pr-check.yml

name: pr-check

# Tests PR code against a local SQL Server instance so no Azure credentials are required.
# This workflow uses the pull_request trigger (not pull_request_target), so fork PRs run
# with no secrets and no elevated permissions.
#
# - Linux runners: spin up SQL Server 2022 in a Docker container with SA auth.
# - Windows runners: install SQL Server 2025 Express directly from Microsoft with SA auth.

on:
  pull_request:

permissions: {}

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      checks: write

    env:
      TEST_DB: SqlActionTest

    defaults:
      run:
        shell: bash

    steps:
    - name: Checkout PR
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        ref: ${{ github.event.pull_request.head.sha }}

    - name: Generate SA password
      run: |
        SA_PASSWORD="$(openssl rand -base64 18 | tr -d '/+=')Aa1!"
        echo "::add-mask::${SA_PASSWORD}"
        echo "SA_PASSWORD=${SA_PASSWORD}" >> "$GITHUB_ENV"

    - name: Set up SQL Server (Linux)
      if: runner.os == 'Linux'
      uses: ./.github/actions/setup-sql-linux
      with:
        sa-password: ${{ env.SA_PASSWORD }}

    - name: Set up SQL Server (Windows)
      if: runner.os == 'Windows'
      uses: ./.github/actions/setup-sql-windows
      with:
        sa-password: ${{ env.SA_PASSWORD }}

    - name: Build GitHub Action
      run: npm ci --ignore-scripts && npm run build

    - name: Setup .NET
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: '10.x'

    - name: Install SqlPackage
      run: dotnet tool install -g microsoft.sqlpackage

    # Deploy a DACPAC with only a table to server (sqlpackage creates the DB if needed)
    - name: Test DACPAC Action
      uses: ./
      with:
        connection-string: '${{ env.BASE_CS }}Initial Catalog=${{ env.TEST_DB }};'
        path: ./__testdata__/sql-action.dacpac
        action: 'publish'
        skip-firewall-check: true

    # Build and publish sqlproj that should create a new view
    - name: Test Build and Publish
      uses: ./
      with:
        connection-string: '${{ env.BASE_CS }}Initial Catalog=${{ env.TEST_DB }};'
        path: ./__testdata__/TestProject/sql-action.sqlproj
        action: 'publish'
        skip-firewall-check: true

    # Execute testsql.sql via script action on server
    - name: Test SQL Action
      uses: ./
      with:
        connection-string: '${{ env.BASE_CS }}Initial Catalog=${{ env.TEST_DB }};'
        path: ./__testdata__/testsql.sql
        skip-firewall-check: true

    - name: Cleanup Test Database
      if: always()
      uses: ./
      with:
        connection-string: '${{ env.BASE_CS }}Initial Catalog=master;'
        path: ./__testdata__/cleanup.sql
        arguments: '-v DbName="${{ env.TEST_DB }}"'
        skip-firewall-check: true

    - name: Stop SQL Server container (Linux)
      if: always() && runner.os == 'Linux'
      run: docker rm -f sqlserver || true