pg-llm-batch/.github/workflows/ci.yml at 6a126153cc0f4435369f45d046641b92cf5b2484 · ContextualWisdomLab/pg-llm-batch · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  unit-tests:
    name: Unit tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.12", "3.14"]
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - name: Verify exact source head
        run: test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Set up uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          prune-cache: true
      - name: Install locked dependencies
        run: uv sync --locked
      - name: Run unit tests
        run: uv run pytest -q -m "not integration"

  quality-gates:
    name: Coverage, docstrings, lint, and package
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - name: Verify exact source head
        run: test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"
      - name: Set up uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          prune-cache: true
      - name: Install locked dependencies
        run: uv sync --locked
      - name: Compile source
        run: uv run python -m compileall -q pg_llm_batch
      - name: Lint
        run: uv run ruff check pg_llm_batch tests
      - name: Enforce docstring coverage
        run: uvx --from 'interrogate==1.7.0' interrogate --fail-under 100 pg_llm_batch
      - name: Enforce line coverage
        run: >-
          uv run --with pytest-cov==7.1.0 pytest -q -m "not integration"
          --cov=pg_llm_batch --cov-report=term-missing --cov-fail-under=100
      - name: Verify lockfile freshness
        run: uv lock --check
      - name: Build distribution artifacts without workspace sources
        run: uv build --no-sources

  container-builds:
    name: Container builds and PostgreSQL runtime smokes
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - name: Verify exact source head
        run: test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
      - name: Validate Compose configuration
        run: docker compose config >/dev/null
      - name: Build component image
        run: docker build --tag pg-llm-batch:ci .
      - name: Build PostgreSQL image
        run: docker build --tag pg-llm-batch-postgres:ci docker/postgres
      - name: Verify PostgreSQL container log routing
        run: bash tests/smoke_postgres_container_logging.sh
      - name: Run legacy SQL cleanup integration smoke
        run: bash tests/smoke_legacy_sql_cleanup.sh
      - name: Run lifecycle-outbox replay-arbiter smoke
        run: bash tests/smoke_context_lifecycle_outbox_replay_arbiter.sh
      - name: Run lifecycle-outbox exact-column smoke
        run: bash tests/smoke_context_lifecycle_outbox_exact_columns.sh
      - name: Run lifecycle-outbox UUID default-authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_uuid_default_authority.sh
      - name: Run lifecycle-outbox row-admission authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_row_admission_authority.sh
      - name: Run lifecycle-outbox final default-authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_final_default_authority.sh
      - name: Run lifecycle-outbox final column-authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_final_column_authority.sh
      - name: Run lifecycle-outbox final relation-authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_final_relation_authority.sh
      - name: Run lifecycle-outbox CHECK-expression authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_check_expression_authority.sh
      - name: Run lifecycle-outbox final RLS authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_final_rls_authority.sh
      - name: Run lifecycle-outbox effective-role RLS authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_effective_role_authority.sh
      - name: Run lifecycle-outbox authenticated-session role-authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_session_user_authority.sh
      - name: Run lifecycle-outbox DML grant-option authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_grant_option_authority.sh
      - name: Run lifecycle-outbox MAINTAIN authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_maintain_authority.sh
      - name: Run lifecycle-outbox role-admin DML-delegation smoke
        run: bash tests/smoke_context_lifecycle_outbox_role_admin_delegation_authority.sh
      - name: Run lifecycle-outbox role-admin destructive-delegation smoke
        run: bash tests/smoke_context_lifecycle_outbox_role_admin_destructive_authority.sh
      - name: Run lifecycle-outbox live RLS policy-authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_runtime_rls_policy_authority.sh
      - name: Run lifecycle-outbox SECURITY DEFINER replication-authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_security_definer_replication_authority.sh
      - name: Run lifecycle-outbox SECURITY DEFINER admin-delegation smoke
        run: bash tests/smoke_context_lifecycle_outbox_security_definer_admin_authority.sh
      - name: Run lifecycle-outbox nested SECURITY DEFINER authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_security_definer_chain_authority.sh
      - name: Run lifecycle-outbox SECURITY DEFINER search-path authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_security_definer_search_path_authority.sh
      - name: Run lifecycle-outbox SECURITY DEFINER foreign-data authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_security_definer_foreign_authority.sh
      - name: Run lifecycle-outbox SECURITY DEFINER delegated foreign-data authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_security_definer_admin_foreign_authority.sh
      - name: Run lifecycle-outbox materialized-view authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_materialized_view_authority.sh
      - name: Run lifecycle-outbox foreign-table authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_foreign_table_authority.sh
      - name: Run lifecycle-outbox partitioned foreign authority smoke
        run: bash tests/smoke_context_lifecycle_outbox_partitioned_foreign_authority.sh