queryguard/.github/workflows/ci.yml at master · oniani1/queryguard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

jobs:
  unit:
    strategy:
      fail-fast: false
      matrix:
        node: [20, 22, 24]
    runs-on: ubuntu-latest
    name: unit (Node ${{ matrix.node }})
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: 10

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - run: pnpm install --frozen-lockfile

      - run: pnpm typecheck
        name: Type check

      - run: pnpm lint
        name: Lint

      - run: pnpm test
        name: Unit tests

      - run: pnpm build
        name: Build

  claims:
    runs-on: ubuntu-latest
    name: package claims gate
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: 10
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - run: pnpm install --frozen-lockfile
      - run: pnpm build

      - name: Zero runtime dependencies
        run: |
          node -e "const p = require('./package.json'); const deps = p.dependencies && Object.keys(p.dependencies); if (deps && deps.length) { console.error('Unexpected runtime deps:', deps); process.exit(1) } console.log('OK: zero runtime deps')"

      - name: Package size under 40 KB
        run: |
          pnpm pack
          SIZE=$(stat -c %s qguard-*.tgz)
          echo "Pack size: $SIZE bytes"
          if [ "$SIZE" -gt 40960 ]; then
            echo "FAIL: package exceeds 40 KB (40960 bytes)"
            exit 1
          fi
          echo "OK: under 40 KB"

  integration:
    runs-on: ubuntu-latest
    name: integration (pg + mysql2)
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: test
          POSTGRES_DB: test
          POSTGRES_USER: postgres
        ports: ['5432:5432']
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      mysql:
        image: mysql:8
        env:
          MYSQL_ROOT_PASSWORD: test
          MYSQL_DATABASE: test
        ports: ['3306:3306']
        options: >-
          --health-cmd "mysqladmin ping -h localhost -uroot -ptest"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 10
    env:
      TEST_PG_URL: postgresql://postgres:test@localhost:5432/test
      TEST_MYSQL_URL: mysql://root:test@localhost:3306/test
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: 10
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - run: pnpm install --frozen-lockfile

      - name: Seed Postgres
        run: |
          PGPASSWORD=test psql -h localhost -U postgres -d test -c '
            CREATE TABLE IF NOT EXISTS "User" (id INT PRIMARY KEY, name TEXT);
            CREATE TABLE IF NOT EXISTS "Post" (id INT PRIMARY KEY, "userId" INT, title TEXT);
            DELETE FROM "Post";
            DELETE FROM "User";
            INSERT INTO "User" VALUES (1, '"'"'a'"'"'), (2, '"'"'b'"'"'), (3, '"'"'c'"'"');
            INSERT INTO "Post" VALUES (1, 1, '"'"'p1'"'"'), (2, 2, '"'"'p2'"'"'), (3, 3, '"'"'p3'"'"');
          '

      - run: pnpm test:integration

  bench:
    runs-on: ubuntu-latest
    name: overhead regression (warn-only)
    needs: [unit, integration]
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: 10
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - run: pnpm install --frozen-lockfile
      - run: pnpm bench:ci