chore: adds db migrations to ci/cd #5563
Conversation
ravenac95
temporarily deployed
to
external-prs-app
GitHub Actions
Inactive
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
|
|
||
| - name: Setup pnpm | ||
| uses: pnpm/action-setup@v4 | ||
| with: | ||
| version: 10 | ||
| run_install: | | ||
| - recursive: true | ||
| args: [--frozen-lockfile, --strict-peer-dependencies] | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "20.x" | ||
| cache: "pnpm" | ||
|
|
||
| - name: Push Supabase migrations | ||
| working-directory: apps/frontend | ||
| run: | | ||
| pnpm supabase db push | ||
| env: | ||
| SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }} | ||
| SUPABASE_DB_PASSWORD: ${{ secrets.SUPABASE_DB_PASSWORD }} | ||
| NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 21 days ago
To address the problem, add an explicit permissions block to the workflow or job with the least required privileges. In most cases where the workflow only needs access to check out the code (read-only), the correct minimal permissions are:
permissions:
contents: readThis can be added at the root of the workflow (applies to all jobs) or at the job level. Since the example includes one job, the simplest and best method is to add the following directly below the workflow name: field, before the on: field (to make it clear and to cover future jobs). No imports, methods, or further changes are required.
| @@ -1,4 +1,6 @@ | ||
| name: Supabase DB Migration | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| merge_group: |
| - name: Set up Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "20.x" |
There was a problem hiding this comment.
Just copied this from default but I realize we should update the node version
TODO:
This is slightly cleaner AI slop