native-ci.yml

name: Native CI

on:
  push:
    branches: [napi-jemalloc, main]
    paths:
      - "native/**"
      - ".github/workflows/native-ci.yml"
      - ".github/workflows/native-build.yml"
  # Deliberately unfiltered by path. Upstream tree-sync PRs touch no native/**
  # files, so a paths filter would let them merge with no native CI at all, and
  # enumerating the upstream paths a merge might touch is not tractable.
  pull_request:

permissions:
  contents: read

jobs:
  build:
    name: Build
    uses: ./.github/workflows/native-build.yml
    with:
      upload-retention-days: 3

  package-test:
    name: Package test ${{ matrix.platform }}
    needs: build
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      # Reuse the matrix the build workflow already derived from platforms.json.
      matrix:
        include: ${{ fromJSON(needs.build.outputs.matrix) }}
    # No job-level `container` (JS actions can't run in an Alpine container on
    # arm64). The prebuild is downloaded on the glibc host; the musl smoke test
    # runs in the Alpine image via `docker run`.
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        if: ${{ !matrix.musl }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"
          package-manager-cache: false

      - name: Download prebuild
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: prebuild-${{ matrix.platform }}
          path: native/prebuilds/${{ matrix.platform }}

      # Pack the main + platform packages into tarballs and install them in an
      # isolated dir. Tarballs + --omit=optional install cleanly without registry
      # lookups for the (unpublished) platform optionalDependencies.
      - name: Pack, install, smoke test (glibc / macOS)
        if: ${{ !matrix.musl }}
        env:
          PLATFORM_KEY: ${{ matrix.platform }}
        run: |
          cd native
          npm ci
          npm run build:ts
          node scripts/package-platforms.mjs
          # Inject optionalDependencies so the packed tarball matches what gets
          # published. They are not committed to package.json (they pin the
          # package's own unpublished version, which breaks `npm ci`).
          node scripts/sync-optional-deps.mjs
          mkdir -p dist-packs
          npm pack --pack-destination "$PWD/dist-packs"
          (cd "packages/libpg-query-native-$PLATFORM_KEY" \
            && npm pack --pack-destination "$PWD/../../dist-packs")
          mkdir -p /tmp/smoke-test && cd /tmp/smoke-test && npm init -y >/dev/null
          npm install --omit=optional "$GITHUB_WORKSPACE/native/dist-packs/"*.tgz
          echo "Installed @ashbyhq packages:"; ls node_modules/@ashbyhq
          cp "$GITHUB_WORKSPACE/native/test/smoke.mjs" smoke.mjs
          node smoke.mjs

      - name: Pack, install, smoke test (musl, in Alpine container)
        if: ${{ matrix.musl }}
        env:
          PLATFORM_KEY: ${{ matrix.platform }}
          CONTAINER: ${{ matrix.container }}
        run: |
          docker run --rm -e PLATFORM_KEY -v "$GITHUB_WORKSPACE/native:/work" -w /work \
            "$CONTAINER" sh -c '
              apk add --no-cache git &&
              npm ci && npm run build:ts && node scripts/package-platforms.mjs &&
              node scripts/sync-optional-deps.mjs &&
              mkdir -p dist-packs &&
              npm pack --pack-destination /work/dist-packs &&
              (cd "packages/libpg-query-native-$PLATFORM_KEY" && npm pack --pack-destination /work/dist-packs) &&
              mkdir -p /tmp/smoke && cd /tmp/smoke && npm init -y >/dev/null &&
              npm install --omit=optional /work/dist-packs/*.tgz &&
              echo "Installed @ashbyhq packages:" && ls node_modules/@ashbyhq &&
              cp /work/test/smoke.mjs smoke.mjs &&
              node smoke.mjs
            '

  # Consumers alias the `libpg-query` dependency key straight to this package and
  # import from it directly, then hand our AST to pgsql-deparser to render back
  # to SQL. This job reproduces that exact shape.
  #
  # Two things are under test. The symbol contract (what consumers import by
  # name) is ours to keep. The AST contract — whether pgsql-deparser can still
  # render what we emit — is the load-bearing one, and it is invisible to
  # TypeScript, since ParseResult is identical across @pgsql/types majors. A
  # PG-major bump can only ever surface there, at runtime.
  #
  # Contract-shaped, not platform-shaped: one runner is enough. Per-platform
  # binary loading is already covered by the smoke test above.
  consumer-contract:
    name: Consumer contract
    needs: build
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"
          package-manager-cache: false

      - name: Download prebuild
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: prebuild-linux-x64
          path: native/prebuilds/linux-x64

      - name: Pack
        working-directory: native
        run: |
          set -euo pipefail
          npm ci
          npm run build:ts
          node scripts/package-platforms.mjs
          node scripts/sync-optional-deps.mjs
          mkdir -p dist-packs
          npm pack --pack-destination "$PWD/dist-packs"
          (cd packages/libpg-query-native-linux-x64 \
            && npm pack --pack-destination "$PWD/../../dist-packs")

      # Reproduce the downstream install: `libpg-query` aliased to us, alongside
      # the deparser that consumes our AST. Pinned to the deparser's 17 line,
      # which is what consumers are on — the PG18-parser/PG17-deparser pairing is
      # exactly the combination worth testing.
      - name: Install as a consumer does
        run: |
          set -euo pipefail
          mkdir -p /tmp/consumer && cd /tmp/consumer
          npm init -y >/dev/null
          MAIN=$(ls "$GITHUB_WORKSPACE"/native/dist-packs/ashbyhq-libpg-query-native-[0-9]*.tgz)
          PLAT=$(ls "$GITHUB_WORKSPACE"/native/dist-packs/ashbyhq-libpg-query-native-linux-x64-*.tgz)
          node -e "
            const fs=require('fs');
            const p=JSON.parse(fs.readFileSync('package.json','utf8'));
            p.dependencies={'libpg-query':'file:$MAIN','pgsql-deparser':'^17.0.0'};
            fs.writeFileSync('package.json',JSON.stringify(p,null,2));
          "
          npm install --omit=optional
          npm install --no-save "$PLAT"
          node -p "'libpg-query -> '+require('/tmp/consumer/node_modules/libpg-query/package.json').name"

      - name: Verify the consumer contract
        run: |
          set -euo pipefail
          cp "$GITHUB_WORKSPACE/native/test/consumer-contract.mjs" /tmp/consumer/
          cd /tmp/consumer && node consumer-contract.mjs