sync-db.yml

name: "Manage: Sync Production"

on:
  workflow_call:
    secrets:
      DEPLOY_SSH_PRIVATE_KEY:
        required: true
      NPM_FONTAWESOME_AUTH_TOKEN:
        required: true
      PACKAGIST_GITHUB_TOKEN:
        required: true
      DB_ARTIFACT_KEY:
        required: true

permissions:
  contents: read

jobs:
  sync:
    name: Pull, sanitize and upload DB
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: generoi/github-actions/ssh-agent@v1
        with:
          ssh-private-key: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}

      - name: Setup project
        uses: generoi/github-actions/setup@v1
        with:
          npm_fontawesome_auth_token: ${{ secrets.NPM_FONTAWESOME_AUTH_TOKEN }}
          packagist_github_token: ${{ secrets.PACKAGIST_GITHUB_TOKEN }}

      - name: Install dependencies
        run: composer install:development

      - name: Add remote public keys to known hosts
        run: ssh-keyscan -p $(./vendor/bin/robo config env.@production.port || echo 22) $(./vendor/bin/robo config env.@production.host) >> ~/.ssh/known_hosts

      - name: Setup DDEV
        uses: generoi/github-actions/setup-ddev@v1

      - name: Pull database from production
        run: ./vendor/bin/robo db:pull @production

      - name: Sanitize and export
        run: |
          mkdir -p .github/fixtures
          ddev exec CI=true wp db export-clean .github/fixtures/sanitized-db.sql --remove-keys
          gzip -f .github/fixtures/sanitized-db.sql

      - name: Encrypt artifact
        env:
          DB_ARTIFACT_KEY: ${{ secrets.DB_ARTIFACT_KEY }}
        run: |
          openssl enc -aes-256-cbc -pbkdf2 -salt \
            -in .github/fixtures/sanitized-db.sql.gz \
            -out .github/fixtures/sanitized-db.sql.gz.enc \
            -pass env:DB_ARTIFACT_KEY

      - name: Upload sanitized DB artifact
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
        with:
          name: sanitized-db
          path: .github/fixtures/sanitized-db.sql.gz.enc
          retention-days: 90