name: "Unit Tests: Proxy DB Operations"

# Uses DATABASE_URL secret — only runs on trusted branches, not PRs.
on:
  push:
    branches: [main, "litellm_**"]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  proxy-db:
    permissions:
      contents: read
      id-token: write
      pull-requests: write
    strategy:
      fail-fast: false
      matrix:
        include:
          # Key generation tests must NOT run in parallel (event loop conflicts with logging worker)
          - test-group: key-generation
            test-path: "tests/proxy_unit_tests/test_key_generate_prisma.py"
            workers: 0
            timeout: 30
          - test-group: auth-checks
            test-path: "tests/proxy_unit_tests/test_auth_checks.py tests/proxy_unit_tests/test_user_api_key_auth.py"
            workers: 8
            timeout: 20
          # test_proxy_utils.py is large (168+ parametrized tests) — run it on its
          # own matrix so --dist=loadscope doesn't pin all of it to a single xdist
          # worker and push the "remaining" group past the job timeout.
          - test-group: proxy-utils
            test-path: "tests/proxy_unit_tests/test_proxy_utils.py"
            workers: 8
            timeout: 20
          - test-group: remaining
            test-path: "tests/proxy_unit_tests --ignore=tests/proxy_unit_tests/test_key_generate_prisma.py --ignore=tests/proxy_unit_tests/test_auth_checks.py --ignore=tests/proxy_unit_tests/test_user_api_key_auth.py --ignore=tests/proxy_unit_tests/test_proxy_utils.py"
            workers: 8
            timeout: 30
    uses: ./.github/workflows/_test-unit-services-base.yml
    with:
      test-path: ${{ matrix.test-path }}
      workers: ${{ matrix.workers }}
      reruns: 2
      timeout-minutes: ${{ matrix.timeout }}
      enable-postgres: true
      artifact-name: proxy-db-${{ matrix.test-group }}
    secrets:
      DATABASE_URL: ${{ secrets.DATABASE_URL }}
      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}