# The required merge gate. Marking this workflow required on the default branch (repository
# settings, branch protection) is the operator step that makes red unmergeable; the workflow itself
# runs exactly the same make build-test-gates a developer runs locally, so CI and local can never
# disagree about what green means. Migrations are additionally proven reversible up, down, up
# against a disposable Postgres 16 service container.
name: build-test-gates

on:
  pull_request:
  push:
    branches: [master, main]

jobs:
  build-test-gates:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_PASSWORD: ci
          POSTGRES_DB: mm_ci
        ports: ['5432:5432']
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: build-test-gates
        run: make build-test-gates
      - name: migrations up, down one, up (reversibility gate)
        env:
          PGPASSWORD: ci
        run: |
          psql -h 127.0.0.1 -U postgres -d mm_ci -c "CREATE ROLE missionmatch_app NOLOGIN NOBYPASSRLS" || true
          psql -h 127.0.0.1 -U postgres -d mm_ci -c "CREATE ROLE missionmatch_compliance NOLOGIN NOBYPASSRLS" || true
          go run github.com/pressly/goose/v3/cmd/goose@latest -dir db/migrations postgres "postgres://postgres:ci@127.0.0.1:5432/mm_ci?sslmode=disable" up
          go run github.com/pressly/goose/v3/cmd/goose@latest -dir db/migrations postgres "postgres://postgres:ci@127.0.0.1:5432/mm_ci?sslmode=disable" down
          go run github.com/pressly/goose/v3/cmd/goose@latest -dir db/migrations postgres "postgres://postgres:ci@127.0.0.1:5432/mm_ci?sslmode=disable" up