name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  backend:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres_dev_pw
          POSTGRES_DB: dadaotask
        ports: ["5433:5432"]
        options: >-
          --health-cmd "pg_isready -U postgres -d dadaotask"
          --health-interval 5s --health-timeout 3s --health-retries 20

    env:
      ENV: test
      DATABASE_URL: postgresql+asyncpg://dadao_app:dadao_dev_pw@127.0.0.1:5433/dadaotask
      MIGRATION_DATABASE_URL: postgresql+asyncpg://dadao_owner:dadao_dev_pw@127.0.0.1:5433/dadaotask

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      # 关键：先建角色再跑迁移。应用角色必须是受限角色，否则 RLS 测试会"假通过"。
      - name: 创建数据库角色
        run: |
          PGPASSWORD=postgres_dev_pw psql -h 127.0.0.1 -p 5433 -U postgres -d dadaotask \
            -v ON_ERROR_STOP=1 -f deploy/postgres/init/01-roles.sql

      - name: 安装依赖
        working-directory: backend
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - name: Lint
        working-directory: backend
        run: |
          ruff check .
          ruff format --check .

      - name: 迁移
        working-directory: backend
        run: alembic upgrade head

      - name: 测试
        working-directory: backend
        run: pytest -q