# Validates Drizzle migrations on every pull request.
#
# Runs `pnpm db:check`, which redirects Drizzle's bookkeeping table to a
# scratch schema, applies all pending migrations, then drops the schema.
# If the migrations don't parse or the bookkeeping plumbing fails, the
# job blocks the PR.
#
# Uses in-process PGlite when DATABASE_URL is not configured as a repo
# secret — that's usually fine for structural validation. To run against
# a real Postgres on PR (catches data-dependent issues), add a
# `DATABASE_URL` secret pointing at a clone of production.
name: db-check

on:
  pull_request:
    paths:
      - "db/**"
      - "drizzle.config.ts"
      - "package.json"
      - ".github/workflows/db-check.yml"

permissions:
  contents: read

jobs:
  db-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
        with:
          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
      - name: Validate migrations
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL_STAGING }}
        run: pnpm db:check