Repository navigation
59 lines (59 loc) · 2.02 KB
/
Copy pathoperations.yml
File metadata and controls
59 lines (59 loc) · 2.02 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
name: daily-backup-and-health
on:
workflow_dispatch:
schedule:
- cron: '23 1 * * *'
permissions:
contents: read
concurrency:
group: bioai-daily-operations
cancel-in-progress: false
jobs:
backup:
runs-on: ubuntu-24.04
timeout-minutes: 15
services:
restore:
image: postgres:17
env:
POSTGRES_USER: restore_test
POSTGRES_PASSWORD: ephemeral-restore-only
POSTGRES_DB: restored
ports:
- 5432:5432
options: >-
--health-cmd "pg_isready -U restore_test"
--health-interval 5s
--health-timeout 5s
--health-retries 10
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: '3.12'
- run: python -m pip install -r backend/requirements.lock
- name: Check live service and source freshness
continue-on-error: true
env:
DATABASE_URL: ${{ secrets.BIOAI_BACKUP_DATABASE_URL }}
BIOAI_SITE_ORIGIN: ${{ vars.BIOAI_SITE_ORIGIN }}
run: python scripts/operations.py health --report operations-health.json
- name: Encrypted backup and isolated restore drill
env:
DATABASE_URL: ${{ secrets.BIOAI_BACKUP_DATABASE_URL }}
BACKUP_PASSPHRASE: ${{ secrets.BIOAI_BACKUP_PASSPHRASE }}
RESTORE_DATABASE_URL: postgresql://restore_test:[email protected]:5432/restored
run: python scripts/operations.py backup --output backup --pg-docker-container '${{ job.services.restore.id }}'
- uses: actions/upload-artifact@v4
if: always()
with:
name: bioai-encrypted-backup-${{ github.run_id }}
path: |
backup/*.gpg
backup/manifest.json
operations-health.json
retention-days: 7
if-no-files-found: error
- name: Fail unhealthy runs after preserving the backup artifact
if: always()
run: python scripts/operations.py check-health --report operations-health.json