cli.yml

# CLI checks, including database-object and gateway publishing guards.

name: CLI - CI

on:
  push:
    branches: [main]
    paths:
      - 'cli/**'
      - 'grammar/**'
      - 'config/**'
      - 'samples/**'
      - 'scripts/**'
      - 'global.json'
      - '.editorconfig'
      - '.gitattributes'
      - '.github/scripts/**'
      - '.github/workflows/cli*.yml'
  pull_request:
    paths:
      - 'cli/**'
      - 'grammar/**'
      - 'config/**'
      - 'samples/**'
      - 'scripts/**'
      - 'global.json'
      - '.editorconfig'
      - '.gitattributes'
      - '.github/scripts/**'
      - '.github/workflows/cli*.yml'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: cli-ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  gateway-publishing-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Test private-package publishing guards
        run: node --test .github/scripts/gateway-package.test.cjs
      - name: Validate CLI workflows
        run: >-
          docker run --rm --volume "$PWD/.github:/repo/.github:ro" --workdir /repo
          rhysd/actionlint:1.7.7@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9
          -ignore 'label "oracle-gateway" is unknown'
          .github/workflows/cli-publish-oracle-gateway.yml
          .github/workflows/cli-benchmark.yml
          .github/workflows/cli.yml

  # Matrixed over Linux and Windows because the CLI's on-disk formats are
  # platform-sensitive in ways a single-OS pipeline cannot see: line endings
  # (Environment.NewLine), path separators, the default console encoding a
  # redirected child process is decoded with, and which characters are legal in
  # a file name. A Linux-only run passed while the extracted-object round trip
  # was broken on Windows, which is what this matrix exists to catch.
  cli:
    name: CLI - format, build, test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    defaults:
      run:
        working-directory: cli
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      # No packages.lock.json in the repo, so cache the global package folder
      # keyed by the project files that decide what gets restored.
      - name: Cache NuGet packages
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('cli/**/*.csproj', 'cli/Directory.Build.props', 'cli/tests/Directory.Build.props') }}
          restore-keys: ${{ runner.os }}-nuget-

      - name: Restore
        run: dotnet restore SyncSql.slnx

      # grammar/ is generated ANTLR output committed as-is, so it is excluded
      # here for the same reason .gitattributes exempts it from whitespace
      # checks - reformatting it would break byte-for-byte reproducibility with
      # the documented generator command.
      # Linux only: the check reads .editorconfig, which pins end_of_line = lf,
      # while Git for Windows checks sources out as CRLF by default - so a
      # second run on Windows reports the checkout's line endings rather than
      # anything about the committed source.
      - name: Format check
        if: runner.os == 'Linux'
        run: dotnet format SyncSql.slnx --verify-no-changes --no-restore --exclude ../grammar/

      - name: Build
        run: dotnet build SyncSql.slnx --configuration Release --no-restore

      - name: Test
        run: >-
          dotnet test SyncSql.slnx --configuration Release --no-build
          --logger "console;verbosity=normal"
          --logger "trx;LogFileName=test-results.trx"
          --collect "XPlat Code Coverage"

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cli-test-results-${{ matrix.os }}
          path: |
            cli/tests/**/TestResults/*.trx
            cli/tests/**/TestResults/**/coverage.cobertura.xml
          if-no-files-found: ignore

  publish-script:
    name: Publish script - parse and 5.1 compatibility
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Test coverage gate failure handling
        shell: pwsh
        run: ./scripts/Test-CliCoverageGate.ps1

      - name: Parse
        shell: pwsh
        run: |
          $errors = $null
          $null = [System.Management.Automation.Language.Parser]::ParseFile(
              (Resolve-Path ./scripts/Publish-SyncSqlObjects.ps1).Path, [ref] $null, [ref] $errors)
          if ($errors) {
              $errors | ForEach-Object { Write-Host "::error::$($_.Extent.StartLineNumber): $($_.Message)" }
              throw "$($errors.Count) parse error(s) in Publish-SyncSqlObjects.ps1."
          }
          Write-Host 'Parsed cleanly.'

      # The script targets Windows PowerShell 5.1 (see .gitlab/README.md); this
      # is what keeps that true. PSUseCompatibleSyntax is language-level only -
      # profile-based cmdlet/parameter compatibility rules need a platform
      # profile name and are left to run locally.
      - name: Check Windows PowerShell 5.1 syntax compatibility
        shell: pwsh
        run: |
          Install-Module PSScriptAnalyzer -Scope CurrentUser -Force -ErrorAction Stop
          $settings = @{
              Rules = @{
                  PSUseCompatibleSyntax = @{
                      Enable         = $true
                      TargetVersions = @('5.1', '7.4')
                  }
              }
          }
          $findings = Invoke-ScriptAnalyzer -Path ./scripts -Recurse -IncludeRule PSUseCompatibleSyntax -Settings $settings
          if ($findings) {
              $findings | ForEach-Object { Write-Host "::error file=$($_.ScriptPath),line=$($_.Line)::$($_.Message)" }
              throw "$($findings.Count) PowerShell 5.1 compatibility finding(s)."
          }
          Write-Host 'No 5.1 compatibility findings.'

  # The compatibility job above runs PSScriptAnalyzer's language-level 5.1 rule
  # under PowerShell 7 on Linux. This one parses the script with the real
  # Windows PowerShell 5.1 engine, which is the interpreter the GitLab runner
  # actually uses (see .gitlab/README.md) - the only way to be sure a syntax
  # form 7 accepts is one 5.1 accepts too. Parse only: nothing is executed, so
  # no database, credential, or git remote is touched here either.
  publish-script-windows:
    name: Publish script - Windows PowerShell 5.1 parse
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      # `shell: powershell` is Windows PowerShell 5.1; `pwsh` would be 7.x.
      - name: Parse under Windows PowerShell 5.1
        shell: powershell
        run: |
          $PSVersionTable.PSVersion.ToString()
          if ($PSVersionTable.PSVersion.Major -ne 5) { throw "Expected Windows PowerShell 5.1, got $($PSVersionTable.PSVersion)." }
          $errors = $null
          $null = [System.Management.Automation.Language.Parser]::ParseFile(
              (Resolve-Path ./scripts/Publish-SyncSqlObjects.ps1).Path, [ref] $null, [ref] $errors)
          if ($errors) {
              $errors | ForEach-Object { Write-Host "::error::$($_.Extent.StartLineNumber): $($_.Message)" }
              throw "$($errors.Count) parse error(s) under Windows PowerShell 5.1."
          }
          Write-Host 'Parsed cleanly under Windows PowerShell 5.1.'