root/Jyotisha
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

test(deploy): integrate billing admin rollout checks
Staging Backend Quality Gate / validate (push) Failing after 7m30s
Details
Staging Backend Quality Gate / publish (push) Has been skipped
Details

Browse Source
This commit is contained in:
Jesse_Chen
2026-08-06 20:15:50 +08:00
parent 5622ab448a
commit 9d8c73561f
40 changed files with 2911 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/postgres/001-bootstrap-roles.sh
+12 -3
View File
@@ -5,7 +5,8 @@ set +x
required=(
POSTGRES_DB POSTGRES_USER POSTGRES_PASSWORD
SCHEMA_OWNER_PASSWORD IDENTITY_RUNTIME_PASSWORD APP_RUNTIME_PASSWORD
ADMIN_RUNTIME_PASSWORD MIGRATION_RUNNER_PASSWORD BACKUP_READER_PASSWORD
SERVICE_RUNTIME_PASSWORD ADMIN_RUNTIME_PASSWORD MIGRATION_RUNNER_PASSWORD
BACKUP_READER_PASSWORD
)
for key in "${required[@]}"; do
if [ -z "${!key:-}" ]; then
@@ -21,6 +22,7 @@ psql --set ON_ERROR_STOP=1 \
--set schema_owner_password="$SCHEMA_OWNER_PASSWORD" \
--set identity_runtime_password="$IDENTITY_RUNTIME_PASSWORD" \
--set app_runtime_password="$APP_RUNTIME_PASSWORD" \
--set service_runtime_password="$SERVICE_RUNTIME_PASSWORD" \
--set admin_runtime_password="$ADMIN_RUNTIME_PASSWORD" \
--set migration_runner_password="$MIGRATION_RUNNER_PASSWORD" \
--set backup_reader_password="$BACKUP_READER_PASSWORD" <<'SQL'
@@ -42,6 +44,12 @@ SELECT format(
) WHERE NOT EXISTS (
SELECT 1 FROM pg_roles WHERE rolname = 'app_runtime'
) \gexec
SELECT format(
'CREATE ROLE service_runtime WITH LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT PASSWORD %L',
:'service_runtime_password'
) WHERE NOT EXISTS (
SELECT 1 FROM pg_roles WHERE rolname = 'service_runtime'
) \gexec
SELECT format(
'CREATE ROLE admin_runtime WITH LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT PASSWORD %L',
:'admin_runtime_password'
@@ -58,7 +66,8 @@ WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') \gexec
ALTER ROLE service_role BYPASSRLS;
GRANT authenticated TO app_runtime;
GRANT service_role TO admin_runtime;
GRANT service_role TO service_runtime;
REVOKE service_role FROM admin_runtime;
SELECT format(
'CREATE ROLE migration_runner WITH LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT PASSWORD %L',
:'migration_runner_password'
@@ -77,7 +86,7 @@ SELECT format(
:'database_name'
) \gexec
SELECT format(
'GRANT CONNECT ON DATABASE %I TO identity_runtime, app_runtime, admin_runtime, migration_runner, backup_reader',
'GRANT CONNECT ON DATABASE %I TO identity_runtime, app_runtime, service_runtime, admin_runtime, migration_runner, backup_reader',
:'database_name'
) \gexec
deploy/postgres/002-ensure-business-compatibility-roles.sql
+9 -1
View File
@@ -7,5 +7,13 @@ where not exists (select 1 from pg_roles where rolname = 'service_role') \gexec
alter role service_role bypassrls;
\getenv service_runtime_password SERVICE_RUNTIME_PASSWORD
select format(
'create role service_runtime with login nosuperuser nocreatedb nocreaterole noinherit password %L',
:'service_runtime_password'
) where not exists (select 1 from pg_roles where rolname = 'service_runtime') \gexec
select format('grant connect on database %I to service_runtime', current_database()) \gexec
grant authenticated to app_runtime;
grant service_role to admin_runtime;
grant service_role to service_runtime;
revoke service_role from admin_runtime;