migrations.yml

name: Database Migrations

on:
  workflow_call:
    inputs:
      environment:
        description: Target environment (production, staging, or dev)
        required: true
        type: string
  workflow_dispatch:
    inputs:
      environment:
        description: Target environment
        required: true
        type: choice
        options:
          - production
          - staging
          - dev

permissions:
  contents: read

jobs:
  migrate:
    name: Apply Database Migrations
    runs-on: blacksmith-4vcpu-ubuntu-2404

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.13

      - name: Cache Bun dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.bun/install/cache
            node_modules
            **/node_modules
          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      # The expression maps the explicit environment input to exactly one repo
      # secret, so the job never holds another environment's database URL. An
      # unknown environment resolves to empty and the guard below fails the job.
      # MIGRATION_DATABASE_URL is the optional direct (non-pooled) DSN preferred
      # by migrate.ts; when the secret is unset it resolves to empty and the
      # script falls back to DATABASE_URL.
      - name: Apply database schema changes
        working-directory: ./packages/db
        env:
          DATABASE_URL: ${{ inputs.environment == 'production' && secrets.DATABASE_URL || inputs.environment == 'staging' && secrets.STAGING_DATABASE_URL || inputs.environment == 'dev' && secrets.DEV_DATABASE_URL || '' }}
          MIGRATION_DATABASE_URL: ${{ inputs.environment == 'production' && secrets.MIGRATION_DATABASE_URL || inputs.environment == 'staging' && secrets.STAGING_MIGRATION_DATABASE_URL || '' }}
          ENVIRONMENT: ${{ inputs.environment }}
        run: |
          if [ -z "$DATABASE_URL" ]; then
            echo "ERROR: no database URL secret resolved for environment '${ENVIRONMENT}'" >&2
            exit 1
          fi

          if [ "${ENVIRONMENT}" = "dev" ]; then
            echo "Dev environment — pushing schema directly (db:push)"
            # `--force` only suppresses the data-loss confirm, not drizzle's
            # rename-vs-drop prompt, which fires (and crashes, no TTY) when a
            # diff both adds and drops tables/columns at once. Turn that opaque
            # crash into an actionable failure instead of a bare stack trace.
            push_output="$(bun run db:push --force 2>&1)" && push_status=0 || push_status=$?
            echo "$push_output"
            if [ "$push_status" -ne 0 ]; then
              if printf '%s' "$push_output" | grep -q 'Interactive prompts require a TTY'; then
                echo "::error title=Dev schema push needs manual reconciliation::drizzle-kit push hit an interactive rename/drop prompt that CI cannot answer. The dev DB has drifted from schema.ts: it still holds table(s)/column(s) the schema no longer declares while the schema also adds new ones, so drizzle cannot tell a rename from a drop+create. Fix: drop the stale objects on the dev DB to match schema.ts — the same DROPs the latest versioned migration already applied to staging/prod (grep packages/db/migrations for the most recent DROP TABLE / DROP COLUMN) — then re-run this workflow. --force cannot bypass this prompt."
              fi
              exit "$push_status"
            fi
          else
            echo "Applying versioned migrations (db:migrate)"
            bun run ./scripts/migrate.ts
          fi