orca/.github/workflows/cloud-verify.yml

name: Cloud Verify

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
    paths:
      - cloud/**
      - src/packages/process-host/**
      - .github/workflows/cloud-*.yml
      - .github/actions/cloud-sql-rollout-lease/**
  push:
    branches: [main]
    paths:
      - cloud/**
      - src/packages/process-host/**
      - .github/workflows/cloud-*.yml
      - .github/actions/cloud-sql-rollout-lease/**

permissions:
  contents: read

concurrency:
  group: cloud-verify-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    working-directory: cloud

jobs:
  # Public-repository hosted runners preserve Blacksmith allowance for macOS.
  security:
    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
    name: Secret scan
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Pull Gitleaks image
        id: gitleaks-image
        background: true
        run: docker pull zricethezav/gitleaks@sha256:cdbb7c955abce02001a9f6c9f602fb195b7fadc1e812065883f695d1eeaba854

      - name: Pull TruffleHog image
        id: trufflehog-image
        background: true
        run: docker pull trufflesecurity/trufflehog@sha256:5dc064868ba7933601b5cbaea6954954d524ddd5dc6222a9667acea70068bf7d

      # Scan every ancestor of HEAD without downloading unrelated branch/tag histories.
      - name: Fetch complete scan history
        working-directory: .
        run: |
          git fetch --no-tags --unshallow origin "$GITHUB_SHA"
          test "$(git rev-parse --is-shallow-repository)" = false

      - wait: [gitleaks-image, trufflehog-image]

      - name: Scan Cloud history reachable from HEAD with Gitleaks
        id: history-scan
        background: true
        run: >-
          docker run --rm
          --volume "${GITHUB_WORKSPACE}:/repo:ro"
          zricethezav/gitleaks@sha256:cdbb7c955abce02001a9f6c9f602fb195b7fadc1e812065883f695d1eeaba854
          git /repo --config /repo/cloud/.gitleaks.toml
          --log-opts="HEAD -- cloud :(glob).github/workflows/cloud-*.yml .github/actions/cloud-sql-rollout-lease"

      - name: Scan the single-commit Cloud snapshot with TruffleHog
        run: >-
          docker run --rm
          --volume "${GITHUB_WORKSPACE}:/repo:ro"
          trufflesecurity/trufflehog@sha256:5dc064868ba7933601b5cbaea6954954d524ddd5dc6222a9667acea70068bf7d
          filesystem /repo --no-verification --fail
          --include-paths=/repo/cloud/.trufflehog-include-paths.txt
          --exclude-paths=/repo/cloud/.trufflehog-exclude-paths.txt

      - wait: history-scan

  # Compiles the workspace. No Postgres service: nothing here reaches a
  # database, and the service container costs ~13s of startup.
  build:
    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/setup@v2
        with:
          package-json-file: cloud/package.json
          install: false

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          check-latest: true

      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - run: pnpm typecheck

  # Runs in parallel with build. `pnpm test` compiles the workspace
  # packages it needs through pretest hooks, so it does not depend on
  # `pnpm build` having run.
  test:
    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
    runs-on: ubuntu-22.04
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_DB: orca_relay_test
          POSTGRES_PASSWORD: relay_test
          POSTGRES_USER: relay_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U relay_test -d orca_relay_test"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      ORCA_BACKGROUND_LAUNCH: '1'
      ORCA_PUSH_TEST_DATABASE_URL: postgres://relay_test:relay_test@127.0.0.1:5432/orca_relay_test
      ORCA_RELAY_TEST_POSTGRES_URL: postgres://relay_test:relay_test@127.0.0.1:5432/orca_relay_test
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/setup@v2
        with:
          package-json-file: cloud/package.json
          install: false

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          check-latest: true

      - run: pnpm install --frozen-lockfile
      - run: pnpm test

  # Fork pull requests reach this job, so it never configures a backend, never plans, and never
  # holds a credential. Only the relay root ships here; foundation and apps stay private.
  terraform:
    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.15.8

      - run: terraform -chdir=infra/terraform fmt -check -recursive
      - run: terraform -chdir=infra/terraform init -backend=false -input=false
      - run: terraform -chdir=infra/terraform validate