From a4c226ddb20a5b9f2c5594f733f7eea71fd4635c Mon Sep 17 00:00:00 2001
From: Andrii Tsok <andrii@tsok.org>
Date: Mon, 20 Apr 2026 21:31:02 +0000
Subject: [PATCH] feat(nx-ci): add test_integration input + grant PROCESS to
 MySQL test user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two related changes that together let a workspace move its integration
test lane off a dedicated per-plugin workflow (like mcpg-dev's
sql-integration.yml) and back onto nx-ci.yml alongside lint / test /
build.

nx-ci.yml — new `test_integration: bool` input (default false). When
true, runs `pnpm nx <affected|run-many> -t test:integration` after the
main `test` step. Projects that don't declare the target are skipped
silently by Nx. Intended for CD-gated lanes where callers flip this on
for merges / PRs targeting core branches (main / develop / next).

environment-setup — grant PROCESS on *.* to the mcpg MySQL test user
alongside the existing database-scoped GRANT ALL. MySQL 8 requires
PROCESS for `KILL QUERY` across sessions, which the sql-binding
integration tests exercise when validating cancellation. Safe on an
ephemeral CI database that only the test user touches.

Callers that want the CD-gated integration lane can now drop their
dedicated workflow, toggle `test_integration: true` + flip
`environment_skip` to include services, and rely on the same
reusable workflow path as every other target.
---
 .github/workflows/nx-ci.yml          | 51 ++++++++++++++++++++++++++++
 actions/environment-setup/action.yml |  6 ++++
 2 files changed, 57 insertions(+)

diff --git a/.github/workflows/nx-ci.yml b/.github/workflows/nx-ci.yml
index 74f0656..5a17d08 100644
--- a/.github/workflows/nx-ci.yml
+++ b/.github/workflows/nx-ci.yml
@@ -124,6 +124,24 @@ on:
         type: boolean
         default: false
 
+      test_integration:
+        description: |
+          Run the `test:integration` Nx target on projects that define it.
+          Intended for CD-gated lanes (merges / PRs targeting main / develop
+          / next) where integration suites against real databases, services,
+          and other heavy fixtures should run. Feature-branch PRs typically
+          keep this off so daily iteration stays fast.
+
+          Projects without a `test:integration` target are skipped silently
+          (nx reports the target is missing and moves on).
+
+          Services that integration suites depend on (postgres, mysql,
+          redis, nats, etc.) must be enabled via `environment_skip` /
+          `.environment.yml` — this input only runs the target.
+        required: false
+        type: boolean
+        default: false
+
       custom_tasks:
         description: |
           Additional custom tasks to run (comma-separated).
@@ -455,6 +473,39 @@ jobs:
           echo "Running: $CMD"
           $CMD
 
+      # ════════════════════════════════════════════════════════════════════════
+      # 🧪 TEST:INTEGRATION (OPTIONAL, CD-GATED)
+      # ════════════════════════════════════════════════════════════════════════
+
+      - name: Run test:integration
+        id: test_integration
+        if: inputs.test_integration
+        run: |
+          echo "🧪 Running test:integration..."
+          CMD="pnpm nx"
+
+          if [ "${{ inputs.affected_only }}" == "true" ]; then
+            CMD="$CMD affected"
+          else
+            CMD="$CMD run-many"
+          fi
+
+          # Projects without a `test:integration` target are skipped by Nx,
+          # so `run-many -t test:integration` is safe to run across every
+          # project even when only a subset declares the target.
+          CMD="$CMD -t test:integration --parallel=${{ inputs.parallel }}"
+
+          if [ -n "${{ inputs.exclude_projects }}" ]; then
+            CMD="$CMD --exclude=${{ inputs.exclude_projects }}"
+          fi
+
+          if [ "${{ inputs.verbose }}" == "true" ]; then
+            CMD="$CMD --verbose"
+          fi
+
+          echo "Running: $CMD"
+          $CMD
+
       # ════════════════════════════════════════════════════════════════════════
       # 📊 COVERAGE UPLOAD (OPTIONAL)
       # ════════════════════════════════════════════════════════════════════════
diff --git a/actions/environment-setup/action.yml b/actions/environment-setup/action.yml
index fba4980..cc4e474 100644
--- a/actions/environment-setup/action.yml
+++ b/actions/environment-setup/action.yml
@@ -623,6 +623,12 @@ runs:
           CREATE DATABASE IF NOT EXISTS mcpg_test;
           GRANT ALL PRIVILEGES ON mcpg_test.* TO 'mcpg'@'127.0.0.1';
           GRANT ALL PRIVILEGES ON mcpg_test.* TO 'mcpg'@'localhost';
+          -- PROCESS is a server-wide privilege; required so cancellation
+          -- paths in SQL-binding integration tests can `KILL QUERY` their
+          -- own sessions (MySQL 8 rejects KILL without PROCESS). Safe to
+          -- grant on an ephemeral CI DB that only the test user touches.
+          GRANT PROCESS ON *.* TO 'mcpg'@'127.0.0.1';
+          GRANT PROCESS ON *.* TO 'mcpg'@'localhost';
           FLUSH PRIVILEGES;
         SQL
         echo "MYSQL_TEST_URL=mysql://mcpg:mcpg@127.0.0.1/mcpg_test" >> "$GITHUB_ENV"