github-workflows/.github/workflows/migration-guard.yml at main · JorisJonkers-dev/github-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
name: Migration Guard

on:
  workflow_call:
    inputs:
      base-ref:
        description: Base ref used for migration comparison.
        required: false
        type: string
        default: ''
      migration-regex:
        description: Regex matching migration paths.
        required: false
        type: string
        default: 'services/[^/]+/src/main/resources/db/migration(-pg)?/V[0-9][^/]*\.sql$'
      scope-regex:
        description: Regex whose first capture group is the migration scope.
        required: false
        type: string
        default: '(services/[^/]+)/.*'
      override-label:
        description: Pull request label that allows existing migration changes.
        required: false
        type: string
        default: allow-migration-change

permissions:
  contents: read
  pull-requests: read

jobs:
  guard:
    name: Migration Guard
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Resolve workflow ref
        id: workflow-ref
        shell: bash
        env:
          WORKFLOW_REF: ${{ github.workflow_ref }}
        run: |
          set -euo pipefail

          ref="${WORKFLOW_REF#*@}"
          if [ -z "$ref" ] || [ "$ref" = "$WORKFLOW_REF" ]; then
            echo "::error::Unable to resolve reusable workflow ref from $WORKFLOW_REF"
            exit 1
          fi

          printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@v7
        with:
          repository: JorisJonkers-dev/github-workflows
          ref: v0.33.0 # x-release-please-version
          path: .github-workflows
          persist-credentials: false

      - name: Check migrations are immutable and incrementing
        env:
          BASE_REF_INPUT: ${{ inputs.base-ref }}
          BASE_REF_FALLBACK: origin/${{ github.event.pull_request.base.ref || github.event.repository.default_branch || 'main' }}
          ALLOW_MIGRATION_CHANGE: ${{ contains(github.event.pull_request.labels.*.name, inputs.override-label) }}
          MIGRATION_REGEX: ${{ inputs.migration-regex }}
          SCOPE_REGEX: ${{ inputs.scope-regex }}
        run: |
          set -euo pipefail

          base_ref="${BASE_REF_INPUT:-$BASE_REF_FALLBACK}"
          python3 .github-workflows/scripts/check_migrations.py \
            --base-ref "$base_ref" \
            --migration-regex "$MIGRATION_REGEX" \
            --scope-regex "$SCOPE_REGEX"