code-check.yml

name: Code checks

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:


# No `concurrency`/`cancel-in-progress`, deliberately. GitHub force-terminates a
# cancelled job's remaining steps -- `if: always()` included -- after a 5-minute
# cancellation timeout, and an S-00 cluster refuses DELETE until it is ACTIVE
# (~460s). A run cancelled in its first few minutes would die holding a cluster
# it is not yet allowed to delete, with nothing scheduled to reap it. Letting
# both runs finish costs clusters; cancelling them costs stranded clusters.
jobs:
  test-coverage:
    runs-on: ubuntu-latest
    environment: Base
    permissions:
      contents: read
      actions: write

    # One ledger for the whole job, so the cleanup step at the end can reap
    # what any of the pytest steps created. See the matching block in
    # coverage.yml.
    env:
      SINGLESTOREDB_TEST_DEPLOYMENT_LOG: ${{ github.workspace }}/deployments.jsonl

    services:
      singlestore:
        image: ghcr.io/singlestore-labs/singlestoredb-dev:latest
        ports:
          - 3307:3306
          - 8081:8080
          - 9081:9081
        env:
          SINGLESTORE_LICENSE: ${{ secrets.SINGLESTORE_LICENSE }}
          ROOT_PASSWORD: "root"

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # Full history, because the change detector below diffs against
          # origin/main, a ref a shallow clone does not create. With
          # fetch-depth: 2 every diff died on `fatal: bad revision
          # 'origin/main'`, which the detector read as "nothing changed", so the
          # management step never ran on a PR.
          fetch-depth: 0

      # One version, not a matrix: the supported range is covered by
      # smoke-test.yml and pre-commit.yml, so this tracks the newest final
      # release rather than the floor in pyproject.toml.
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.14"
          cache: "pip"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Check for changes in monitored directories
        id: check-changes
        run: |
          # Define directories to monitor (space-separated)
          MONITORED_DIRS="singlestoredb/management singlestoredb/fusion"

          # Determine the base commit to compare against
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            # For PRs, compare against the target branch (usually master/main)
            BASE_COMMIT="origin/${{ github.event.pull_request.base.ref }}"
            echo "Pull Request: Comparing against $BASE_COMMIT"
          elif [ "${{ github.ref_name }}" == "main" ] || [ "${{ github.ref_name }}" == "master" ]; then
            # For pushes to main/master, compare against previous commit
            BASE_COMMIT="HEAD~1"
            echo "Push to main/master: Comparing against $BASE_COMMIT"
          else
            # For pushes to other branches, compare against master/main
            if git rev-parse --verify origin/main >/dev/null 2>&1; then
              BASE_COMMIT="origin/main"
              echo "Push to branch: Comparing against origin/main"
            elif git rev-parse --verify origin/master >/dev/null 2>&1; then
              BASE_COMMIT="origin/master"
              echo "Push to branch: Comparing against origin/master"
            else
              # Fallback to previous commit if master/main not found
              BASE_COMMIT="HEAD~1"
              echo "Fallback: Comparing against HEAD~1"
            fi
          fi

          # Check if this is a release preparation commit
          COMMIT_MSG=$(git log -1 --format='%s' HEAD)
          if [[ "$COMMIT_MSG" =~ ^Prepare\ for\ v[0-9]+\.[0-9]+\.[0-9]+\ release$ ]]; then
            echo "🚀 Release preparation commit detected: $COMMIT_MSG"
            echo "changes-detected=true" >> "$GITHUB_OUTPUT"
            echo "changed-directories=release" >> "$GITHUB_OUTPUT"
            echo ""
            echo "🎯 RESULT: Full test suite will run for release preparation"
            exit 0
          fi

          echo "Checking for changes in: $MONITORED_DIRS"
          echo "Comparing against: $BASE_COMMIT"

          # Check for any changes in monitored directories
          CHANGES_FOUND=false
          CHANGED_DIRS=""

          for DIR in $MONITORED_DIRS; do
            if [ -d "$DIR" ]; then
              # No `|| true` here: a git failure means the comparison did not
              # happen, and swallowing it silently downgrades the run to the
              # no-management path instead of reporting the breakage.
              CHANGED_FILES=$(git diff --name-only "$BASE_COMMIT" HEAD -- "$DIR")
              if [ -n "$CHANGED_FILES" ]; then
                echo "✅ Changes detected in: $DIR"
                echo "Files changed:"
                # shellcheck disable=SC2001  # prefixing every line, which
                # ${var//search/replace} cannot do
                echo "$CHANGED_FILES" | sed 's/^/  - /'
                CHANGES_FOUND=true
                if [ -z "$CHANGED_DIRS" ]; then
                  CHANGED_DIRS="$DIR"
                else
                  CHANGED_DIRS="$CHANGED_DIRS,$DIR"
                fi
              else
                echo "❌ No changes in: $DIR"
              fi
            else
              echo "⚠️  Directory not found: $DIR"
            fi
          done

          # Set outputs
          if [ "$CHANGES_FOUND" = true ]; then
            echo "changes-detected=true" >> "$GITHUB_OUTPUT"
            echo "changed-directories=$CHANGED_DIRS" >> "$GITHUB_OUTPUT"
            echo ""
            echo "🎯 RESULT: Changes detected in monitored directories"
          else
            echo "changes-detected=false" >> "$GITHUB_OUTPUT"
            echo "changed-directories=" >> "$GITHUB_OUTPUT"
            echo ""
            echo "🎯 RESULT: No changes in monitored directories"
          fi

      - name: Trigger smoke tests for release
        if: steps.check-changes.outputs.changed-directories == 'release'
        run: |
          echo "🔥 Triggering smoke tests for release preparation..."
          gh workflow run smoke-test.yml
          echo "✅ Smoke tests triggered successfully"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run MySQL protocol tests (with management API)
        if: steps.check-changes.outputs.changes-detected == 'true'
        # -m 'not management_v1' keeps the v2 management coverage while dropping
        # the deprecated v1 suite, which coverage.yml runs nightly instead. The
        # -m 'not management' steps below need no second term: they already
        # exclude everything v1 deploys.
        run: |
          pytest -v -m 'not management_v1' --cov=singlestoredb --pyargs singlestoredb.tests
        env:
          COVERAGE_FILE: "coverage-mysql.cov"
          SINGLESTOREDB_URL: "root:root@127.0.0.1:3307"
          SINGLESTOREDB_PURE_PYTHON: 0
          SINGLESTORE_LICENSE: ${{ secrets.SINGLESTORE_LICENSE }}
          SINGLESTOREDB_MANAGEMENT_TOKEN: ${{ secrets.CLUSTER_API_KEY }}
          SINGLESTOREDB_FUSION_ENABLE_HIDDEN: "1"

      - name: Run MySQL protocol tests (without management API)
        if: steps.check-changes.outputs.changes-detected == 'false'
        run: |
          pytest -v -m 'not management' --cov=singlestoredb --pyargs singlestoredb.tests
        env:
          COVERAGE_FILE: "coverage-mysql.cov"
          SINGLESTOREDB_URL: "root:root@127.0.0.1:3307"
          SINGLESTOREDB_PURE_PYTHON: 0
          SINGLESTORE_LICENSE: ${{ secrets.SINGLESTORE_LICENSE }}
          SINGLESTOREDB_MANAGEMENT_TOKEN: ${{ secrets.CLUSTER_API_KEY }}
          SINGLESTOREDB_FUSION_ENABLE_HIDDEN: "1"

      - name: Run MySQL protocol tests (pure Python)
        run: |
          pytest -v -m 'not management' --cov=singlestoredb --pyargs singlestoredb.tests
        env:
          COVERAGE_FILE: "coverage-mysql-py.cov"
          SINGLESTOREDB_URL: "root:root@127.0.0.1:3307"
          SINGLESTOREDB_PURE_PYTHON: 1
          SINGLESTORE_LICENSE: ${{ secrets.SINGLESTORE_LICENSE }}
          SINGLESTOREDB_MANAGEMENT_TOKEN: ${{ secrets.CLUSTER_API_KEY }}
          SINGLESTOREDB_FUSION_ENABLE_HIDDEN: "1"

      - name: Run HTTP protocol tests
        # -n 0 overrides the -n 2 in pyproject.toml's addopts: the HTTP/Data API
        # run must be serial. Setup goes over SINGLESTOREDB_INIT_DB_URL (MySQL),
        # so load_sql takes its `SET GLOBAL HTTP_PROXY_PORT` + `RESTART PROXY`
        # branch (singlestoredb/tests/utils.py:227) once per worker, and a proxy
        # restart drops any HTTP request another worker has in flight.
        run: |
          pytest -v -n 0 -m 'not management' --cov=singlestoredb --pyargs singlestoredb.tests
        env:
          COVERAGE_FILE: "coverage-http.cov"
          SINGLESTOREDB_URL: "http://root:root@127.0.0.1:9081"
          SINGLESTORE_LICENSE: ${{ secrets.SINGLESTORE_LICENSE }}
          SINGLESTOREDB_MANAGEMENT_TOKEN: ${{ secrets.CLUSTER_API_KEY }}
          # Can not change databases using HTTP API. The URL below will be
          # used to create the database and the generated database name will
          # be applied to the above URL.
          SINGLESTOREDB_INIT_DB_URL: "root:root@127.0.0.1:3307"
          SINGLESTOREDB_FUSION_ENABLE_HIDDEN: "1"

      - name: Generate report
        run: |
          coverage combine coverage-mysql.cov coverage-http.cov coverage-mysql-py.cov
          coverage report
          coverage xml
          coverage html

      # if: always() is the whole point -- this has to run when the job fails or
      # is cancelled, which is what left three clusters billing in run
      # 35631802648 (see the matching step in coverage.yml). On a PR the
      # management step above only runs when the change detector fires, so most
      # runs reach this with an empty ledger and report nothing.
      #
      # Best effort, not a guarantee: a cancelled job's remaining steps are
      # force-terminated after GitHub's 5-minute cancellation timeout, so this
      # covers a cancel whose clusters are already ACTIVE but not one in the
      # first few minutes, where DELETE is still refused. That remainder needs
      # `cleanup_deployments.py --older-than` run by hand.
      #
      # The secret sweep alongside it is the same rolling janitor coverage.yml
      # runs; see the comment on that step.
      - name: Clean up what the tests left behind
        if: always()
        run: |
          python -m singlestoredb.tests.cleanup_deployments --secrets --yes \
            || true
          python -m singlestoredb.tests.cleanup_deployments \
            --ledger "$SINGLESTOREDB_TEST_DEPLOYMENT_LOG" --yes
        env:
          SINGLESTOREDB_MANAGEMENT_TOKEN: ${{ secrets.CLUSTER_API_KEY }}