neiam /dms

name: checks
# A pull request's build, tests and clippy: the workspace compiled with the
# Dockerfile's toolchain and `cargo test` against a throwaway Postgres
# (tests/search_integration.rs runs only when DMS_TEST_DATABASE_URL is
# set, each test in a schema of its own). Every pull request — the
# security update PRs gg-security opens (dependency-updates.yml) most of
# all, since a bump that resolves isn't one that builds.
on:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

# A newer push supersedes this run: on a branch or PR the run in
# progress is cancelled; on master it finishes, and only a run still
# waiting is replaced.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

jobs:
  test:
    runs-on: self-hosted
    # As compose.yml's database.
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_DB: dms
          POSTGRES_USER: dms_user
          POSTGRES_PASSWORD: dms_password
        options: >-
          --health-cmd "pg_isready -U dms_user -d dms"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    env:
      DMS_TEST_DATABASE_URL: postgres://dms_user:dms_password@postgres:5432/dms
    steps:
      - uses: actions/checkout@v4

      # As the Dockerfile's rust-builder stage.
      - name: Build dependencies
        run: |
          sudo apt-get update -q
          sudo apt-get install -y -q --no-install-recommends \
            build-essential pkg-config libssl-dev ca-certificates

      # rustup directly, at the Dockerfile's rust:1.98: setup actions
      # choose a build by ImageOS, which this runner sets to "selfhosted"
      # over anything a workflow says.
      - name: Rust
        run: |
          curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98 -c clippy
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Build
        run: cargo build --locked --workspace --all-targets

      - name: Test
        run: cargo test --locked --workspace

      # Every warning clippy or rustc raises fails the run: the one
      # command every Rust repository on the forge gates on.
      - name: Clippy
        run: cargo clippy --workspace --all-targets --locked -- -D warnings