prekopani SELL

scripts/ci_flyway_validate_remote.sh

@@ -1,6 +1,12 @@
 #!/usr/bin/env bash
 # Flyway validate using migration files from repo root; JDBC from env (staging / CI DB).
 # Env: EMS_CI_FLYWAY_URL — if unset, skips (warn). Optional: EMS_CI_FLYWAY_USER, EMS_CI_FLYWAY_PASSWORD, FLYWAY_IMAGE
+#
+# CI notes:
+# - Flyway runs in a throwaway container; without --network host, jdbc:…//localhost… hits the
+#   container loopback, not the host (connection refused).
+# - Some runners set missing secrets to the literal string "null"; passing FLYWAY_USER=null
+#   overrides credentials embedded in the JDBC URL and yields "user 'null'" from the driver.
 set -euo pipefail
 
 if [[ -z "${EMS_CI_FLYWAY_URL:-}" ]]; then
@@ -8,6 +14,17 @@ if [[ -z "${EMS_CI_FLYWAY_URL:-}" ]]; then
   exit 0
 fi
 
+# Treat empty / JSON-null placeholders as unset so we do not override URL credentials.
+_ci_sanitize_secret() {
+  local v="${1-}"
+  v="${v#"${v%%[![:space:]]*}"}"
+  v="${v%"${v##*[![:space:]]}"}"
+  case "${v,,}" in ''|'null'|'<null>') printf '%s' '' ;; *) printf '%s' "$v" ;; esac
+}
+
+EMS_CI_FLYWAY_USER="$(_ci_sanitize_secret "${EMS_CI_FLYWAY_USER-}")"
+EMS_CI_FLYWAY_PASSWORD="$(_ci_sanitize_secret "${EMS_CI_FLYWAY_PASSWORD-}")"
+
 ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
 cd "$ROOT"
 
@@ -15,6 +32,7 @@ IMG="${FLYWAY_IMAGE:-flyway/flyway:12}"
 
 args=(
   run --rm
+  --network host
   -v "$ROOT/db/migration:/flyway/sql/migration"
   -v "$ROOT/db/routines:/flyway/sql/routines"
   -v "$ROOT/db/views:/flyway/sql/views"
@@ -23,10 +41,10 @@ args=(
   -e "FLYWAY_LOCATIONS=filesystem:/flyway/sql/migration,filesystem:/flyway/sql/routines,filesystem:/flyway/sql/views"
 )
 
-if [[ -n "${EMS_CI_FLYWAY_USER:-}" ]]; then
+if [[ -n "$EMS_CI_FLYWAY_USER" ]]; then
   args+=(-e "FLYWAY_USER=${EMS_CI_FLYWAY_USER}")
 fi
-if [[ -n "${EMS_CI_FLYWAY_PASSWORD:-}" ]]; then
+if [[ -n "$EMS_CI_FLYWAY_PASSWORD" ]]; then
   args+=(-e "FLYWAY_PASSWORD=${EMS_CI_FLYWAY_PASSWORD}")
 fi