          restore-keys: |
            ${{ runner.os }}-mix-${{ matrix.elixir }}-${{ matrix.otp }}-

      - name: Install Mix dependencies
        run: mix deps.get

      - name: Check Elixir formatting
        run: mix format --check-formatted

      - name: Compile (warnings as errors)
        run: mix compile --force --warnings-as-errors

      - name: Run Credo code quality checks
        run: mix credo

      - name: Run Sobelow security audit
        run: mix sobelow --config

      - name: Debug .so files
        run: find . -name '*.so' -print

      - name: Run Elixir tests
        run: mix test

  elixir-tests-compatibility:
    name: Elixir ${{ matrix.elixir }} / OTP ${{ matrix.otp }} / ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    needs: [elixir-tests-latest]
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-latest, macos-latest]
        elixir: ["1.17.0"]
        otp: ["26.2"]

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Set up Elixir
        uses: erlef/setup-beam@v1
        with:
          elixir-version: ${{ matrix.elixir }}
          otp-version: ${{ matrix.otp }}

      - name: Cache Mix dependencies
        uses: actions/cache@v5
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-mix-${{ matrix.elixir }}-${{ matrix.otp }}-${{ hashFiles('mix.exs', '**/Cargo.toml') }}
          restore-keys: |
            ${{ runner.os }}-mix-${{ matrix.elixir }}-${{ matrix.otp }}-

      - name: Install Mix dependencies
        run: mix deps.get

      - name: Compile (warnings as errors)
        run: mix compile --force --warnings-as-errors

      - name: Run Elixir tests
        run: mix test

  integration-test:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: [rust-checks, elixir-tests-latest, elixir-tests-compatibility]

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Set up Elixir
        uses: erlef/setup-beam@v1
        with:
          elixir-version: "1.18.0"
          otp-version: "27.0"

      - name: Cache Mix dependencies
        uses: actions/cache@v5
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-integration-mix-${{ hashFiles('mix.exs', '**/Cargo.toml') }}
          restore-keys: |
            ${{ runner.os }}-integration-mix-

      - name: Cache Rust dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.toml') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Verify Rust toolchain
        run: |
          rustc --version
          cargo --version

      - name: Install dependencies
        run: mix deps.get

      - name: Compile project
        run: |
          echo "Compiling with MIX_ENV=$MIX_ENV"
          mix compile --force

      - name: Verify NIF library exists
        run: |
          echo "Checking for NIF library..."
          echo "Contents of priv/:"
          ls -laR priv/ || echo "priv/ does not exist"
          echo ""
          echo "Contents of target/release/:"
          ls -la target/release/ | grep -E "libecto_libsql|ecto_libsql" || echo "No ecto_libsql files in target/release/"
          echo ""
          echo "Contents of _build/test/lib/ecto_libsql/:"
          ls -laR _build/test/lib/ecto_libsql/ | head -50 || echo "_build path does not exist"
          echo ""
          if [ ! -f "priv/native/ecto_libsql.so" ]; then
            echo "ERROR: NIF library not found at priv/native/ecto_libsql.so"
            exit 1
          fi
          echo "SUCCESS: NIF library found at priv/native/ecto_libsql.so"

      - name: Run full test suite (excluding Turso remote tests)
        run: mix test --trace --exclude turso_remote

  turso-remote-tests:
    name: Turso Remote Database Tests
    runs-on: ubuntu-latest
    needs: [rust-checks, elixir-tests-latest, elixir-tests-compatibility]
    # Only run on PRs to main
    if: github.event_name == 'pull_request' && github.base_ref == 'main'
    env:
      TURSO_DB_URI: ${{ secrets.TURSO_DB_URI }}
      TURSO_AUTH_TOKEN: ${{ secrets.TURSO_AUTH_TOKEN }}

    steps:
      - name: Check if secrets are available
        id: check-secrets
        run: |
          if [ -z "$TURSO_DB_URI" ] || [ -z "$TURSO_AUTH_TOKEN" ]; then
            echo "Secrets not available, skipping tests"
            echo "skip=true" >> $GITHUB_OUTPUT
          else
            echo "Secrets available, running tests"
            echo "skip=false" >> $GITHUB_OUTPUT
          fi

      - name: Checkout code
        if: steps.check-secrets.outputs.skip != 'true'
        uses: actions/checkout@v6

      - name: Set up Rust
        if: steps.check-secrets.outputs.skip != 'true'
        uses: dtolnay/rust-toolchain@stable

      - name: Set up Elixir
        if: steps.check-secrets.outputs.skip != 'true'
        uses: erlef/setup-beam@v1
        with:
          elixir-version: "1.18.0"
          otp-version: "27.0"

      - name: Cache Mix dependencies
        if: steps.check-secrets.outputs.skip != 'true'
        uses: actions/cache@v5
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-turso-mix-${{ hashFiles('mix.exs', '**/Cargo.toml') }}
          restore-keys: |
            ${{ runner.os }}-turso-mix-

      - name: Cache Rust dependencies
        if: steps.check-secrets.outputs.skip != 'true'
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.toml') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Install dependencies
        if: steps.check-secrets.outputs.skip != 'true'
        run: mix deps.get

      - name: Compile project
        if: steps.check-secrets.outputs.skip != 'true'
        run: mix compile --force

      - name: Run Turso remote tests
        if: steps.check-secrets.outputs.skip != 'true'
        run: mix test test/turso_remote_test.exs --trace

  all-checks-pass:
    name: All Checks Pass
    runs-on: ubuntu-latest
    needs:
      [
        rust-checks,
        rust-fuzz,
        elixir-tests-latest,
        elixir-tests-compatibility,
        integration-test,
        turso-remote-tests,
      ]
    if: always()

    steps:
      - name: Check if all jobs passed
        run: |
          if [ "${{ needs.rust-checks.result }}" != "success" ] || \
             [ "${{ needs.rust-fuzz.result }}" != "success" ] || \
             [ "${{ needs.elixir-tests-latest.result }}" != "success" ] || \
             [ "${{ needs.elixir-tests-compatibility.result }}" != "success" ] || \
             [ "${{ needs.integration-test.result }}" != "success" ]; then
            echo "One or more checks failed"
            exit 1
          fi
          echo "All checks passed successfully!"

          # Note: Turso remote tests are optional and don't block the build
          if [ "${{ needs.turso-remote-tests.result }}" == "success" ]; then
            echo "Turso remote tests also passed!"
          elif [ "${{ needs.turso-remote-tests.result }}" == "skipped" ]; then
            echo "Turso remote tests were skipped (not on PR to main or credentials not available)"
          elif [ "${{ needs.turso-remote-tests.result }}" == "failure" ]; then
            echo "WARNING: Turso remote tests failed (but not blocking the build)"
          fi