ci.yml

# CI for pg-java (C0.9 / N1.6).
#
# Two stages:
#   - unit: the full reactor build with unit tests and the enforced build gates
#     (Spotless formatting, the ASCII source policy, the JaCoCo coverage floor).
#     Needs no Docker; a plain `./mvnw verify` never touches Testcontainers.
#   - integration: the Testcontainers suite (real PostgreSQL, the TLS-enabled
#     derived image, and the PgBouncer transaction-pooling ITs, which start their
#     own pgbouncer container) across the full supported server matrix (ADR-0004
#     "Supported servers": PostgreSQL 9.1-18). The matrix leg is selected with the
#     `pg.it.image` system property, which every IT harness honors; version-gated
#     tests (for example direct TLS, PG17+) skip themselves on older servers via
#     JUnit assumptions.
#
# The matrix is event-dependent: pull requests run only the ADR-0004 maintained
# floor (14-18) for fast, cheap feedback, while pushes to main run the whole
# supported range (9.1-18). `scripts/run-integration-matrix.sh` drives the full set
# locally. The eventual goal is to run much older servers (down to 8.4). When
# extending the matrix, edit the leg lists in `matrix.pg` below -- but note Docker
# Hub's official `postgres` images only reach back to 9.x, so pre-9 legs will need a
# pinned third-party or self-built image; switch the matrix values to full image
# references (e.g. `someorg/postgres:8.4`) at that point, since the property takes the
# whole image.

name: ci

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  unit:
    name: unit + gates (JDK ${{ matrix.java }})
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        # 21 is the language/toolchain floor we compile and ship against; 25 is the
        # current LTS most deployments will actually run on. The gap between them is
        # not cosmetic for this driver: JEP 491 (Java 24) stopped `synchronized` from
        # pinning virtual threads, and JDK 24 removed `-Djdk.tracePinnedThreads`, so
        # the concurrency behaviour ADR-0001 reasons about differs across the range.
        # Testing only the floor would leave the JDK most users are on unexercised.
        java: ['21', '25']
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: ${{ matrix.java }}
          cache: maven
      - name: Build, unit tests, and gates
        run: ./mvnw -B -ntp verify

  native-smoke:
    name: native-image smoke (GraalVM)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: unit
    # Native-image compilation is by far the slowest job, so it runs only on
    # pushes to main, not on every pull request.
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - uses: graalvm/setup-graalvm@v1
        with:
          distribution: graalvm
          java-version: '21'
          cache: maven
          github-token: ${{ secrets.GITHUB_TOKEN }}
      # Compile the native binary from the shipped native-image metadata and run it as a gate
      # (postgresql-client-native-smoke, native-smoke profile). The profile auto-activates on a GraalVM JDK,
      # but we pass -Pnative-smoke explicitly so a missing GraalVM in CI fails loudly rather than
      # silently skipping. No Docker / PostgreSQL server needed.
      - name: Native-image metadata smoke test
        run: ./mvnw -B -ntp -pl postgresql-client-native-smoke -am -DskipTests -DskipITs -Pnative-smoke verify

  integration:
    name: integration (postgres:${{ matrix.pg }})
    runs-on: ubuntu-latest
    timeout-minutes: 45
    needs: unit
    strategy:
      fail-fast: false
      matrix:
        # Pull requests run only the ADR-0004 maintained floor (14-18) to keep PR
        # feedback fast and cheap; pushes to main run the full supported range
        # (9.1-18). GitHub Actions can't put `if:` on a matrix, so select the leg
        # list with a fromJSON ternary on the event name.
        pg: >-
          ${{
            github.event_name == 'pull_request'
            && fromJSON('[
              14,
              15,
              16,
              17,
              18
            ]')
            || fromJSON('[
              "9.1",
              "9.2",
              "9.3",
              "9.4",
              "9.5",
              "9.6",
              10,
              11,
              12,
              13,
              14,
              15,
              16,
              17,
              18
            ]')
          }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'
          cache: maven
      - name: Integration tests (Testcontainers)
        run: ./mvnw -B -ntp verify -Pintegration-tests -Dpg.it.image=postgres:${{ matrix.pg }}

  # One integration leg on the current LTS. The server matrix above sweeps PostgreSQL
  # versions on the JDK floor; this sweeps the other axis once, so JDK-dependent
  # behaviour the unit tests cannot reach (TLS handshakes, socket timeouts, time zones,
  # virtual-thread scheduling under real I/O) is exercised somewhere. A full
  # JDK x server cross-product would be 30 legs for very little added signal.
  integration-lts:
    name: integration (postgres:17, JDK 25)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    needs: unit
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '25'
          cache: maven
      - name: Integration tests (Testcontainers)
        run: ./mvnw -B -ntp verify -Pintegration-tests -Dpg.it.image=postgres:17

  # Protocol 3.2 (PG18) is a distinct negotiation path -- StartupMessage requests 3.2,
  # the server may answer NegotiateProtocolVersion, and the cancellation key becomes
  # variable-length. ADR-0004 claimed CI exercised it; it did not. Only MockServer unit
  # tests covered it, so the fallback had never run against a real server. One leg.
  integration-protocol-3-2:
    name: integration (postgres:18, protocolVersion=latest)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    needs: unit
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'
          cache: maven
      - name: Integration tests (Testcontainers, protocol 3.2)
        run: >-
          ./mvnw -B -ntp verify -Pintegration-tests
          -Dpg.it.image=postgres:18
          -Dpg.it.protocolVersion=latest