Skip to content

Releases: pgrundev/ci-action

Release list

v1.1.0 — Disposable PostgreSQL for any stack

v1.1.0 — Disposable PostgreSQL for any stack Latest
Latest

Choose a tag to compare

View all tags
@alexshapalov alexshapalov released this 17 Oct 15:14
v1.1.0
96038ad

PGRun — Disposable PostgreSQL for any stack, any agent, any CI. We provide the database; you decide what runs against it.

New: pgrundev/ci-action/database@v1

One step gives your job an isolated PostgreSQL database. Your own steps then use it, with any framework, language or tool.

      - uses: pgrundev/ci-action/database@v1
        with:
          token: ${{ secrets.PGRUN_API_TOKEN }}

      - run: npm ci && npx prisma migrate deploy && npm test   # anything: DATABASE_URL is set
  • Data: sanitized is a branch of your Safe Copy (production-like data under your approved Protect policy). schema-only gives empty tables from a CI template.
  • Several databases: with branches: 1–16, DATABASE_URL_1..N are set too.
  • Connection: DATABASE_URL (or env-name) is exported to later steps, or kept in the step's outputs only with export-env: false. URL and password are masked in the logs.
  • Cleanup: the action deletes exactly the branches it created when the job ends, on success, failure or cancellation. If the runner dies, PGRun deletes them at their TTL (1h or 6h).
  • Gates: the same as the Rails preset. Protect must be active and the Safe Copy usable. Sanitized data is refused for fork pull requests and, by default, public repositories. pull_request_target is always refused.
  • Scope: no framework detection, no language setup, no migrations, no test runner.

Docs, with Rails, Django, Prisma and Go examples: docs/database.md.

Unchanged: pgrundev/ci-action@v1 (Rails preset)

action.yml and lib/ are byte-identical to v1.0.0. Existing workflows keep working with no change.

Verified on real GitHub-hosted runners

  • Provisioning: sanitized and schema-only branches, DATABASE_URL in later steps, export-env: false.
  • Concurrency: three concurrent jobs under a full branch quota, each waiting for capacity and staying isolated.
  • Cleanup: after a failing command, after cancellation during provisioning and during the command, and by TTL after the runner was killed.
  • Rails preset: fast and production-like modes.
  • Leaks: 0 credential leaks in any log, and 0 orphaned branches.
Assets 2
Loading

PGRun CI v1.0.0

PGRun CI v1.0.0
Marketplace
Marketplace

Choose a tag to compare

View all tags
@alexshapalov alexshapalov released this 16 Oct 06:37
v1.0.0
5939ebc

Test every pull request against its own production-like PostgreSQL database, in one workflow step.

What it does

  • Production-like mode: each run gets a copy-on-write PGX branch of your sanitized Safe Copy, ready in about 2 seconds. Your migrations run on it, then the data is compared before and after:

    • rows and non-null values;
    • dropped tables and columns;
    • NOT VALID constraints existing rows violate, and invalid indexes;
    • Rails references and polymorphic type columns;
    • pending migrations.

    Your own tests can run on the same branch with test-command.

  • Fast mode: your whole suite in parallel. Each worker gets an empty branch with the production schema, built from a schema-only template. When the project's branch quota is full, runs wait for capacity instead of failing.

  • Intentional data loss: approved in PGRun by an account manager, for one migration, bound to the SHA-256 of its file. A pull request cannot approve its own data loss.

  • Cleanup: branches are deleted on success, failure, timeout and cancellation.

Security

  • Credential: a project-scoped CI token with an explicit expiry of 30, 90, 180 or 365 days.
    • It reaches only the branches it created itself.
    • It cannot change data protection, Safe Copies or template seeds.
  • Fork pull requests: they get no secrets. The documented if: skips them, and an empty token stops the run before any API call. pull_request_target is refused.
  • Production data: never reached from CI. Branches come only from the sanitized Safe Copy or the schema-only template.
  • Supply chain: the pgrun CLI is checksum-pinned, and ruby/setup-ruby is pinned by commit. The action runs on Node 24.

Use it

      - uses: pgrundev/ci-action@v1
        with:
          token: ${{ secrets.PGRUN_API_TOKEN }}
          mode: production-like

For an immutable pin, use this release's commit:

      - uses: pgrundev/ci-action@5939ebcdc3229bad6ef1b392427973735dbe755d  # v1.0.0

Requirements

  • A PGRun project with Protect approved and a Safe Copy.
  • A project CI token stored as the PGRUN_API_TOKEN secret.
  • Rails is the first supported framework.

See the README and security model.

Loading