Skip to content

ci: replace dry-run with staging DB for PR migration checks #69

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zacharias-ona merged 4 commits into from
Apr 15, 2026
Merged

ci: replace dry-run with staging DB for PR migration checks #69

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8c8f110
ci: replace dry-run with staging DB for PR migration checks
zacharias-ona Apr 15, 2026
bec6441
fix: [ci-fix] skip staging job when secrets are not configured
zacharias-ona Apr 15, 2026
17675a4
fix: [ci-fix] skip staging migration check when secrets are not confi…
zacharias-ona Apr 15, 2026
9ae549f
fix(ci): pass --yes to supabase commands to skip interactive prompts
zacharias-ona Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 36 additions & 7 deletions .github/workflows/deploy-migrations.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,29 +11,58 @@ env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
dry-run:
# ---------------------------------------------------------------------------
# PR check: reset staging DB then push migrations for real execution
# ---------------------------------------------------------------------------
staging:
if: github.event_name == 'pull_request'
runs-on: ubuntu-latest
# Only one staging validation at a time — later PRs queue behind earlier ones
concurrency:
group: staging-migrations
cancel-in-progress: false

env:
SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
SUPABASE_DB_PASSWORD: ${{ secrets.SUPABASE_DB_PASSWORD }}
SUPABASE_PROJECT_ID: ${{ secrets.SUPABASE_PROJECT_ID }}
SUPABASE_DB_PASSWORD: ${{ secrets.SUPABASE_STAGING_DB_PASSWORD }}
SUPABASE_PROJECT_ID: ${{ secrets.SUPABASE_STAGING_PROJECT_ID }}

steps:
- name: Check staging secrets are configured
id: check-secrets
run: |
if [ -z "$SUPABASE_PROJECT_ID" ] || [ -z "$SUPABASE_DB_PASSWORD" ]; then
echo "⚠️ Staging secrets not configured — skipping migration validation."
echo "Add SUPABASE_STAGING_PROJECT_ID and SUPABASE_STAGING_DB_PASSWORD repository secrets to enable."
echo "skip=true" >> "$GITHUB_OUTPUT"
else
echo "skip=false" >> "$GITHUB_OUTPUT"
fi

- uses: actions/checkout@v6
if: steps.check-secrets.outputs.skip == 'false'

# supabase/setup-cli@v1 still targets node20; keep FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 until they ship a node24 version
- uses: supabase/setup-cli@v1
if: steps.check-secrets.outputs.skip == 'false'
with:
version: latest

- name: Link Supabase project
- name: Link staging project
if: steps.check-secrets.outputs.skip == 'false'
run: supabase link --project-ref $SUPABASE_PROJECT_ID

- name: Dry-run migrations
run: supabase db push --dry-run
- name: Reset staging DB to clean state
if: steps.check-secrets.outputs.skip == 'false'
run: supabase db reset --linked --yes

- name: Push migrations to staging
if: steps.check-secrets.outputs.skip == 'false'
run: supabase db push --yes

# ---------------------------------------------------------------------------
# Production deploy: runs on push to main
# ---------------------------------------------------------------------------
deploy:
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
Expand All @@ -55,7 +84,7 @@ jobs:
run: supabase link --project-ref $SUPABASE_PROJECT_ID

- name: Deploy migrations
run: supabase db push
run: supabase db push --yes

- name: Verify critical tables exist
env:
Expand Down
Loading