feat: add approval step via harness ui #11607
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,162 @@ | ||
| --- | ||
| title: Preview SQL with Manual Approval | ||
| description: Learn how to preview SQL changes in Harness DB DevOps pipelines and enforce manual approval before applying schema changes. | ||
| sidebar_position: 11 | ||
| keywords: | ||
| - preview sql | ||
| - harness dbops | ||
| - manual approval | ||
| - database pipeline | ||
| - sql review | ||
| - schema deployment | ||
| - db change governance | ||
| - harness database devops | ||
| - dbops approval workflow | ||
| tags: | ||
| - harness-db-devops | ||
| - sql-preview | ||
| - approval-gates | ||
| - deployment-safety | ||
| - governance | ||
|
|
||
| --- | ||
|
|
||
| import Tabs from '@theme/Tabs'; | ||
| import TabItem from '@theme/TabItem'; | ||
|
|
||
| Harness DB DevOps allows you to integrate a **Preview SQL** step in your pipeline to review generated SQL before applying schema changes to the database. | ||
| This workflow ensures **governance, visibility, and control**, as you can add a **Manual Approval** step between previewing and executing the changes. | ||
|
|
||
| The typical workflow looks like this: | ||
|
|
||
| 1. Clone the Git repository containing migration scripts. | ||
| 2. Run the **Preview SQL** step to generate SQL for the changes. | ||
| 3. Pause the pipeline at a **Manual Approval** gate for human verification. | ||
| 4. After approval, proceed with the **DB Schema Apply** step to deploy the changes. | ||
|
|
||
| <Tabs> | ||
| <TabItem value="Pipeline Setup" label="Pipeline Setup"> | ||
|
|
||
|  | ||
| </TabItem> | ||
| <TabItem value="YAML Setup" label="YAML Setup"> | ||
|
|
||
| ```yaml | ||
| pipeline: | ||
| name: mux-sql | ||
| identifier: muxsql | ||
| projectIdentifier: default_project | ||
| orgIdentifier: default | ||
| tags: {} | ||
| stages: | ||
| - stage: | ||
| name: deploy | ||
| identifier: deploy | ||
| description: "preview SQL changes in Harness DB DevOps pipelines and enforce manual approval before applying schema changes." | ||
| type: Custom | ||
| spec: | ||
| execution: | ||
| steps: | ||
| - stepGroup: | ||
| name: preview | ||
| identifier: preview | ||
| steps: | ||
| - step: | ||
| type: LiquibaseCommand | ||
| name: Preview | ||
| identifier: Preview | ||
| spec: | ||
| connectorRef: account.harnessImage | ||
| command: " update-sql" | ||
| dbSchema: cockroachDB | ||
| dbInstance: cab | ||
| timeout: 10m | ||
| stepGroupInfra: | ||
| type: KubernetesDirect | ||
| spec: | ||
| connectorRef: db | ||
| - step: | ||
| type: HarnessApproval | ||
| name: Approval | ||
| identifier: Approval | ||
| spec: | ||
| approvalMessage: Please review the following information and approve the pipeline progression | ||
| includePipelineExecutionHistory: true | ||
| isAutoRejectEnabled: false | ||
| approvers: | ||
| userGroups: | ||
| - account._account_all_users | ||
| minimumCount: 1 | ||
| disallowPipelineExecutor: false | ||
| approverInputs: [] | ||
| timeout: 1d | ||
| - stepGroup: | ||
| name: deploy | ||
| identifier: deploy | ||
| steps: | ||
| - step: | ||
| type: DBSchemaApply | ||
| name: DB Schema Apply | ||
| identifier: DB_Schema_Apply | ||
| spec: | ||
| connectorRef: account.harnessImage | ||
| dbSchema: cockroachDB | ||
| dbInstance: cab | ||
| markNextChangeSetRun: true | ||
| timeout: 10m | ||
| stepGroupInfra: | ||
| type: KubernetesDirect | ||
| spec: | ||
| connectorRef: db | ||
| rollbackSteps: [] | ||
| serviceDependencies: [] | ||
| tags: {} | ||
| delegateSelectors: | ||
| - harness-gke-delegate | ||
| ``` | ||
| </TabItem> | ||
| </Tabs> | ||
|
|
||
| ## Setting Up the Workflow | ||
|
|
||
| In your pipeline’s **Execution** tab, add the following steps: | ||
|
|
||
| | Step | Description | | ||
| |-----------------|-----------------------------------------------------------------------------| | ||
| | **Git Clone** | Clones the migration scripts from the connected Git repository. | | ||
|
There was a problem hiding this comment. the user doesn't add a 'git clone' step. its an automatic subsetp of the 'preview' step |
||
| | **Preview SQL** | Generates SQL statements from your changelog or schema definition. | | ||
|
There was a problem hiding this comment. we don't have a step called 'preview SQL''. I believe this is referring to 'DBSchema Update SQL' (should we also nmentioned they can use 'DB Schema Rollback SQL' for previewing the sql when rolling back?) There was a problem hiding this comment. I agree, with this. Both during the apply and rollback they should know what sql is being applied |
||
| | **Approval** | Adds a manual approval gate where users must review and confirm SQL changes. | | ||
| | **DB Schema Apply** | Applies the approved SQL changes to the target database instance. | | ||
|
|
||
| ## SQL Preview | ||
|
|
||
| The **Preview SQL** step shows a generated SQL script based on the detected changes. | ||
| This allows DBAs and developers to: | ||
|
|
||
| - Validate the correctness of the SQL. | ||
| - Identify potential issues such as destructive changes. | ||
| - Ensure compliance with internal policies. | ||
|
|
||
| Example output: | ||
|
|
||
| ```sql | ||
| CREATE TABLE products | ||
| ( | ||
| id SERIAL, | ||
| name TEXT NOT NULL, | ||
| price NUMERIC(10,2) NOT NULL DEFAULT 0.00, | ||
| CONSTRAINT products_pkey PRIMARY KEY (id) | ||
| ); | ||
| ``` | ||
| ## Manual Approval Step | ||
| The Approval step acts as a gate in the pipeline. When the pipeline reaches this stage: | ||
| - A notification is sent to the designated approvers. | ||
| - Approvers can review the Preview SQL output before continuing. | ||
| - The pipeline proceeds to the DB Schema Apply step only after approval. | ||
| This ensures that no schema changes are deployed without human validation. | ||
|
|
||
| ## Applying Schema Changes | ||
| After approval, the pipeline executes the `Apply Schema` step. This deploys the reviewed SQL script to the configured database instance. For example: | ||
| - **Preview SQL:** shows the generated ALTER TABLE statement. | ||
| - **Approval:** DBA confirms the change is safe. | ||
| - **DB Schema Apply:** Executes the approved change on the target database. | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
a month ago you wouldn't have gotten this comment, but I noticed this morning we apparently have purpose build steps for this now (DBSchemaUpdate). Lets update the yaml to use the purpose built step instead of liquibase command (new full steps for this was needed so customers can do this usecase while benefiting from the large log size limit).