change migrations to use single shot

Author: geleeroyale

.github/workflows/master-pipeline.yml

@@ -73,9 +73,28 @@ jobs:
             cd giveth-all
             docker compose pull
 
-  rollout-deploy-1:
+  migrate:
     needs: deploy
     runs-on: ubuntu-latest
+    steps:
+      - name: SSH and Run DB Migrations (one-shot)
+        uses: appleboy/ssh-action@v1.0.0
+        with:
+          host: ${{ secrets.PROD_HOST_ALL }}
+          username: ${{ secrets.PROD_USERNAME_ALL }}
+          key: ${{ secrets.PROD_PRIVATE_KEY_ALL }}
+          port: ${{ secrets.SSH_PORT }}
+          script: |
+            set -e
+            cd giveth-all
+            echo "Running database migrations (one-shot) before rollout"
+            # One-shot container: runs migrations, then exits. Non-zero exit fails the deploy.
+            docker compose run --rm impact-graph-migrations
+            echo "Migrations complete"
+
+  rollout-deploy-1:
+    needs: migrate
+    runs-on: ubuntu-latest
     steps:
       - name: SSH and Redeploy
         uses: appleboy/ssh-action@v1.0.0

.github/workflows/staging-pipeline.yml

@@ -132,9 +132,32 @@ jobs:
             
             echo "✅ Verified image pulled: ghcr.io/giveth/impact-graph@${{ needs.publish.outputs.image-digest }}"
 
-  rollout-deploy-1:
+  migrate:
     needs: deploy
     runs-on: ubuntu-latest
+    permissions:
+      contents: none      # Minimal - only for actions to work
+    steps:
+      - name: SSH and Run DB Migrations (one-shot)
+        uses: appleboy/ssh-action@v1.2.2
+        with:
+          host: ${{ secrets.STAGING_HOST_ALL }}
+          username: ${{ secrets.STAGING_USERNAME_ALL }}
+          key: ${{ secrets.STAGING_PRIVATE_KEY_ALL }}
+          port: ${{ secrets.SSH_PORT }}
+          script: |
+            set -e
+            cd giveth-all
+            # Load the verified image SHA so migrations run on the exact image being deployed
+            export $(cat .env.impact-graph | xargs)
+            echo "🗃️  Running database migrations using verified image: $IMPACT_GRAPH_IMAGE"
+            # One-shot container: runs migrations, then exits. Non-zero exit fails the deploy.
+            docker compose run --rm impact-graph-migrations
+            echo "✅ Migrations complete"
+
+  rollout-deploy-1:
+    needs: migrate
+    runs-on: ubuntu-latest
     permissions:
       contents: none      # Minimal - only for actions to work
     steps:

Dockerfile

@@ -1,5 +1,5 @@
 #https://hub.docker.com/_/node?tab=tags&page=1
-FROM node:20.11.0-alpine3.18
+FROM node:22.18.0-alpine3.21
 
 WORKDIR /usr/src/app
 
@@ -11,7 +11,7 @@ COPY tsconfig.json .
 
 RUN apk add --update alpine-sdk
 RUN apk add git python3
-RUN apk add --no-cache  chromium --repository=http://dl-cdn.alpinelinux.org/alpine/v3.18/main
+RUN apk add --no-cache  chromium --repository=http://dl-cdn.alpinelinux.org/alpine/v3.21/main
 RUN npm ci
 RUN npm i -g ts-node
 
@@ -23,3 +23,8 @@ COPY test ./test
 COPY migration ./migration
 
 RUN npm run build
+
+# Default startup runs the app WITHOUT migrations. Database migrations are run by a
+# dedicated one-shot container/CI step (npm run start:docker:migrate) to avoid multiple
+# replicas racing to migrate on boot. Compose services may override this command.
+CMD ["npm", "run", "production"]

package.json

@@ -242,6 +242,7 @@
         "dev": "NODE_ENV=development node ./build/src/index.js",
         "production": "NODE_ENV=production node ./build/src/index.js",
         "start:docker:server": "npm run db:migrate:run:production && npm run production",
+        "start:docker:migrate": "npm run db:migrate:run:production",
         "start:docker:locally": "npm run db:migrate:run:local && npm run dev",
         "postinstall": "patch-package"
     },