feat(nx-ci): add test_integration input + grant PROCESS to MySQL test user

.github/workflows/nx-ci.yml

@@ -124,6 +124,24 @@ on:
         type: boolean
         default: false
 
+      test_integration:
+        description: |
+          Run the `test:integration` Nx target on projects that define it.
+          Intended for CD-gated lanes (merges / PRs targeting main / develop
+          / next) where integration suites against real databases, services,
+          and other heavy fixtures should run. Feature-branch PRs typically
+          keep this off so daily iteration stays fast.
+
+          Projects without a `test:integration` target are skipped silently
+          (nx reports the target is missing and moves on).
+
+          Services that integration suites depend on (postgres, mysql,
+          redis, nats, etc.) must be enabled via `environment_skip` /
+          `.environment.yml` — this input only runs the target.
+        required: false
+        type: boolean
+        default: false
+
       custom_tasks:
         description: |
           Additional custom tasks to run (comma-separated).
@@ -455,6 +473,39 @@ jobs:
           echo "Running: $CMD"
           $CMD
 
+      # ════════════════════════════════════════════════════════════════════════
+      # 🧪 TEST:INTEGRATION (OPTIONAL, CD-GATED)
+      # ════════════════════════════════════════════════════════════════════════
+
+      - name: Run test:integration
+        id: test_integration
+        if: inputs.test_integration
+        run: |
+          echo "🧪 Running test:integration..."
+          CMD="pnpm nx"
+
+          if [ "${{ inputs.affected_only }}" == "true" ]; then
+            CMD="$CMD affected"
+          else
+            CMD="$CMD run-many"
+          fi
+
+          # Projects without a `test:integration` target are skipped by Nx,
+          # so `run-many -t test:integration` is safe to run across every
+          # project even when only a subset declares the target.
+          CMD="$CMD -t test:integration --parallel=${{ inputs.parallel }}"
+
+          if [ -n "${{ inputs.exclude_projects }}" ]; then
+            CMD="$CMD --exclude=${{ inputs.exclude_projects }}"
+          fi
+
+          if [ "${{ inputs.verbose }}" == "true" ]; then
+            CMD="$CMD --verbose"
+          fi
+
+          echo "Running: $CMD"
+          $CMD
+
       # ════════════════════════════════════════════════════════════════════════
       # 📊 COVERAGE UPLOAD (OPTIONAL)
       # ════════════════════════════════════════════════════════════════════════

actions/environment-setup/action.yml

@@ -623,6 +623,12 @@ runs:
           CREATE DATABASE IF NOT EXISTS mcpg_test;
           GRANT ALL PRIVILEGES ON mcpg_test.* TO 'mcpg'@'127.0.0.1';
           GRANT ALL PRIVILEGES ON mcpg_test.* TO 'mcpg'@'localhost';
+          -- PROCESS is a server-wide privilege; required so cancellation
+          -- paths in SQL-binding integration tests can `KILL QUERY` their
+          -- own sessions (MySQL 8 rejects KILL without PROCESS). Safe to
+          -- grant on an ephemeral CI DB that only the test user touches.
+          GRANT PROCESS ON *.* TO 'mcpg'@'127.0.0.1';
+          GRANT PROCESS ON *.* TO 'mcpg'@'localhost';
           FLUSH PRIVILEGES;
         SQL
         echo "MYSQL_TEST_URL=mysql://mcpg:mcpg@127.0.0.1/mcpg_test" >> "$GITHUB_ENV"