deckhearth/.github/workflows
Randall Stillwell b712e38c86 fix(migrate): use PGHOST/PGUSER/PGPASSWORD instead of URL secret
First Brief 1+2 validation run failed on the migrate job with
`psql: invalid option -- '/'` despite the secret being set correctly
and a direct CT-111 → CT-102 psql connection working fine. The
URL-parse path in `psql "$PGBASE/postgres"` was the fragile bit.

Splitting the connection into discrete `PG*` env vars (which psql
picks up automatically) sidesteps URL parsing entirely. The
`HOMELAB_CI_POSTGRES_BASE_URL` repo secret is now
`HOMELAB_CI_POSTGRES_PASSWORD` — password only — and the workflow
hardcodes the (non-sensitive) host/port/user. `node-pg-migrate`
still reads `POSTGRES_URL` from `.env.local`, so we assemble that
URL inline for it; the runner is ephemeral so the leaked-to-disk
password is bounded to one job.

Convoy doc updated to reflect the shipped approach + lesson learned
in prerequisites.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-05 18:00:11 -05:00
..
agent-context-drift.yml bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
ci.yml fix(migrate): use PGHOST/PGUSER/PGPASSWORD instead of URL secret 2026-06-05 18:00:11 -05:00
pr-health-rollup.yml convoy: migrate CI to self-hosted axiom runners (briefs 1+2) 2026-06-05 17:50:27 -05:00
preview-smoke.yml convoy: migrate CI to self-hosted axiom runners (briefs 1+2) 2026-06-05 17:50:27 -05:00
visual-diff.yml convoy: migrate CI to self-hosted axiom runners (briefs 1+2) 2026-06-05 17:50:27 -05:00