add migration pipeline

.github/workflows/apps-migrations.yaml

@@ -0,0 +1,60 @@
+name: CD / Migrations
+
+on:
+  pull_request:
+    branches: ["*"]
+    paths:
+      - packages/db/**
+      - .github/workflows/apps-migrations.yaml
+      - pnpm-lock.yaml
+  push:
+    branches: ["main"]
+    paths:
+      - packages/db/**
+      - .github/workflows/apps-migrations.yaml
+      - pnpm-lock.yamlaa
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ctrlplane/migrations
+          tags: |
+            type=sha,format=short,prefix=
+
+      - name: Build
+        uses: docker/build-push-action@v6
+        if: github.ref != 'refs/heads/main'
+        with:
+          push: false
+          file: package/db/Dockerfile
+          tags: ${{ steps.meta.outputs.tags }}
+
+      - name: Build and Push
+        uses: docker/build-push-action@v6
+        if: github.ref == 'refs/heads/main'
+        with:
+          push: true
+          file: package/db/Dockerfile
+          tags: ${{ steps.meta.outputs.tags }}

apps/docs/Dockerfile

@@ -1,4 +1,4 @@
-ARG NODE_VERSION=24
+ARG NODE_VERSION=22
 FROM node:${NODE_VERSION}-alpine AS base
 
 

apps/job-policy-checker/Dockerfile

@@ -34,8 +34,6 @@ COPY . .
 
 RUN turbo build --filter=...@ctrlplane/job-policy-checker
 
-WORKDIR /app
-
 RUN addgroup --system --gid 1001 nodejs
 RUN adduser --system --uid 1001 nodejs
 USER nodejs

packages/db/Dockerfile

@@ -0,0 +1,38 @@
+ARG NODE_VERSION=22
+FROM node:${NODE_VERSION}-alpine
+
+WORKDIR /app
+
+RUN apk add --no-cache libc6-compat python3 make g++
+
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+
+RUN npm install -g turbo
+RUN corepack enable pnpm
+
+COPY .gitignore .gitignore
+COPY turbo.json turbo.json
+RUN pnpm add -g turbo
+
+COPY package.json package.json
+COPY pnpm-*.yaml .
+
+COPY tooling/prettier/package.json ./tooling/prettier/package.json
+COPY tooling/eslint/package.json ./tooling/eslint/package.json
+COPY tooling/typescript/package.json ./tooling/typescript/package.json
+
+COPY packages/db/package.json ./packages/db/package.json
+
+RUN pnpm install --frozen-lockfile
+COPY . .
+
+RUN turbo build --filter=@ctrlplane/db...
+
+RUN addgroup --system --gid 1001 nodejs
+RUN adduser --system --uid 1001 nodejs
+USER nodejs
+
+COPY ./packages/db/drizzle ./packages/db/dist/drizzle
+
+CMD node packages/db/dist/migrate.js