name: "Unit Tests: Proxy DB Operations"

# Uses DATABASE_URL secret — only runs on trusted branches, not PRs.
on:
  push:
    branches: [main, "litellm_*"]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  proxy-db:
    strategy:
      fail-fast: false
      matrix:
        include:
          # Key generation tests must NOT run in parallel (event loop conflicts with logging worker)
          - test-group: key-generation
            test-path: "tests/proxy_unit_tests/test_key_generate_prisma.py"
            workers: 0
            timeout: 30
          - test-group: auth-checks
            test-path: "tests/proxy_unit_tests/test_auth_checks.py tests/proxy_unit_tests/test_user_api_key_auth.py"
            workers: 8
            timeout: 20
          - test-group: remaining
            test-path: "tests/proxy_unit_tests --ignore=tests/proxy_unit_tests/test_key_generate_prisma.py --ignore=tests/proxy_unit_tests/test_auth_checks.py --ignore=tests/proxy_unit_tests/test_user_api_key_auth.py"
            workers: 8
            timeout: 20
    uses: ./.github/workflows/_test-unit-services-base.yml
    with:
      test-path: ${{ matrix.test-path }}
      workers: ${{ matrix.workers }}
      reruns: 2
      timeout-minutes: ${{ matrix.timeout }}
      enable-redis: false
      enable-postgres: true
    secrets:
      DATABASE_URL: ${{ secrets.DATABASE_URL }}
      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}