ci.yml

on:
  pull_request:
  push:
    branches:
      - master
  merge_group:
  workflow_dispatch:
    inputs:
      pr_number:
        description: "Pull Request Number"
        required: false
        default: ""

name: CI

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.inputs.pr_number || format('sha-{0}', github.sha) }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: read

jobs:
  merge_queue_noop:
    name: Merge queue no-op/reuse
    runs-on: spacetimedb-linux
    permissions:
      actions: write
      contents: read
      pull-requests: read
    outputs:
      # A reused failure also skips fresh jobs; the final step reports that failure on this commit.
      skip: ${{ steps.compare.outputs.skip == 'true' || steps.reuse.outputs.reused == 'true' }}
    steps:
      - name: Checkout merge queue commit
        uses: actions/checkout@v4

      - name: Compare merge queue commit to PR head
        id: compare
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HEAD_REF: ${{ github.event.merge_group.head_ref }}
        shell: bash
        run: |
          set -euo pipefail

          echo "skip=false" >>"$GITHUB_OUTPUT"

          if [[ "${GITHUB_EVENT_NAME}" != "merge_group" ]]; then
            echo "Not a merge_group event; running CI normally."
            exit 0
          fi

          if [[ ! "${HEAD_REF}" =~ /pr-([0-9]+)- ]]; then
            echo "Could not parse PR number from merge group head ref: ${HEAD_REF}"
            exit 0
          fi

          pr_number="${BASH_REMATCH[1]}"
          pr_head_sha="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${pr_number}" --jq '.head.sha')"
          pr_head_repo="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${pr_number}" --jq '.head.repo.full_name')"

          if [[ -z "${pr_head_sha}" || "${pr_head_sha}" == "null" || -z "${pr_head_repo}" || "${pr_head_repo}" == "null" ]]; then
            echo "Could not resolve PR head SHA for PR #${pr_number}; running CI normally."
            exit 0
          fi

          git fetch --no-tags --depth=1 "https://github.com/${pr_head_repo}.git" "${pr_head_sha}"

          if git diff --quiet "${pr_head_sha}" "${GITHUB_SHA}" --; then
            echo "Merge queue commit ${GITHUB_SHA} has the same tree as PR #${pr_number} head ${pr_head_sha}; skipping duplicate CI."
            echo "skip=true" >>"$GITHUB_OUTPUT"
          else
            echo "Merge queue commit ${GITHUB_SHA} differs from PR #${pr_number} head ${pr_head_sha}; running CI normally."
          fi

      # The merge queue coordinator is part of cargo ci and needs the repository's pinned Rust toolchain.
      - uses: dsherret/rust-toolchain-file@v1
        if: ${{ github.event_name == 'merge_group' && steps.compare.outputs.skip != 'true' }}

      - name: Reuse merge queue run
        id: reuse
        if: ${{ github.event_name == 'merge_group' && steps.compare.outputs.skip != 'true' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: cargo ci other-workflows coordinate merge-queue-reuse

      - name: Report merge queue workflow reuse failure on this commit
        if: ${{ steps.reuse.outputs.failed == 'true' }}
        run: exit 1

  upload-build-artifacts-linux:
    needs: [merge_queue_noop, lints]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: Upload build artifacts (Linux)
    runs-on: spacetimedb-linux
    timeout-minutes: 15
    env:
      RUST_BACKTRACE: full
      ARTIFACT_SUFFIX: linux
      EXE_SUFFIX: ""
    steps: &upload-build-artifact-steps
      - &set-cargo-target-dir
        name: Set Cargo target directory
        shell: bash
        run: |
          if [[ "${RUNNER_OS}" == "Linux" ]]; then
            cargo_target_dir="${HOME}/actions-runner/_work/target"
          else
            # Forward slashes keep the Windows path compatible with Cargo,
            # PowerShell, GitHub Actions, and Git Bash filesystem commands.
            cargo_target_dir="${GITHUB_WORKSPACE//\\//}/target"
          fi
          echo "CARGO_TARGET_DIR=${cargo_target_dir}" >>"${GITHUB_ENV}"

      - &configure-sccache
        name: Configure sccache
        if: runner.os == 'Linux'
        shell: bash
        run: |
          if command -v sccache >/dev/null 2>&1; then
            # sccache cannot cache incremental compilation artifacts, so
            # disable Cargo's incremental mode whenever the wrapper is active.
            echo "CARGO_INCREMENTAL=0" >>"${GITHUB_ENV}"
            echo "RUSTC_WRAPPER=/usr/local/bin/sccache" >>"${GITHUB_ENV}"
            echo "SCCACHE_DIR=${HOME}/.cache/sccache" >>"${GITHUB_ENV}"
            echo "SCCACHE_CACHE_SIZE=20G" >>"${GITHUB_ENV}"
          fi

      - &find-git-ref
        name: Find Git ref
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
          if test -n "${PR_NUMBER}"; then
            GIT_REF="$( gh pr view --repo clockworklabs/SpacetimeDB $PR_NUMBER --json headRefName --jq .headRefName )"
          else
            GIT_REF="${{ github.ref }}"
          fi
          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"

      - &checkout-sources
        name: Checkout sources
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - uses: dsherret/rust-toolchain-file@v1
      - &set-default-rust-toolchain
        name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - &verify-openssl-assembler
        name: Verify OpenSSL assembler
        if: runner.os == 'Windows'
        shell: pwsh
        run: nasm -v

      # These keys intentionally spell out stable native-build inputs instead of
      # hashing the workspace. Keep the versions in sync with Cargo.lock and bump
      # v1 if a fixed feature set or build configuration changes. This manual
      # versioning is temporary until a better caching mechanism replaces it.
      # - V8 uses its default features and has profile-specific native output.
      # - OpenSSL is the vendored static build with legacy enabled. Windows uses
      #   NASM, which is represented by a separate cache-key suffix.
      - &set-native-cache-keys
        name: Set native cache keys
        id: native-cache-keys
        if: runner.os == 'Windows'
        shell: bash
        run: |
          target="$(rustc -vV | sed -n 's/^host: //p')"
          openssl_suffix=""
          if [[ "${OPENSSL_RUST_USE_NASM:-}" == "1" ]]; then
            openssl_suffix="-nasm"
          fi
          echo "v8-release-key=rusty-v8-v1-145.0.0-${target}" >>"$GITHUB_OUTPUT"
          echo "v8-debug-key=rusty-v8-debug-v1-145.0.0-${target}" >>"$GITHUB_OUTPUT"
          echo "openssl-key=openssl-v1-300.5.3+3.5.4-${target}${openssl_suffix}" >>"$GITHUB_OUTPUT"

      - &cache-rusty-v8
        name: Cache rusty_v8
        if: runner.os == 'Windows'
        uses: actions/cache@v4
        with: &v8-release-cache
          path: ${{ env.CARGO_TARGET_DIR }}/release/gn_out/obj
          key: ${{ steps.native-cache-keys.outputs.v8-release-key }}

      - &cache-openssl
        name: Cache OpenSSL
        id: cache-openssl
        if: runner.os == 'Windows'
        uses: actions/cache@v4
        with: &openssl-cache
          path: ${{ github.workspace }}/.ci-cache/openssl
          key: ${{ steps.native-cache-keys.outputs.openssl-key }}

      - &configure-cached-openssl
        name: Configure cached OpenSSL
        if: runner.os == 'Windows' && steps.cache-openssl.outputs.cache-hit == 'true'
        shell: bash
        run: |
          # Reuse the cached vendored output as a prebuilt OpenSSL installation.
          echo "OPENSSL_NO_VENDOR=1" >>"$GITHUB_ENV"
          echo "OPENSSL_DIR=${{ github.workspace }}/.ci-cache/openssl" >>"$GITHUB_ENV"

      - name: Build CLI and standalone
        shell: bash
        run: |
          cargo build --timings --release \
            -p spacetimedb-cli \
            -p spacetimedb-standalone \
            --features spacetimedb-standalone/allow_loopback_http_for_tests

      - &prepare-openssl-cache
        name: Prepare OpenSSL cache
        if: runner.os == 'Windows' && steps.cache-openssl.outputs.cache-hit != 'true'
        shell: bash
        run: |
          openssl_cache_dir="${PWD}/.ci-cache/openssl"
          cd "${CARGO_TARGET_DIR}"
          shopt -s nullglob
          openssl_installs=(release/build/openssl-sys-*/out/openssl-build/install)
          if (( ${#openssl_installs[@]} != 1 )); then
            echo "Expected one vendored OpenSSL installation, found ${#openssl_installs[@]}."
            exit 1
          fi
          mkdir -p "${openssl_cache_dir}"
          cp -R "${openssl_installs[0]}/." "${openssl_cache_dir}/"

      - name: Package build artifacts
        shell: bash
        run: |
          archive_path="${PWD}/build-support.tar.gz"
          cd "${CARGO_TARGET_DIR}"
          tar -czf "${archive_path}" \
            "release/spacetimedb-cli${EXE_SUFFIX}" \
            "release/spacetimedb-standalone${EXE_SUFFIX}"

      - &show-sccache-stats
        name: Show sccache statistics
        if: always() && runner.os == 'Linux'
        shell: bash
        run: |
          if command -v sccache >/dev/null 2>&1; then
            sccache --show-stats
          else
            echo "::notice::sccache is not installed on this Linux runner"
          fi

      - name: Upload Cargo timing reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: build-artifacts-cargo-timings-${{ env.ARTIFACT_SUFFIX }}
          path: ${{ env.CARGO_TARGET_DIR }}/cargo-timings/
          if-no-files-found: warn
          overwrite: true
          retention-days: 14

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-artifacts-${{ env.ARTIFACT_SUFFIX }}
          path: build-support.tar.gz
          if-no-files-found: error
          overwrite: true
          retention-days: 14

  upload-build-artifacts-windows:
    needs: [merge_queue_noop, lints]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: Upload build artifacts (Windows)
    runs-on: spacetimedb-windows-runner
    timeout-minutes: 15
    env:
      RUST_BACKTRACE: full
      ARTIFACT_SUFFIX: windows
      EXE_SUFFIX: .exe
      OPENSSL_RUST_USE_NASM: "1"
    steps: *upload-build-artifact-steps

  smoketest_build_linux:
    needs: [upload-build-artifacts-linux]
    name: Build smoketests (Linux)
    runs-on: spacetimedb-linux
    timeout-minutes: 15
    env:
      RUST_BACKTRACE: full
      ARTIFACT_SUFFIX: linux
      EXE_SUFFIX: ""
      SMOKETEST_SUITE: standalone
    steps: &smoketest-build-steps
      - *set-cargo-target-dir
      - *configure-sccache

      - *find-git-ref
      - *checkout-sources

      - uses: dsherret/rust-toolchain-file@v1
      - *set-default-rust-toolchain

      - *set-native-cache-keys
      - *verify-openssl-assembler
      - &restore-openssl
        name: Restore OpenSSL
        id: cache-openssl
        if: runner.os == 'Windows'
        uses: actions/cache/restore@v4
        with: *openssl-cache
      - *configure-cached-openssl

      - name: Install cargo-nextest
        uses: taiki-e/install-action@nextest

      - name: Build smoketest dependencies and archive test binaries
        shell: bash
        run: |
          cargo run --timings --package ci-smoketests -- --suite "${SMOKETEST_SUITE}" archive --archive-file smoketest-nextest.tar.zst

          archive_path="${PWD}/smoketest-support.tar.gz"
          cd "${CARGO_TARGET_DIR}"
          shopt -s nullglob
          precompiled_modules=(wasm32-unknown-unknown/release/smoketest_module_*.wasm)
          if (( ${#precompiled_modules[@]} == 0 )); then
            echo "No precompiled smoketest modules were produced."
            exit 1
          fi

          tar -czf "${archive_path}" \
            "debug/ci-smoketests${EXE_SUFFIX}" \
            "${precompiled_modules[@]}"

      - *show-sccache-stats

      - name: Upload Cargo timing reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: smoketest-build-cargo-timings-${{ env.ARTIFACT_SUFFIX }}
          path: ${{ env.CARGO_TARGET_DIR }}/cargo-timings/
          if-no-files-found: warn
          overwrite: true
          retention-days: 14

      - name: Upload smoketest build
        uses: actions/upload-artifact@v4
        with:
          name: smoketest-build-${{ env.ARTIFACT_SUFFIX }}
          path: |
            smoketest-nextest.tar.zst
            smoketest-support.tar.gz
          if-no-files-found: error
          overwrite: true
          retention-days: 14

  smoketest_build_windows:
    needs: [upload-build-artifacts-windows]
    name: Build smoketests (Windows)
    runs-on: spacetimedb-windows-runner
    timeout-minutes: 15
    env:
      RUST_BACKTRACE: full
      ARTIFACT_SUFFIX: windows
      EXE_SUFFIX: .exe
      OPENSSL_RUST_USE_NASM: "1"
      SMOKETEST_SUITE: all
    steps: *smoketest-build-steps

  smoketest_partitions_linux:
    needs: [smoketest_build_linux]
    name: Smoketests (Linux ${{ matrix.partition }}/1)
    strategy:
      fail-fast: false
      matrix:
        partition: [1]
    runs-on: spacetimedb-linux
    timeout-minutes: 30
    env:
      RUST_BACKTRACE: full
      SPACETIMEDB_CPP_DIR: ${{ github.workspace }}/crates/bindings-cpp
      ARTIFACT_SUFFIX: linux
      PARTITION_COUNT: 1
    steps: &smoketest-partition-steps
      - *set-cargo-target-dir
      - *configure-sccache

      - *find-git-ref
      - *checkout-sources

      - uses: dsherret/rust-toolchain-file@v1
      - *set-default-rust-toolchain

      - uses: actions/setup-dotnet@v4
        with:
          global-json-file: global.json

      # Node.js and pnpm are required for the TypeScript smoketests.
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 18

      - uses: ./.github/actions/setup-pnpm

      - name: Install TypeScript SDK dependencies
        run: pnpm --filter spacetimedb install

      - name: Install emscripten (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          git clone https://github.com/emscripten-core/emsdk.git $env:USERPROFILE\emsdk
          cd $env:USERPROFILE\emsdk
          .\emsdk install 4.0.21
          .\emsdk activate 4.0.21

      - name: Install psql
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          # Fail properly if any individual command fails
          $ErrorActionPreference = 'Stop'
          $PSNativeCommandUseErrorActionPreference = $true
          choco install psql -y --no-progress
          # Check for existence, since `choco` doesn't seem to fail the step if it fails to install..
          # See https://github.com/clockworklabs/SpacetimeDB/pull/4399 for more background.
          Get-Command psql

      - name: Update dotnet workloads
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          # Fail properly if any individual command fails
          $ErrorActionPreference = 'Stop'
          $PSNativeCommandUseErrorActionPreference = $true

          cd modules
          # the sdk-manifests on windows-latest are messed up, so we need to update them
          dotnet workload config --update-mode manifests
          dotnet workload update --from-previous-sdk
          # Explicitly install wasi-experimental for .NET 8 SDK (needed for test_build_csharp_module)
          # Create temp global.json to target .NET 8 SDK for workload install
          $sdk8Json = '{"sdk":{"version":"8.0.400","rollForward":"latestFeature"}}'
          $sdk8Json | Out-File -FilePath global.json -Encoding utf8
          dotnet workload install wasi-experimental
          Remove-Item global.json

      - name: Override NuGet packages
        shell: bash
        run: |
          dotnet pack -c Release crates/bindings-csharp/BSATN.Runtime
          dotnet pack -c Release crates/bindings-csharp/Runtime
          cd sdks/csharp
          ./tools~/write-nuget-config.sh ../..

      - name: Install cargo-nextest
        uses: taiki-e/install-action@nextest

      - &download-build-artifacts
        name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-artifacts-${{ env.ARTIFACT_SUFFIX }}
          path: build-artifacts

      - &extract-build-artifacts
        name: Extract build artifacts
        shell: bash
        run: |
          archive_path="${PWD}/build-artifacts/build-support.tar.gz"
          exe_suffix=""
          if [[ "${RUNNER_OS}" == "Windows" ]]; then
            exe_suffix=".exe"
          fi
          mkdir -p "${CARGO_TARGET_DIR}"
          cd "${CARGO_TARGET_DIR}"
          tar -xzf "${archive_path}"
          test -f "release/spacetimedb-cli${exe_suffix}"
          test -f "release/spacetimedb-standalone${exe_suffix}"

      - name: Download smoketest build
        uses: actions/download-artifact@v4
        with:
          name: smoketest-build-${{ env.ARTIFACT_SUFFIX }}

      - name: Extract smoketest support files
        shell: bash
        run: |
          archive_path="${PWD}/smoketest-support.tar.gz"
          mkdir -p "${CARGO_TARGET_DIR}"
          cd "${CARGO_TARGET_DIR}"
          tar -xzf "${archive_path}"

      # Serial execution avoids contention between the C# tests over generated bindings.
      - name: Run smoketest partition (Linux)
        if: runner.os == 'Linux'
        shell: bash
        run: |
          if [ -f ~/emsdk/emsdk_env.sh ]; then
            source ~/emsdk/emsdk_env.sh
          fi
          cargo ci smoketests run-archive \
            --archive-file smoketest-nextest.tar.zst \
            -- \
            --partition hash:${{ matrix.partition }}/${{ env.PARTITION_COUNT }}

      # Due to Emscripten PATH issues this remains separate from the Linux command.
      - name: Run smoketest partition (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          if (Test-Path "$env:USERPROFILE\emsdk\emsdk_env.ps1") {
            & "$env:USERPROFILE\emsdk\emsdk_env.ps1" | Out-Null
          }
          & "$env:CARGO_TARGET_DIR\debug\ci-smoketests.exe" run-archive `
            --archive-file smoketest-nextest.tar.zst `
            -- `
            --partition hash:${{ matrix.partition }}/${{ env.PARTITION_COUNT }}

      - name: Upload timing reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-smoketests-${{ matrix.name }}
          path: ${{ env.CARGO_TARGET_DIR }}/cargo-timings/
          retention-days: 14

  smoketest_partitions_windows:
    needs: [smoketest_build_windows]
    name: Smoketests (Windows ${{ matrix.partition }}/4)
    strategy:
      fail-fast: false
      matrix:
        partition: [1, 2, 3, 4]
    runs-on: spacetimedb-windows-runner
    timeout-minutes: 30
    env:
      RUST_BACKTRACE: full
      SPACETIMEDB_CPP_DIR: ${{ github.workspace }}/crates/bindings-cpp
      ARTIFACT_SUFFIX: windows
      PARTITION_COUNT: 4
    steps: *smoketest-partition-steps

  # this is a no-op version of the above check with a trivially-passing body.
  # we can't just let the check be entirely skipped because each matrix target is a required check,
  # and skipping this check means that the matrix isn't "populated" so the required checks wouldn't be met.
  smoketests_noop:
    needs: [merge_queue_noop]
    if: ${{ needs.merge_queue_noop.outputs.skip == 'true' }}
    name: Smoketests (${{ matrix.name }})
    strategy:
      matrix:
        include:
          - name: Linux 1/1
          - name: Windows 1/4
          - name: Windows 2/4
          - name: Windows 3/4
          - name: Windows 4/4
    runs-on: spacetimedb-linux
    steps:
      - name: Skip duplicate merge queue smoketest
        run: echo "Merge queue commit has the same tree as the PR head; smoketest already ran for the PR."

  test:
    needs: [merge_queue_noop, lints, upload-build-artifacts-linux]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: Test Suite
    runs-on: spacetimedb-linux

    env:
      RUST_BACKTRACE: full
      ARTIFACT_SUFFIX: linux
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      - &set-spacetime-bin
        name: Set SpacetimeDB binary path
        shell: bash
        run: echo "SPACETIME_BIN=${CARGO_TARGET_DIR}/release/spacetimedb-cli" >>"${GITHUB_ENV}"

      - name: Find Git ref
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
          if test -n "${PR_NUMBER}"; then
            GIT_REF="$( gh pr view --repo clockworklabs/SpacetimeDB $PR_NUMBER --json headRefName --jq .headRefName )"
          else
            GIT_REF="${{ github.ref }}"
          fi
          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"

      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - *download-build-artifacts
      - *extract-build-artifacts

      - uses: actions/setup-dotnet@v3
        with:
          global-json-file: global.json

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: ./.github/actions/setup-pnpm
        with:
          run_install: true

      # Install cmake and emscripten for C++ module compilation tests.
      - name: Install cmake and emscripten
        run: |
          sudo apt-get update
          sudo apt-get install -y cmake
          git clone https://github.com/emscripten-core/emsdk.git ~/emsdk
          cd ~/emsdk
          ./emsdk install 4.0.21
          ./emsdk activate 4.0.21

      - name: Install wasm-bindgen CLI
        run: |
          REQUIRED_WASM_BINDGEN_VERSION="$(
            awk '
              $1 == "name" && $3 == "\"wasm-bindgen\"" { in_pkg = 1; next }
              in_pkg && $1 == "version" {
                gsub(/"/, "", $3);
                print $3;
                exit;
              }
            ' Cargo.lock
          )"
          if [ -z "${REQUIRED_WASM_BINDGEN_VERSION}" ]; then
            echo "Failed to determine wasm-bindgen version from Cargo.lock"
            exit 1
          fi

          INSTALLED_WASM_BINDGEN_VERSION="$(wasm-bindgen --version 2>/dev/null | awk '{print $2}' || true)"
          if [ "${INSTALLED_WASM_BINDGEN_VERSION}" != "${REQUIRED_WASM_BINDGEN_VERSION}" ]; then
            cargo install --locked --force wasm-bindgen-cli --version "${REQUIRED_WASM_BINDGEN_VERSION}"
          fi

          wasm-bindgen --version

        # Source emsdk environment to make emcc (Emscripten compiler) available in PATH.
      - name: Run tests
        run: |
          source ~/emsdk/emsdk_env.sh
          cargo ci test

      - *show-sccache-stats

      - name: Upload timing reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-test
          path: ${{ env.CARGO_TARGET_DIR }}/cargo-timings/
          retention-days: 14

  index_scan_bench:
    needs: [merge_queue_noop, lints]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: Index Scan Bench
    runs-on: spacetimedb-benchmark-runner
    concurrency:
      group: ci-benchmark-runner
      queue: max
    timeout-minutes: 60
    env:
      RUST_BACKTRACE: full
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      - name: Find Git ref
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
          if test -n "${PR_NUMBER}"; then
            GIT_REF="$( gh pr view --repo clockworklabs/SpacetimeDB $PR_NUMBER --json headRefName --jq .headRefName )"
          else
            GIT_REF="${{ github.ref }}"
          fi
          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"

      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - name: Run index scan benchmark regression check
        run: cargo run --release -p spacetimedb-index-scan-gate

      - *show-sccache-stats

  lints:
    needs: [merge_queue_noop]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: Lints
    runs-on: spacetimedb-linux
    env:
      RUST_BACKTRACE: full
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      - name: Checkout sources
        uses: actions/checkout@v3

      - uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)
      - run: echo ::add-matcher::.github/workflows/rust_matcher.json

      - uses: actions/setup-dotnet@v3
        with:
          global-json-file: global.json

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: ./.github/actions/setup-pnpm
        with:
          run_install: true

      - name: Run ci lint
        run: cargo ci lint

      - *show-sccache-stats

      - name: Upload timing reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-public-lints
          path: ${{ env.CARGO_TARGET_DIR }}/cargo-timings/
          retention-days: 14

  codeowners_check:
    if: ${{ github.event_name == 'pull_request' }}
    name: CODEOWNERS check
    runs-on: spacetimedb-linux
    permissions:
      contents: read
      pull-requests: read
    env:
      RUST_BACKTRACE: full
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - name: Run CODEOWNERS check
        run: |
          cargo ci other-workflows codeowners-check \
            --base-ref "origin/${{ github.event.pull_request.base.ref }}" \
            --pr-number "${{ github.event.pull_request.number }}"

      - name: Upload timing reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-codeowners-check
          path: ${{ env.CARGO_TARGET_DIR }}/cargo-timings/
          retention-days: 14

  module_latest_deps:
    needs: [merge_queue_noop, upload-build-artifacts-linux]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: Build and test wasm bindings
    runs-on: spacetimedb-linux
    env:
      RUST_BACKTRACE: full
      ARTIFACT_SUFFIX: linux
    steps:
      - *set-cargo-target-dir
      - *configure-sccache
      - *set-spacetime-bin

      - *find-git-ref
      - *checkout-sources

      - uses: dsherret/rust-toolchain-file@v1
      - *set-default-rust-toolchain
      - run: echo ::add-matcher::.github/workflows/rust_matcher.json

      - *download-build-artifacts
      - *extract-build-artifacts

      - name: Build module with latest compatible dependencies
        run: cargo ci module-latest-deps

      - *show-sccache-stats

  publish_checks:
    needs: [merge_queue_noop]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: Check that packages are publishable
    runs-on: spacetimedb-linux
    permissions: read-all
    env:
      RUST_BACKTRACE: full
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      - uses: actions/checkout@v3
      - uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)
      - name: Run checks
        run: cargo ci publish-checks

      - name: Upload timing reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-publish-checks
          path: ${{ env.CARGO_TARGET_DIR }}/cargo-timings/
          retention-days: 14

  update:
    needs: [merge_queue_noop]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: Test spacetimedb-update flow (${{ matrix.target }})
    permissions: read-all
    strategy:
      matrix:
        include:
          - { target: x86_64-unknown-linux-gnu, runner: spacetimedb-linux }
          - { target: aarch64-apple-darwin, runner: macos-latest }
          - { target: x86_64-pc-windows-msvc, runner: windows-latest }
    runs-on: ${{ matrix.runner }}
    env:
      RUST_BACKTRACE: full
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      - *find-git-ref
      - *checkout-sources

      - name: Install Rust
        uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - name: Install rust target
        run: rustup target add ${{ matrix.target }}

      - name: Test spacetimedb-update
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: cargo ci update-flow --target=${{ matrix.target }} --github-token-auth

      - *show-sccache-stats

      - name: Upload timing reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-update-flow-${{ matrix.target }}
          path: ${{ env.CARGO_TARGET_DIR }}/cargo-timings/
          retention-days: 14

  # this is a no-op version of the above check with a trivially-passing body.
  # we can't just let the check be entirely skipped because each matrix target is a required check,
  # and skipping this check means that the matrix isn't "populated" so the required checks wouldn't be met.
  update_noop:
    needs: [merge_queue_noop]
    if: ${{ needs.merge_queue_noop.outputs.skip == 'true' }}
    name: Test spacetimedb-update flow (${{ matrix.target }})
    permissions: read-all
    strategy:
      matrix:
        include:
          - { target: x86_64-unknown-linux-gnu }
          - { target: aarch64-apple-darwin }
          - { target: x86_64-pc-windows-msvc }
    runs-on: spacetimedb-linux
    steps:
      - name: Skip duplicate merge queue update test
        run: echo "Merge queue commit has the same tree as the PR head; update-flow already ran for the PR."

  unreal_engine_tests:
    name: Unreal Engine Tests
    # This can't go on e.g. ubuntu-latest because that runner runs out of disk space. ChatGPT suggested that the general solution tends to be to use
    # a custom runner.
    runs-on: spacetimedb-linux
    # Disable the tests because they are very flaky at the moment.
    # TODO: Remove this line and re-enable the `if` line just below here.
    if: false
    # Skip if this is an external contribution. GitHub secrets will be empty, so the step would fail anyway.
    # if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
    container:
      image: ghcr.io/epicgames/unreal-engine:dev-5.6
      credentials:
        # Note(bfops): I don't think that `github.actor` needs to match the user that the token is for, because I'm using a token for my account and
        # it seems to be totally happy.
        # However, the token needs to be for a user that has access to the EpicGames org (see
        # https://dev.epicgames.com/documentation/en-us/unreal-engine/downloading-source-code-in-unreal-engine?application_version=5.6)
        username: ${{ github.actor }}
        password: ${{ secrets.GHCR_TOKEN }}
      # Run as root because otherwise we get permission denied for various directories inside the container. I tried doing dances to allow it to run
      # without this (reassigning env vars and stuff), but was unable to get it to work and it felt like an uphill battle.
      options: --user 0:0
    env:
      RUST_BACKTRACE: full
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      # Uncomment this before merging so that it will run properly if run manually through the GH actions flow. It was playing weird with rolled back
      # commits though.
      #      - name: Find Git ref
      #        env:
      #          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      #        shell: bash
      #        run: |
      #          PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
      #          if test -n "${PR_NUMBER}"; then
      #            GIT_REF="$( gh pr view --repo clockworklabs/SpacetimeDB $PR_NUMBER --json headRefName --jq .headRefName )"
      #          else
      #            GIT_REF="${{ github.ref }}"
      #          fi
      #          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}
      - uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)
      - name: Run Unreal Engine tests
        working-directory: sdks/unreal
        env:
          UE_ROOT_PATH: /home/ue4/UnrealEngine
        run: |

          apt-get update
          apt-get install -y acl curl ca-certificates

          REPO="$GITHUB_WORKSPACE"
          # Let ue4 read/write the workspace & tool caches without changing ownership
          for p in "$REPO" "${RUNNER_TEMP:-/__t}" "${RUNNER_TOOL_CACHE:-/__t}"; do
            [ -d "$p" ] && setfacl -R -m u:ue4:rwX -m d:u:ue4:rwX "$p" || true
          done

          # Rust tool caches live under the runner tool cache so they persist
          export CARGO_HOME="${RUNNER_TOOL_CACHE:-/__t}/cargo"
          export RUSTUP_HOME="${RUNNER_TOOL_CACHE:-/__t}/rustup"
          mkdir -p "$CARGO_HOME" "$RUSTUP_HOME"
          chown -R ue4:ue4 "$CARGO_HOME" "$RUSTUP_HOME"

          # Make sure the UE build script is executable (and parents traversable)
          UE_DIR="${UE_ROOT_PATH:-/home/ue4/UnrealEngine}"
          chmod a+rx "$UE_DIR" "$UE_DIR/Engine" "$UE_DIR/Engine/Build" "$UE_DIR/Engine/Build/BatchFiles/Linux" || true
          chmod a+rx "$UE_DIR/Engine/Build/BatchFiles/Linux/Build.sh" || true

          # Run the build & tests as ue4 (who owns the UE tree)
          sudo -E -H -u ue4 env \
            HOME=/home/ue4 \
            XDG_CONFIG_HOME=/home/ue4/.config \
            CARGO_HOME="$CARGO_HOME" \
            RUSTUP_HOME="$RUSTUP_HOME" \
            PATH="$CARGO_HOME/bin:$PATH" \
            bash -lc '
              set -euxo pipefail
              # Install rustup for ue4 if needed (uses the shared caches)
              if ! command -v cargo >/dev/null 2>&1; then
                curl -sSf https://sh.rustup.rs | sh -s -- -y
              fi
              rustup show >/dev/null
              git config --global --add safe.directory "$GITHUB_WORKSPACE" || true

              cd "$GITHUB_WORKSPACE/sdks/unreal"
              cargo --version
              cargo test -- --test-threads=1
            '

  cli_docs:
    needs: [merge_queue_noop]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: Check CLI docs
    permissions: read-all
    runs-on: spacetimedb-linux
    env:
      RUST_BACKTRACE: full
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      - name: Find Git ref
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
          if test -n "${PR_NUMBER}"; then
            GIT_REF="$( gh pr view --repo clockworklabs/SpacetimeDB $PR_NUMBER --json headRefName --jq .headRefName )"
          else
            GIT_REF="${{ github.ref }}"
          fi
          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"

      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: ./.github/actions/setup-pnpm
        with:
          run_install: true

      - uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - name: Check for docs change
        run: |
          cargo ci cli-docs

      - *show-sccache-stats

      - name: Upload timing reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-cli-docs
          path: ${{ env.CARGO_TARGET_DIR }}/cargo-timings/
          retention-days: 14

  unity-testsuite:
    needs: [merge_queue_noop, lints, upload-build-artifacts-linux]
    # Skip if this is an external contribution.
    # The license secrets will be empty, so the step would fail anyway.
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) }}
    permissions:
      contents: read
      checks: write
    runs-on: spacetimedb-unity-runner
    timeout-minutes: 30
    env:
      RUST_BACKTRACE: full
      ARTIFACT_SUFFIX: linux
      UNITY_VERSION: 2022.3.32f1
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      - *find-git-ref
      - *checkout-sources

      # Keep this before generation/hydration so ignored build outputs do not affect hashFiles.
      - name: Restore Unity Library
        id: restore-unity-library
        uses: actions/cache/restore@v4
        with:
          path: demo/Blackholio/client-unity/Library
          key: Unity-v2-${{ runner.os }}-${{ env.UNITY_VERSION }}-${{ hashFiles('demo/Blackholio/client-unity/**', 'sdks/csharp/**', 'crates/bindings-csharp/BSATN.Runtime/**', 'crates/bindings-csharp/Runtime/**', 'crates/bindings-csharp/Directory.Build.props', 'tools/regen/src/csharp.rs', 'global.json') }}
          restore-keys: |
            Unity-v2-${{ runner.os }}-${{ env.UNITY_VERSION }}-

      # Run cheap .NET tests first. If those fail, no need to run expensive Unity tests.

      - name: Setup dotnet
        uses: actions/setup-dotnet@v3
        with:
          global-json-file: global.json

      - name: Override NuGet packages
        run: |
          dotnet pack crates/bindings-csharp/BSATN.Runtime
          dotnet pack crates/bindings-csharp/Runtime

          # Write out the nuget config file to `nuget.config`. This causes the spacetimedb-csharp-sdk repository
          # to be aware of the local versions of the `bindings-csharp` packages in SpacetimeDB, and use them if
          # available. Otherwise, `spacetimedb-csharp-sdk` will use the NuGet versions of the packages.
          # This means that (if version numbers match) we will test the local versions of the C# packages, even
          # if they're not pushed to NuGet.
          # See https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file for more info on the config file.
          cd sdks/csharp
          ./tools~/write-nuget-config.sh ../..

      - name: Restore .NET solution
        working-directory: sdks/csharp
        run: dotnet restore --configfile NuGet.Config SpacetimeDB.ClientSDK.sln

      # Now, setup the Unity tests.
      - name: Patch spacetimedb dependency in Cargo.toml
        working-directory: demo/Blackholio/server-rust
        run: |
          sed -i "s|spacetimedb *=.*|spacetimedb = \{ path = \"../../../crates/bindings\" \}|" Cargo.toml
          cat Cargo.toml

      - name: Install Rust toolchain
        uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - *download-build-artifacts
      - *extract-build-artifacts

      - &expose-spacetime-cli
        name: Expose SpacetimeDB CLI on PATH
        shell: bash
        run: |
          ln -sf spacetimedb-cli "${CARGO_TARGET_DIR}/release/spacetime"
          echo "${CARGO_TARGET_DIR}/release" >>"${GITHUB_PATH}"

      - name: Generate client bindings
        working-directory: demo/Blackholio/server-rust
        run: bash ./generate.sh -y

      - name: Check for changes
        run: |
          tools/check-diff.sh demo/Blackholio/client-unity/Assets/Scripts/autogen || {
              echo 'Error: Bindings are dirty. Please run `demo/Blackholio/server-rust/generate.sh`.'
              exit 1
          }

      - name: Hydrate Unity SDK DLLs
        run: cargo regen csharp dlls

      - name: Check Unity meta files
        uses: DeNA/unity-meta-check@v3
        with:
          enable_pr_comment: ${{ github.event_name == 'pull_request' }}
          target_path: sdks/csharp
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

      - name: Start SpacetimeDB
        run: |
          spacetime start &
          disown

      - name: Publish unity-tests module to SpacetimeDB
        working-directory: demo/Blackholio/server-rust
        run: |
          spacetime logout && spacetime login --server-issued-login local
          bash ./publish.sh

      - name: Patch com.clockworklabs.spacetimedbsdk dependency in manifest.json
        working-directory: demo/Blackholio/client-unity/Packages
        run: |
          yq e -i '.dependencies["com.clockworklabs.spacetimedbsdk"] = "file:../../../../sdks/csharp"' manifest.json
          cat manifest.json

      - name: Run Unity tests
        uses: game-ci/unity-test-runner@v4
        with:
          unityVersion: ${{ env.UNITY_VERSION }}
          projectPath: demo/Blackholio/client-unity # Path to the Unity project subdirectory
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          testMode: playmode
          useHostNetwork: true
          artifactsPath: ""
        env:
          UNITY_EMAIL: ${{ secrets.UNITY_EMAIL }}
          UNITY_PASSWORD: ${{ secrets.UNITY_PASSWORD }}
          UNITY_SERIAL: ${{ secrets.UNITY_SERIAL }}

      - name: Save Unity Library
        if: ${{ github.ref == 'refs/heads/master' && steps.restore-unity-library.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@v4
        with:
          path: demo/Blackholio/client-unity/Library
          key: ${{ steps.restore-unity-library.outputs.cache-primary-key }}

  unity-webgl-build:
    name: Unity WebGL build
    needs: [merge_queue_noop, lints]
    # Skip if this is an external contribution.
    # The license secrets will be empty, so the step would fail anyway.
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) }}
    permissions:
      contents: read
    runs-on: spacetimedb-unity-runner
    timeout-minutes: 30
    env:
      CARGO_TARGET_DIR: ${{ github.workspace }}/target
      UNITY_VERSION: 2022.3.32f1
    steps:
      - *find-git-ref
      - *checkout-sources

      # Keep this before hydration so ignored build outputs do not affect hashFiles.
      - name: Restore Unity WebGL Library
        id: restore-unity-webgl-library
        uses: actions/cache/restore@v4
        with:
          path: demo/Blackholio/client-unity/Library
          key: Unity-WebGL-v1-${{ runner.os }}-${{ env.UNITY_VERSION }}-${{ hashFiles('demo/Blackholio/client-unity/**', 'sdks/csharp/**', 'crates/bindings-csharp/BSATN.Runtime/**', 'crates/bindings-csharp/Runtime/**', 'crates/bindings-csharp/Directory.Build.props', 'tools/regen/src/csharp.rs', 'global.json') }}
          restore-keys: |
            Unity-WebGL-v1-${{ runner.os }}-${{ env.UNITY_VERSION }}-

      - name: Setup dotnet
        uses: actions/setup-dotnet@v3
        with:
          global-json-file: global.json

      - name: Install Rust toolchain
        uses: dsherret/rust-toolchain-file@v1
      - *set-default-rust-toolchain

      - name: Hydrate Unity SDK DLLs
        run: cargo regen csharp dlls

      - name: Build Unity WebGL player
        uses: game-ci/unity-builder@v4
        with:
          unityVersion: ${{ env.UNITY_VERSION }}
          projectPath: demo/Blackholio/client-unity
          targetPlatform: WebGL
          buildsPath: demo/Blackholio/client-unity/Build
          versioning: None
          runAsHostUser: true
        env:
          UNITY_EMAIL: ${{ secrets.UNITY_EMAIL }}
          UNITY_PASSWORD: ${{ secrets.UNITY_PASSWORD }}
          UNITY_SERIAL: ${{ secrets.UNITY_SERIAL }}

      - name: Save Unity WebGL Library
        if: ${{ github.ref == 'refs/heads/master' && steps.restore-unity-webgl-library.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@v4
        with:
          path: demo/Blackholio/client-unity/Library
          key: ${{ steps.restore-unity-webgl-library.outputs.cache-primary-key }}

  godot-testsuite:
    needs: [merge_queue_noop, lints, upload-build-artifacts-linux]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    permissions:
      contents: read
    runs-on: spacetimedb-linux
    env:
      ARTIFACT_SUFFIX: linux
      UseLocalBsatnRuntime: true
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      - *find-git-ref
      - *checkout-sources

      - name: Setup dotnet
        uses: actions/setup-dotnet@v3
        with:
          global-json-file: global.json

      - name: Override NuGet packages
        run: |
          dotnet pack -c Release crates/bindings-csharp/BSATN.Runtime
          dotnet pack -c Release crates/bindings-csharp/Runtime

          # Write out the nuget config file to `nuget.config`. This causes the spacetimedb-csharp-sdk repository
          # to be aware of the local versions of the `bindings-csharp` packages in SpacetimeDB, and use them if
          # available. Otherwise, `spacetimedb-csharp-sdk` will use the NuGet versions of the packages.
          # This means that (if version numbers match) we will test the local versions of the C# packages, even
          # if they're not pushed to NuGet.
          # See https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file for more info on the config file.
          cd sdks/csharp
          ./tools~/write-nuget-config.sh ../..

      - name: Restore .NET solution
        working-directory: sdks/csharp
        run: dotnet restore --configfile NuGet.Config SpacetimeDB.ClientSDK.sln

      # Now, setup the Godot tests.
      - name: Patch spacetimedb dependency in Cargo.toml
        working-directory: demo/Blackholio/server-rust
        run: |
          sed -i "s|spacetimedb *=.*|spacetimedb = \{ path = \"../../../crates/bindings\" \}|" Cargo.toml
          cat Cargo.toml

      - name: Install Rust toolchain
        uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - *download-build-artifacts
      - *extract-build-artifacts
      - *expose-spacetime-cli

      - name: Generate client bindings
        working-directory: demo/Blackholio/server-rust
        run: bash ./generate.sh -y

      - name: Check for changes
        run: |
          tools/check-diff.sh demo/Blackholio/client-godot/module_bindings || {
              echo 'Error: Godot bindings are dirty. Please run `demo/Blackholio/server-rust/generate.sh`.'
              exit 1
          }

      - name: Patch SpacetimeDB Godot SDK dependency
        working-directory: demo/Blackholio/client-godot
        run: |
          dotnet remove package SpacetimeDB.ClientSDK.Godot
          dotnet add reference ../../../sdks/csharp/SpacetimeDB.ClientSDK.Godot.csproj
          cat blackholio.csproj

      - name: Setup Godot
        uses: chickensoft-games/setup-godot@v2
        with:
          version: 4.6.2
          use-dotnet: true

      - name: Restore Godot project
        working-directory: demo/Blackholio/client-godot
        run: dotnet restore --configfile ../../../NuGet.Config blackholio.csproj

      - name: Build Godot project
        working-directory: demo/Blackholio/client-godot
        run: godot --headless --verbose --build-solutions --quit

      - name: Start SpacetimeDB
        run: |
          spacetime start &
          disown

      - name: Publish godot-tests module to SpacetimeDB
        working-directory: demo/Blackholio/server-rust
        run: |
          spacetime login --server-issued-login local
          bash ./publish.sh

      - name: Run Godot tests
        working-directory: demo/Blackholio/client-godot
        run: godot --headless --scene res://tests/GodotPlayModeTests.tscn

      - *show-sccache-stats

  csharp-testsuite:
    needs: [merge_queue_noop, lints, upload-build-artifacts-linux]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    runs-on: spacetimedb-linux
    timeout-minutes: 30
    env:
      RUST_BACKTRACE: full
      ARTIFACT_SUFFIX: linux
    steps:
      - *set-cargo-target-dir
      - *configure-sccache
      - *set-spacetime-bin

      - *find-git-ref
      - *checkout-sources

      - name: Setup dotnet
        uses: actions/setup-dotnet@v3
        with:
          global-json-file: global.json

      - name: Install .NET workloads
        run: |
          dotnet workload config --update-mode manifests
          dotnet workload update --from-previous-sdk
          # Explicitly install wasi-experimental for .NET 8 SDK (needed for test_build_csharp_module)
          # Create temp global.json to target .NET 8 SDK for workload install
          echo '{"sdk":{"version":"8.0.100","rollForward":"latestFeature"}}' > global.json
          dotnet workload install wasi-experimental
          rm global.json

      - name: Override NuGet packages
        run: |
          dotnet pack crates/bindings-csharp/BSATN.Runtime
          dotnet pack crates/bindings-csharp/Runtime

          # Write out the nuget config file to `nuget.config`. This causes the spacetimedb-csharp-sdk repository
          # to be aware of the local versions of the `bindings-csharp` packages in SpacetimeDB, and use them if
          # available. Otherwise, `spacetimedb-csharp-sdk` will use the NuGet versions of the packages.
          # This means that (if version numbers match) we will test the local versions of the C# packages, even
          # if they're not pushed to NuGet.
          # See https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file for more info on the config file.
          cd sdks/csharp
          ./tools~/write-nuget-config.sh ../..

      - name: Restore .NET solution
        working-directory: sdks/csharp
        run: dotnet restore --configfile NuGet.Config SpacetimeDB.ClientSDK.sln

      - name: Run .NET tests
        working-directory: sdks/csharp
        run: dotnet test -warnaserror --no-restore SpacetimeDB.ClientSDK.csproj

      - name: Verify C# formatting
        working-directory: sdks/csharp
        run: dotnet format --no-restore --verify-no-changes SpacetimeDB.ClientSDK.sln

      - name: Install Rust toolchain
        uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - *download-build-artifacts
      - *extract-build-artifacts
      - *expose-spacetime-cli

      - name: Check quickstart-chat bindings are up to date
        run: |
          for dotnet_version in 8 10; do
            bash sdks/csharp/tools~/gen-quickstart.sh "$dotnet_version"
          done
          tools/check-diff.sh templates/chat-console-cs/module_bindings || {
              echo 'Error: quickstart-chat bindings have changed. Please run `sdks/csharp/tools~/gen-quickstart.sh 10`.'
              exit 1
          }

      # TODO: Re-enable this once csharp is using the v2 ws api.
      # - name: Check client-api bindings are up to date
      #   working-directory: sdks/csharp
      #   run: |
      #     bash tools~/gen-client-api.sh
      #     "${GITHUB_WORKSPACE}"/tools/check-diff.sh src/SpacetimeDB/ClientApi || {
      #         echo 'Error: Client API bindings are dirty. Please run `sdks/csharp/tools~/gen-client-api.sh`.'
      #         exit 1
      #     }

      - name: Start SpacetimeDB
        run: |
          spacetime start &
          disown

      - name: Run regression tests
        run: |
          bash sdks/csharp/tools~/run-regression-tests.sh
          # Restore global.json symlinks (we replaced them with files to work around .NET 10 SDK bug)
          # server is 5 levels deep from root, republishing dirs are 6 levels deep
          if [ -f sdks/csharp/examples~/regression-tests/server/global.json ] && [ ! -L sdks/csharp/examples~/regression-tests/server/global.json ]; then
            echo "Restoring symlink at server/global.json"
            rm -f sdks/csharp/examples~/regression-tests/server/global.json
            ln -s ../../../../../global.json sdks/csharp/examples~/regression-tests/server/global.json
          fi
          for dir in sdks/csharp/examples~/regression-tests/republishing/server-initial \
                     sdks/csharp/examples~/regression-tests/republishing/server-republish; do
            if [ -f "$dir/global.json" ] && [ ! -L "$dir/global.json" ]; then
              echo "Restoring symlink at $dir/global.json"
              rm -f "$dir/global.json"
              ln -s ../../../../../../global.json "$dir/global.json"
            fi
          done
          tools/check-diff.sh sdks/csharp/examples~/regression-tests || {
              echo 'Error: Bindings are dirty. Please run `sdks/csharp/tools~/gen-regression-tests.sh`.'
              exit 1
          }

      - *show-sccache-stats

  global_json_policy:
    needs: [merge_queue_noop]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: Verify global.json files are symlinks
    runs-on: spacetimedb-linux
    permissions:
      contents: read
    env:
      RUST_BACKTRACE: full
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      - name: Find Git ref
        env:
          PR_NUMBER: ${{ github.event.inputs.pr_number }}
        run: |
          if [ -n "$PR_NUMBER" ]; then
            GIT_REF="refs/pull/$PR_NUMBER/merge"
          else
            GIT_REF="${{ github.ref }}"
          fi
          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"

      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - name: Check global.json policy
        run: cargo ci global-json-policy

      - name: Upload timing reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-global-json-policy
          path: ${{ env.CARGO_TARGET_DIR }}/cargo-timings/
          retention-days: 14

  smoketests_mod_rs_complete:
    needs: [merge_queue_noop]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: Check smoketests/mod.rs is complete
    runs-on: spacetimedb-linux
    permissions:
      contents: read
    env:
      RUST_BACKTRACE: full
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      - name: Find Git ref
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
          if test -n "${PR_NUMBER}"; then
            GIT_REF="$( gh pr view --repo clockworklabs/SpacetimeDB $PR_NUMBER --json headRefName --jq .headRefName )"
          else
            GIT_REF="${{ github.ref }}"
          fi
          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}
      - uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - name: Verify smoketest module lists and suite constraints
        run: cargo ci smoketests check-mod-list

  docs-build:
    needs: [merge_queue_noop]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: Docs build
    runs-on: spacetimedb-linux
    env:
      RUST_BACKTRACE: full
    steps:
      - *set-cargo-target-dir
      - *configure-sccache

      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Set up Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '22'

      - uses: ./.github/actions/setup-pnpm
        with:
          run_install: true

      - uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - name: Docusaurus build
        run: cargo ci docs

      - name: Upload timing reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-docs-build
          path: ${{ env.CARGO_TARGET_DIR }}/cargo-timings/
          retention-days: 14

      - *show-sccache-stats

  typescript-test:
    needs: [merge_queue_noop, upload-build-artifacts-linux]
    if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
    name: TypeScript - Tests
    runs-on: spacetimedb-linux
    env:
      RUST_BACKTRACE: full
      ARTIFACT_SUFFIX: linux
    steps:
      - *set-cargo-target-dir
      - *configure-sccache
      - *set-spacetime-bin

      - *find-git-ref
      - *checkout-sources

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: ./.github/actions/setup-pnpm
        with:
          run_install: true

      - name: Install Rust toolchain
        uses: dsherret/rust-toolchain-file@v1
      - name: Set default rust toolchain
        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)

      - *download-build-artifacts
      - *extract-build-artifacts

      - name: Run TypeScript tests
        run: cargo ci typescript-test

      - *show-sccache-stats

      - name: Upload timing reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-typescript-test
          path: ${{ env.CARGO_TARGET_DIR }}/cargo-timings/
          retention-days: 14

      # - name: Run quickstart-chat tests
      #   working-directory: examples/quickstart-chat
      #   run: pnpm test
      #
      # # Run this step always, even if the previous steps fail
      # - name: Print rows in the user table
      #   if: always()
      #   run: spacetime sql quickstart-chat "SELECT * FROM user"