policyengine-api/.github/workflows/migrate-v1-cloud-sql.yml at master · PolicyEngine/policyengine-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: Migrate v1 Cloud SQL

on:
  workflow_call:
    inputs:
      deployment_environment:
        description: Logical database environment
        required: true
        type: string
      github_environment:
        description: GitHub environment containing the Cloud SQL target
        required: true
        type: string
  workflow_dispatch:
    inputs:
      deployment_environment:
        description: Logical database environment
        required: true
        type: choice
        options:
          - staging
          - production
      github_environment:
        description: GitHub environment containing the Cloud SQL target
        required: true
        type: environment

jobs:
  migrate:
    name: Upgrade and verify v1 Cloud SQL
    # push.yml calls this from a release job that may follow skipped
    # checks. GitHub would skip this job too unless its if: calls a status
    # function; the calling job has already checked what it needs.
    if: ${{ !cancelled() }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: ${{ inputs.github_environment }}
    permissions:
      contents: read
      id-token: write
    env:
      DEPLOYMENT_ENVIRONMENT: ${{ inputs.deployment_environment }}
      POLICYENGINE_DB_INSTANCE_CONNECTION_NAME: ${{ vars.POLICYENGINE_DB_INSTANCE_CONNECTION_NAME }}
      PRODUCTION_POLICYENGINE_DB_INSTANCE_CONNECTION_NAME: ${{ vars.PRODUCTION_POLICYENGINE_DB_INSTANCE_CONNECTION_NAME }}
      POLICYENGINE_DB_READONLY_PASSWORD_SECRET: ${{ vars.POLICYENGINE_DB_READONLY_PASSWORD_SECRET }}
      POLICYENGINE_DB_MIGRATION_PASSWORD_SECRET: ${{ vars.POLICYENGINE_DB_MIGRATION_PASSWORD_SECRET }}
      PRODUCTION_POLICYENGINE_DB_READONLY_PASSWORD_SECRET: ${{ vars.PRODUCTION_POLICYENGINE_DB_READONLY_PASSWORD_SECRET }}
      PRODUCTION_POLICYENGINE_DB_MIGRATION_PASSWORD_SECRET: ${{ vars.PRODUCTION_POLICYENGINE_DB_MIGRATION_PASSWORD_SECRET }}
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Authenticate to GCP
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ vars.GCP_DB_MIGRATION_SERVICE_ACCOUNT }}
      - name: Set up GCloud
        uses: google-github-actions/setup-gcloud@v2
      # make install syncs .venv from uv.lock, which the bare python this
      # job's scripts run does not read. Moving this job to uv.lock is a
      # separate, verified change; until then it installs unlocked.
      - name: Install dependencies (unlocked)
        run: pip install -e ".[dev]"
      - name: Start Cloud SQL Auth Proxy
        run: bash .github/scripts/start_cloud_sql_proxy.sh
      - name: Upgrade and verify v1 database
        run: bash .github/scripts/migrate_v1_cloud_sql.sh
      - name: Stop Cloud SQL Auth Proxy
        if: always()
        run: bash .github/scripts/stop_cloud_sql_proxy.sh