mirror of
https://github.com/nestriness/nestri.git
synced 2026-09-19 17:25:19 +03:00
4668c98785
`release-prod.yml` for api and auth, mirroring the edge's. The gate is not "you may not merge" — it is that merging does not deploy: tests run against a real Postgres, both binaries are executed, and a failure anywhere means no release exists, so the machine keeps serving what it has. The new piece is `nestri-migrate`, because the deploy runs migrations *before* it swaps a release into place and had nothing to run. `drizzle-kit migrate` reads the migrations folder at runtime, which is right on a laptop and wrong on a server: the deploy ships flat, checksummed files into bin/, and a migrator that needs a directory beside it can be pointed at the wrong directory. So the folder is baked into the binary — generated on every build rather than committed, so it cannot drift — and the artefact's checksum then covers every statement it will run. It reimplements drizzle's bookkeeping in thirty lines of SQL rather than calling into `db.dialect.migrate`: same table, same schema, same sha256 over the whole file, same high-water-mark comparison. That equivalence is the one thing that must not rot, because the production database was first migrated by drizzle-kit and a disagreement means a migration applied twice. Two checks hold it: CI applies the migrations with drizzle-kit and then asserts the embedded set reports nothing pending, and the hashes were verified by hand against the live database — all fourteen match to the byte. Proven before shipping, against the real database: nothing pending on the deployed schema, 14 unchanged rows, and a scratch database migrated from empty to the same 22 tables and the same high-water mark, idempotent on a second run. Refuses with exit 2 when DATABASE_URL is absent rather than defaulting to localhost, which would be a migrator reporting success having migrated nothing. setup-bun is pinned to a commit and not to `v2`. A moving major tag is fine everywhere else in this repository; this workflow is the only thing between a merge and a process serving users, and there is no first-party bun action to prefer instead.
55 lines
1.1 KiB
Plaintext
55 lines
1.1 KiB
Plaintext
node_modules
|
|
|
|
# Output
|
|
.output
|
|
.vercel
|
|
.netlify
|
|
.wrangler
|
|
.svelte-kit
|
|
# JS-framework build-output dirs, at any depth — but not the top-level
|
|
# build/ directory, which is the guest rootfs build (see build/README.md),
|
|
# a real source tree we want tracked.
|
|
**/build
|
|
!/build
|
|
|
|
# Rust
|
|
/target
|
|
**/*.rs.bk
|
|
|
|
# build/'s own output — the packed rootfs images, not source
|
|
/build/output/
|
|
|
|
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Env
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
!.env.test
|
|
|
|
# Vite
|
|
vite.config.js.timestamp-*
|
|
vite.config.ts.timestamp-*
|
|
|
|
dist
|
|
.lunora/
|
|
.lunora-cache
|
|
lunora/_generated
|
|
|
|
#turbo
|
|
.turbo
|
|
|
|
# nesdoctor writes its report next to wherever it is run, and it is run from
|
|
# the repository root during development. It contains the operator's own
|
|
# machine: home paths, installed game titles, launch times. Committed once by
|
|
# accident; never again.
|
|
nesdoctor.json
|
|
*.nesdoctor.json
|
|
|
|
# Baked from packages/core/migrations by scripts/embed-migrations.ts on every
|
|
# build. Committing it would let the binary's migration set drift from the
|
|
# folder, which is the one thing embedding exists to prevent.
|
|
packages/core/src/migrations.generated.ts
|