ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  merge_group:
  workflow_dispatch:

jobs:
  check-versions:
    name: Version consistency check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Verify package.json, config.ts, and CHANGELOG.md versions match
        run: |
          PKG_VERSION=$(node -p "require('./package.json').version")
          CONFIG_VERSION=$(node -p "require('fs').readFileSync('src/config.ts','utf8').match(/version: \"([^\"]+)\"/)[1]")
          CHANGELOG_VERSION=$(node -p "require('fs').readFileSync('CHANGELOG.md','utf8').match(/^## \\[([^\\]]+)\\]/m)[1]")

          echo "package.json:  $PKG_VERSION"
          echo "config.ts:     $CONFIG_VERSION"
          echo "CHANGELOG.md:  $CHANGELOG_VERSION"

          if [ "$PKG_VERSION" != "$CONFIG_VERSION" ]; then
            echo "::error::package.json ($PKG_VERSION) and config.ts ($CONFIG_VERSION) versions differ"
            exit 1
          fi
          if [ "$PKG_VERSION" != "$CHANGELOG_VERSION" ]; then
            echo "::error::package.json ($PKG_VERSION) and CHANGELOG.md ($CHANGELOG_VERSION) versions differ"
            exit 1
          fi
          echo "All versions match: $PKG_VERSION"

  format-check:
    name: Format check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "22"
          cache: "npm"

      - run: npm ci
      - run: npm run format:check

  test-protocol:
    name: Protocol tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "22"
          cache: "npm"

      - run: npm ci
      - run: npm run build
      - run: npm test

  test-integration-core:
    name: Integration tests (InfluxDB 3 Core)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "22"
          cache: "npm"

      - run: npm ci
      - run: npm run build

      - name: Print InfluxDB 3 Core version
        run: docker run --rm influxdb:3-core influxdb3 --version

      - name: Start InfluxDB 3 Core
        run: |
          docker run -d --name influxdb3-core \
            -p 8181:8181 \
            -v "${{ github.workspace }}/tests/fixtures/admin-token.json:/run/secrets/admin-token:ro" \
            influxdb:3-core \
            serve --node-id=ci-test --object-store=memory --admin-token-file=/run/secrets/admin-token

      - name: Wait for InfluxDB to be ready
        run: |
          for i in $(seq 1 30); do
            if curl -sf -H "Authorization: Bearer apiv3_test" http://localhost:8181/ping > /dev/null 2>&1; then
              echo "InfluxDB ready after ${i}s"
              exit 0
            fi
            sleep 1
          done
          echo "InfluxDB failed to start"
          docker logs influxdb3-core
          exit 1

      - name: Integration tests
        run: npm run test:integration
        env:
          INFLUX_TEST_ENABLED: "true"
          INFLUX_DB_INSTANCE_URL: "http://localhost:8181/"
          INFLUX_DB_TOKEN: "apiv3_test"
          INFLUX_DB_PRODUCT_TYPE: "core"

      - name: Stop InfluxDB
        if: always()
        run: docker stop influxdb3-core && docker rm influxdb3-core

  test-integration-cloud-serverless:
    name: Integration tests (InfluxDB Cloud Serverless)
    runs-on: ubuntu-latest
    # Skip on forked and Dependabot PRs — environment secrets
    # (INFLUXDB_CLOUD_URL/TOKEN) are not exposed to those runs, which would
    # fail on empty credentials.
    # merge_group runs only happen for same-repo branches that already
    # cleared review, so they're always safe to include here.
    if: |
      github.repository_owner == 'influxdata' &&
      github.actor != 'dependabot[bot]' &&
      (github.event_name == 'push' ||
       github.event_name == 'merge_group' ||
       github.event.pull_request.head.repo.full_name == github.repository)
    environment: cloud-serverless
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "22"
          cache: "npm"

      - run: npm ci
      - run: npm run build

      - name: Integration tests
        run: npm run test:integration
        env:
          INFLUX_TEST_ENABLED: "true"
          INFLUX_DB_INSTANCE_URL: ${{ secrets.INFLUXDB_CLOUD_URL }}
          INFLUX_DB_TOKEN: ${{ secrets.INFLUXDB_CLOUD_TOKEN }}
          INFLUX_DB_PRODUCT_TYPE: "cloud-serverless"

  # Future: test-integration-enterprise
  # Requires Enterprise Docker image and license key.
  # Gate with: if: github.repository_owner == 'influxdata'
  # Environment: enterprise (with INFLUXDB_ENTERPRISE_LICENSE secret)