Repository navigation
Give the migrate workflow the GitHub Packages token - #63
Merged
Merged
Conversation
Closes #62. bunfig.toml points the @newtheatre scope at GitHub Packages and reads $GH_PACKAGES_TOKEN. When auth-types became a published package, the token and the packages: read permission were added to ci.yml and not here, so this workflow cannot install and dies before it reaches the database. Latent rather than visible: it only runs on a push touching server/db/migrations/**, so it is only tested when it is needed. Proscenium found out the hard way on 2026-08-21, when the first migration since the cutover deployed against an unmigrated database. All four estate repos had the same gap.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
room-bookings | 2c1c4fe | Aug 21 2026, 11:52 AM |
Member
Author
|
Verified by hand as promised: run 32479564138 — success. It installed, authenticated to Cloudflare, took a Time Travel bookmark, read the ledger ( Worth repeating after any future change to how dependencies are installed. This gap existed for two days and only surfaced because proscenium happened to ship a migration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four lines, and the reason they matter is out of proportion to the diff.
bunfig.tomlpoints the@newtheatrescope at GitHub Packages and reads$GH_PACKAGES_TOKEN. When auth-types became a published package (stage-door ADR-0025), the token and thepackages: readpermission were added toci.ymland not tomigrate.yml. So this workflow cannot install its dependencies, and dies before it reaches the database.How it was found
Proscenium merged the first migration in the estate since the cutover and its migrate run failed at
bun install:All four repos had it. Proscenium's fix is newtheatre/proscenium#176; this is the same change.
Why it hid
The workflow only runs on a push touching
server/db/migrations/**. Nothing had added a migration since the cutover, so it was never exercised. A workflow that only runs when it is needed is only tested when it is needed — which is the argument for dispatching it by hand after any change to how dependencies are installed.The failure mode
The job dies at install, before the Time Travel bookmark and before the apply step, so nothing is half-applied and the database is safe. What it leaves behind is a deploy whose code is ahead of its schema — the shape of the estate outage on 2026-08-19 that stage-door ADR-0021 exists to prevent.
Verification
After merging I will dispatch the workflow by hand. With nothing pending it will no-op, which is exactly the proof wanted: that it can install, authenticate, take a Time Travel bookmark and read the
_hub_migrationsledger. I will report the run here.