flyway check

.gitea/workflows/deploy.yml

@@ -1,22 +1,73 @@
-# Deploy na single server: deploy.sh volá hostovský Docker přes /var/run/docker.sock (bez DinD).
+# CI: immutability + Flyway validate (JDBC na staging / sdílenou DB). Deploy na main až po úspěchu.
+# Job bez container: — hostovský docker + git (stejně jako deploy).
+# Gitea secrets: EMS_CI_FLYWAY_URL (jdbc:postgresql://…/ems). Volitelně EMS_CI_FLYWAY_USER, EMS_CI_FLYWAY_PASSWORD.
+# Runner: container.valid_volumes pro /var/run/docker.sock (viz docs/deployment-self-hosted.md).
 #
-# Job běží v kontejneru — /opt/ems-deploy a sock musí být přimountované (viz container.volumes).
-# V /opt/gitea-stack/runner/config.yaml nastav container.valid_volumes na stejné cesty.
-# Sladit `runs-on` s labely registrace runneru (výchozí: self-hosted).
-#
-# Spuštění: push na větev main (včetně merge PR do main — merge v Gitea/Git je stále push na main).
-# Nepřidávat paralelně pull_request:closed — při merge by běžel deploy dvakrát (push + PR).
+# Spuštění deploye: push na main. Nepřidávat paralelně pull_request:closed — při merge by běžel deploy dvakrát.
 
-name: deploy
+name: CI and deploy
 
 on:
   push:
     branches:
       - main
+      - feature/**
+  pull_request:
   workflow_dispatch:
 
 jobs:
+  migration-check:
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          su="${{ github.server_url }}"
+          case "$su" in
+            https://*) clone_url="https://oauth2:${TOKEN}@${su#https://}" ;;
+            http://*) clone_url="http://oauth2:${TOKEN}@${su#http://}" ;;
+            *) echo "unknown github.server_url: $su"; exit 1 ;;
+          esac
+          clone_url="${clone_url}/${{ github.repository }}.git"
+          git init
+          git remote add origin "$clone_url"
+          git fetch --depth=64 origin "${{ github.sha }}"
+          git checkout -qf FETCH_HEAD
+          git remote set-branches origin 'main' || true
+          git fetch --depth=64 origin main:refs/remotes/origin/main || true
+
+      - name: Repo layout
+        run: |
+          test -f docker-compose.yml
+          test -f deploy/docker-compose.yml
+          test -x deploy/deploy.sh
+          test -x scripts/ci_check_migration_immutability.sh
+          test -x scripts/ci_flyway_validate_remote.sh
+
+      - name: Migration immutability (vs PR base or main)
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -eu
+          BASE='origin/main'
+          if [ -n "${PR_BASE_SHA:-}" ]; then
+            BASE="$PR_BASE_SHA"
+            git fetch --no-tags --depth=256 origin "$BASE" || true
+          fi
+          ./scripts/ci_check_migration_immutability.sh "$BASE"
+
+      - name: Flyway validate (remote DB)
+        env:
+          EMS_CI_FLYWAY_URL: ${{ secrets.EMS_CI_FLYWAY_URL }}
+          EMS_CI_FLYWAY_USER: ${{ secrets.EMS_CI_FLYWAY_USER }}
+          EMS_CI_FLYWAY_PASSWORD: ${{ secrets.EMS_CI_FLYWAY_PASSWORD }}
+        run: ./scripts/ci_flyway_validate_remote.sh
+
   deploy:
+    needs: migration-check
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     runs-on: self-hosted
     steps:
       - name: Show execution context
@@ -27,9 +78,8 @@ jobs:
           ls -ld /opt/ems-deploy
 
       - name: Run deploy script
-        run: |
-          bash /opt/ems-deploy/deploy.sh
-          
+        run: bash /opt/ems-deploy/deploy.sh
+
   # Alternativa: runner v Dockeru bez přístupu k hostu — odkomentovat a upravit SERVER + secrets.
   # deploy-ssh:
   #   runs-on: ubuntu-latest

.gitea/workflows/test.yml

@@ -1,46 +0,0 @@
-name: test
-
-on:
-  push:
-    branches:
-      - main
-      - feature/**
-  pull_request:
-
-jobs:
-  smoke-test:
-    # Stejný label jako deploy.yml — výchozí act_runner má typicky jen `self-hosted`.
-    runs-on: self-hosted
-    # Výchozí job image často nemá Node → `actions/checkout@v4` padá na „Cannot find: node“.
-    # alpine/git je malý a stačí na shallow clone přes token (Gitea = GitHub-kompatibilní kontext).
-    container:
-      image: alpine/git:latest
-    steps:
-      - name: Checkout
-        env:
-          TOKEN: ${{ github.token }}
-        run: |
-          set -eu
-          su="${{ github.server_url }}"
-          case "$su" in
-            https://*) clone_url="https://oauth2:${TOKEN}@${su#https://}" ;;
-            http://*) clone_url="http://oauth2:${TOKEN}@${su#http://}" ;;
-            *) echo "unknown github.server_url: $su"; exit 1 ;;
-          esac
-          clone_url="${clone_url}/${{ github.repository }}.git"
-          git init
-          git remote add origin "$clone_url"
-          git fetch --depth=1 origin "${{ github.sha }}"
-          git checkout -qf FETCH_HEAD
-
-      - name: Repo layout
-        run: |
-          test -f docker-compose.yml
-          test -f deploy/docker-compose.yml
-          test -x deploy/deploy.sh
-
-      - name: Runner info
-        run: |
-          uname -a
-          pwd
-          ls -la