integration-tests.yml

name: Integration Tests

on:
  pull_request:
  push:
    branches: [main]

concurrency:
  group: integration-${{ github.ref }}
  cancel-in-progress: true

# Deny-all by default; the acceptance suite only needs to read the source and
# talk to its own ephemeral, in-runner PostgreSQL. No privileged token is ever
# minted, so untrusted PR code cannot leak one.
permissions: {}

env:
  CARGO_TERM_COLOR: always

jobs:
  acceptance:
    name: Acceptance suite (ephemeral PostgreSQL 16)
    runs-on: ubuntu-latest
    # This is the same Cargo debug profile as the quality gate, never a release
    # or profiling artifact. Sharing is safe because only trusted main pushes
    # can write the common cache key below.
    env:
      CARGO_TARGET_DIR: target/ci-debug
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install Rust toolchain
        run: rustup show

      # PRs restore main's cache read-only. The event and ref checks make main
      # pushes the sole cache writers, even if this workflow gains new triggers.
      - name: Cache Rust debug dependencies
        uses: Swatinem/rust-cache@v2
        with:
          prefix-key: v1-serval-rust
          shared-key: ci-debug
          workspaces: . -> target/ci-debug
          cache-bin: false
          cache-workspace-crates: false
          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}

      # The acceptance suite boots its own ephemeral PostgreSQL via
      # testcontainers, so only a working Docker daemon is required — which the
      # ubuntu-latest runner provides out of the box.
      - name: Run acceptance suite
        run: cargo test --features integration --test acceptance -- --test-threads=1
        env:
          SERVAL_SKIP_FRONTEND_BUILD: "1"