ci(code-quality): skip cleanly when unconfigured, fail only when disp… #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Migrate database | |
| # Migrating a REAL database is manual only. Merging to `main` runs the migration-chain SMOKE TEST, | |
| # and structurally cannot do more than that -- see the safety property below. | |
| # | |
| # Migration is deliberately separate from seeding: `keel init` seeds the strategy (rules) library | |
| # on a FRESH deployment, while `keel migrate` only evolves an existing database's schema. Seeding | |
| # on migrate would resurrect rules that were deliberately deleted or refuted. | |
| # | |
| # ⚠️ THE SAFETY PROPERTY THAT MAKES THE `push` TRIGGER SOUND, and it is a property of the event, not | |
| # of anyone's discipline: `db_path` is a `workflow_dispatch` INPUT. A `push` event carries no | |
| # inputs, so on a merge `${{ inputs.db_path }}` renders EMPTY and the job below takes its | |
| # `migration_smoke.py` branch -- always. There is no value a merge can supply that would make it | |
| # migrate a real database. Only a human dispatching it by hand can pass a `db_path`. | |
| # Do not "helpfully" add a default target or read a path from a repo variable: either would remove | |
| # this property and let a merge write to a live database. | |
| # | |
| # DEFERRED SEAM: today `keel.db` is local, git-ignored and single-user, so CI has no database to | |
| # reach. Once the app is server-hosted, that deployment's database becomes the `db_path` target | |
| # (via a self-hosted runner or a mounted volume) and the release workflow can call this job. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| db_path: | |
| description: "Database to migrate. Leave empty to run the migration smoke test instead." | |
| required: false | |
| type: string | |
| default: "" | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| migrate: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v6 | |
| with: | |
| enable-cache: true | |
| - name: Set up Python | |
| run: uv python install # version comes from .python-version; never pin it here twice | |
| - name: Sync dependencies | |
| run: uv sync --all-extras --dev | |
| - name: Migrate, or smoke-test the migration chain | |
| run: | | |
| set -euo pipefail | |
| DB="${{ inputs.db_path }}" | |
| if [ -n "$DB" ]; then | |
| if [ ! -f "$DB" ]; then | |
| echo "::error::no database at '$DB' -- refusing to create one here." | |
| echo "::error::A fresh deployment is bootstrapped with 'keel init', not this workflow." | |
| exit 1 | |
| fi | |
| echo "migrating $DB" | |
| uv run keel migrate --db "$DB" | |
| else | |
| echo "no db_path given -- verifying the migration chain instead" | |
| uv run python scripts/migration_smoke.py | |
| fi |