data-sync.yml

name: data-sync

on:
  schedule:
    - cron: "17 */6 * * *"
  workflow_dispatch:

concurrency:
  group: data-sync
  cancel-in-progress: false

permissions:
  contents: write
  pull-requests: write

jobs:
  sync:
    runs-on: ubuntu-latest
    environment: production
    defaults:
      run:
        working-directory: apps/api
    env:
      DATABASE_URL: ${{ secrets.PRODUCTION_DATABASE_URL }}
    steps:
      - name: Require the database secret
        run: |
          if [ -z "$DATABASE_URL" ]; then
            echo "::error::Add the PRODUCTION_DATABASE_URL secret"
            exit 1
          fi
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          enable-cache: true
      - run: uv sync --frozen
      - name: Mask the connection details
        run: >
          uv run python -c "import os;
          from hackproof.db_utils.connection import Connection;
          print('\n'.join(Connection.from_url(os.environ['DATABASE_URL']).mask_lines()))"
      - name: Regenerate the data files from the database
        run: uv run hackproof export
      - uses: peter-evans/create-pull-request@v7
        with:
          branch: chore/sync-data
          delete-branch: true
          commit-message: "fix: sync the data files with the database"
          title: "fix: sync the data files with the database"
          body: |
            The database and the committed data files had drifted apart. This regenerates the files from the database so they match again.

            - the files are rewritten by `hackproof export`, the same command that produced them
            - review the diff, then merge to bring the repo back in sync
            - this branch is refreshed on every scheduled run until it is merged
          labels: data
          add-paths: data/**