CI recipe

name: schema-diff
on: pull_request

permissions:
  contents: read
  checks: write
  issues: write

jobs:
  supaschema:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready --health-interval 5s --health-timeout 5s --health-retries 10

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v6
        with:
          node-version: 22
      - name: Scan schema safety
        uses: jmclaughlin724/supaschema@<tag>
        with:
          argv: '["scan","--reporter","json"]'
      - name: Render migration from the PR diff
        uses: jmclaughlin724/supaschema@<tag>
        with:
          argv: >-
            ["diff","--from","git:origin/${{ github.base_ref }}","--to","dir:database/schemas","--out","/tmp/supaschema/migration.sql"]

      - name: Check replay safety
        uses: jmclaughlin724/supaschema@<tag>
        with:
          argv: '["check","/tmp/supaschema/migration.sql"]'
      - name: Verify apply-twice and catalog parity
        uses: jmclaughlin724/supaschema@<tag>
        with:
          argv: >-
            ["verify","--from","git:origin/${{ github.base_ref }}","--to","dir:database/schemas","--migration","/tmp/supaschema/migration.sql","--database-url","postgresql://postgres:postgres@localhost:5432/postgres"]

- name: Scan schema and generated-contract usage
  uses: jmclaughlin724/supaschema@<tag>
  with:
    argv: '["scan","--contract-usage","src","--reporter","json"]'

name: schema-sync
on:
  workflow_dispatch:

jobs:
  sync:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 22
      - name: Sync remote schema
        uses: jmclaughlin724/supaschema@<tag>
        with:
          argv: '["sync","--target","remote"]'
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          SUPASCHEMA_REMOTE_SYNC_APPROVED: "1"

npx supaschema diff --fail-on-diff --quiet
npx supaschema check --reporter github

npx supaschema check --reporter sarif