mirror of
https://github.com/simstudioai/sim.git
synced 2026-09-24 15:45:35 +08:00
Waleed
7d46103d09
* chore(deps): remove unused dependencies and harden CI supply chain Dependency cleanup: - Remove unused deps: papaparse, unified, and 6 unused Radix primitives (alert-dialog, radio-group, scroll-area, separator, toggle, visually-hidden) plus @tanstack/react-query-devtools (all verified zero imports repo-wide) - Consolidate jwt-decode into the existing jose dependency (decodeJwt) - Migrate react-window to @tanstack/react-virtual to drop a redundant virtualization library (terminal, structured-output, code viewer) - Remove the better-auth-harmony plugin and its gating env flag Supply-chain hardening: - SHA-pin every GitHub Action to a full commit SHA with a version comment - Pin CI bun-version to 1.3.13 (was "latest" in the release job) - Raise bun minimumReleaseAge cooldown from 3 to 7 days - Add a non-blocking `bun audit` step in CI - Add a CODEOWNERS gate routing dependency-manifest changes to @simstudioai/deps * chore(deps): remove unused apps/docs dependencies (@tabler/icons-react, dotenv-cli) * style(search-modal): use Send icon for Invite teammates action * feat(search-modal): surface New chat as the top action above Create workflow * feat(search-modal): add Secrets to the pages list
77 lines
2.6 KiB
YAML
77 lines
2.6 KiB
YAML
name: Database Migrations
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
environment:
|
|
description: Target environment (production, staging, or dev)
|
|
required: true
|
|
type: string
|
|
workflow_dispatch:
|
|
inputs:
|
|
environment:
|
|
description: Target environment
|
|
required: true
|
|
type: choice
|
|
options:
|
|
- production
|
|
- staging
|
|
- dev
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
migrate:
|
|
name: Apply Database Migrations
|
|
runs-on: blacksmith-4vcpu-ubuntu-2404
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
|
|
|
|
- name: Setup Bun
|
|
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
|
|
with:
|
|
bun-version: 1.3.13
|
|
|
|
- name: Cache Bun dependencies
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
|
with:
|
|
path: |
|
|
~/.bun/install/cache
|
|
node_modules
|
|
**/node_modules
|
|
key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-bun-
|
|
|
|
- name: Install dependencies
|
|
run: bun install --frozen-lockfile
|
|
|
|
# The expression maps the explicit environment input to exactly one repo
|
|
# secret, so the job never holds another environment's database URL. An
|
|
# unknown environment resolves to empty and the guard below fails the job.
|
|
# MIGRATION_DATABASE_URL is the optional direct (non-pooled) DSN preferred
|
|
# by migrate.ts; when the secret is unset it resolves to empty and the
|
|
# script falls back to DATABASE_URL.
|
|
- name: Apply database schema changes
|
|
working-directory: ./packages/db
|
|
env:
|
|
DATABASE_URL: ${{ inputs.environment == 'production' && secrets.DATABASE_URL || inputs.environment == 'staging' && secrets.STAGING_DATABASE_URL || inputs.environment == 'dev' && secrets.DEV_DATABASE_URL || '' }}
|
|
MIGRATION_DATABASE_URL: ${{ inputs.environment == 'production' && secrets.MIGRATION_DATABASE_URL || inputs.environment == 'staging' && secrets.STAGING_MIGRATION_DATABASE_URL || '' }}
|
|
ENVIRONMENT: ${{ inputs.environment }}
|
|
run: |
|
|
if [ -z "$DATABASE_URL" ]; then
|
|
echo "ERROR: no database URL secret resolved for environment '${ENVIRONMENT}'" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ "${ENVIRONMENT}" = "dev" ]; then
|
|
echo "Dev environment — pushing schema directly (db:push)"
|
|
bun run db:push --force
|
|
else
|
|
echo "Applying versioned migrations (db:migrate)"
|
|
bun run ./scripts/migrate.ts
|
|
fi
|