name: Apply Caterium Basic Signup Migration

on:
  push:
    branches: ["main"]
    paths:
      - ".github/workflows/migrate-basic-signup.yml"
      - "ops/sql/SUPABASE-V17.9.1-PUBLIC-BASIC-SIGNUP.sql"
      - "supabase/migrations/20260922102500_public_basic_signup.sql"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: caterium-basic-signup-migration
  cancel-in-progress: false

jobs:
  migrate:
    runs-on: ubuntu-latest
    timeout-minutes: 8
    env:
      PGHOST: db.usfjwhztqoopzzfmfbis.supabase.co
      PGPORT: "5432"
      PGDATABASE: postgres
      PGUSER: postgres
      PGPASSWORD: ${{ secrets.SUPABASE_DB_PASSWORD }}
      PGSSLMODE: require
    steps:
      - uses: actions/checkout@v4

      - name: Require configured database password
        shell: bash
        run: |
          set -euo pipefail
          if [ -z "${PGPASSWORD:-}" ]; then
            echo "::error::Repository secret SUPABASE_DB_PASSWORD is not configured."
            exit 2
          fi

      - name: Apply only v17.9.1 public Basic signup migration
        shell: bash
        run: |
          set -euo pipefail
          psql -v ON_ERROR_STOP=1 -f ops/sql/SUPABASE-V17.9.1-PUBLIC-BASIC-SIGNUP.sql

      - name: Verify server policy and workspace function
        shell: bash
        run: |
          set -euo pipefail
          psql -v ON_ERROR_STOP=1 -At <<'SQL'
          select public.caterium_public_signup_policy();
          select case
            when pg_get_functiondef('public.sun_create_workspace(text)'::regprocedure) like '%public_signup_basic%'
             and pg_get_functiondef('public.sun_create_workspace(text)'::regprocedure) like '%v_promo.plan_id%'
            then 'PASS'
            else 'FAIL'
          end;
          SQL