GitHub Action

rowsafe/action saves a Mark before a deploy. The task-oriented guide is Save a Mark before every deploy.

- uses: rowsafe/action@v1
  with:
    api-key: ${{ secrets.ROWSAFE_API_KEY }}
    database: app

What it does, in order

1. Installs the rowsafe CLI from the GitHub release, checks it against the release's SHA256SUMS, verifies its SLSA build provenance, and caches it (see Verification).
2. Finds the database: the database input, else ROWSAFE_DATABASE, else "database" in the nearest .rowsafe.json, else the organization's only database.
3. Checks protection (rowsafe status): whether the database can be restored right now. If not, a warning, or with require-protected: true the step fails before anything else happens.
4. Previews migrations when preview-sql is set and the CLI has rowsafe preview: the new files run, in order, on a copy of the database on your server, and the preview's report goes into the job summary. If the migration fails on the copy (verdict failed), the step fails before the Mark: it would fail on production too. A careful or dangerous verdict is a warning, or fails the step with fail-on.
5. Saves the Mark (rowsafe mark) and, with wait: true, waits until it is confirmed in your bucket. If it isn't confirmed within wait-timeout-minutes, the step fails.
6. Writes the outputs and the job summary.

Inputs

Outputs

The job summary

A successful run adds a summary to the workflow run with the Mark and when it was confirmed, the database and whether it was protected, the backup a rewind starts from, the commit, the preview's report when one ran (the same report the CLI writes for a pull request comment), a Rewind to this Mark link and, collapsed, the CLI commands for this Mark. A failed run's summary says what stopped the deploy and what to do next: the reasons a database isn't protected, why a Mark wasn't confirmed, or which input is wrong.

Messages also appear as annotations on the run: a notice with the Mark, warnings (not protected, preview skipped), and errors.

Verification

The action runs the CLI only after two checks, on every run, including when the CLI comes from the cache:

1. Checksum: the binary's SHA-256 must match the release's SHA256SUMS, downloaded fresh from the same release. A cached copy that doesn't match is downloaded again.
2. Build provenance: gh attestation verify checks the SLSA provenance recorded when the release was built: signed by the release.yml workflow of rowsafe/rowsafe, at that version's tag, in the public Sigstore transparency log. On GitHub-hosted runners the GitHub CLI is installed, so this always runs.

The CLI is cached with actions/cache, keyed by version and platform, and in the runner's tool cache on self-hosted runners.

Runners

Linux and macOS, x64 and ARM64, GitHub-hosted or self-hosted. Windows runners aren't supported: use runs-on: ubuntu-latest for the deploy job. The action needs bash, curl and git (for preview-changed-only).

Errors