name: MariaDB persistence qualification
on:
  push:
    branches: [codex/rd21-mariadb-standardisation, fix/p9-ci-and-requalification, fix/p9-model-cache-and-ci-qualification]
  # Restore PR preparation only after the dedicated runner/trust-boundary review.
  workflow_dispatch:
jobs:
  mariadb:
    # This unique label must be registered on an isolated nonproduction runner.
    runs-on: jobtracker-mariadb-isolated
    steps:
      - name: Require verified runner isolation
        # Remove this blocker only after the operator evidence and workflow review in the handoff.
        run: |
          echo '::error::BLOCKED: hosted runner isolation is unverified. See docs/redesign/phase-9/p9-requal-01/CI_OPERATOR_HANDOFF.md before enabling database execution.'
          exit 1
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '9.0.317'
      - name: Check isolated database runner guards
        run: python3 scripts/test-mariadb-integration.py
      - name: Require Docker and Compose
        # Unavailable infrastructure fails this explicit lane; it must never skip to SQLite.
        run: |
          docker info
          docker compose version
      - name: Qualify pinned MariaDB 12.2.2
        run: python3 scripts/mariadb-integration.py
      - name: Retain MariaDB evidence
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: mariadb-persistence
          path: .artifacts/mariadb/integration/