# Applies Drizzle migrations to the production database after a merge
# to `main`. Gated on a GitHub Environment named `production` — configure
# required reviewers there to enforce manual approval.
#
# Also runnable manually via workflow_dispatch (e.g. to re-run a failed
# migrate after a transient outage).
name: db-migrate

on:
  push:
    branches: [main]
    paths:
      - "db/migrations/**"
      - "db/migrate.ts"
      - ".github/workflows/db-migrate.yml"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  # Advisory lock at the workflow layer too — defense in depth alongside
  # safeMigrate's per-database advisory lock.
  group: db-migrate-production
  cancel-in-progress: false

jobs:
  migrate:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
        with:
          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
      - name: Apply migrations
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
        run: pnpm db:migrate