CI/CD

#Credentials

• Create a custom key with the admin role for CI (sov keys create --name ci --role admin, or Project Settings › API keys) and store it as a repository secret; the CLI reads it from SOVARIA_API_KEY, with no sov login step. Schema changes need the admin role.
• Pass --project (and --org when the key alone doesn't decide it) on every command — linked folders and saved logins are ignored while a key is set.
• Never print keys in logs; give each pipeline its own key so you can revoke one alone (API keys).

#A pipeline

1. 1

   Check migrations

   sov db migrations push --dry-run runs each pending migration in a transaction and rolls it back. Each file is checked on its own, so a pull request with migrations that build on each other is better checked by applying them to staging (Migrations).

2. 2

   Check access

   sov rules test runs the cases in sovaria.rules.test.yaml (start one with sov rules init); sov sim run --fail-on critical runs a full access simulation and fails on findings at that level. Each uses one policy simulation from the plan's monthly allowance.

3. 3

   Deploy

   Apply migrations and deploy functions. With an environment, add --env <environment-id> to deploy to staging and run your integration tests against its URL.

4. 4

   Promote

   Move staging's changes to production with Deploy to production in the console, which checks everything with nothing written first (Environments, staging and deploying to production). There is no CLI command for it yet. With Staging first on, production changes only this way.

name: sovaria
on: [pull_request, push]

jobs:
  checks:
    runs-on: ubuntu-latest
    env:
      SOVARIA_API_KEY: ${{ secrets.SOVARIA_API_KEY }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install sovaria-cli
      - run: sov db migrations push --dry-run --project ${{ vars.SOVARIA_PROJECT_ID }}
      - run: sov rules test sovaria.rules.test.yaml --junit rules.xml --project ${{ vars.SOVARIA_PROJECT_ID }}
      - run: sov sim run --fail-on critical --project ${{ vars.SOVARIA_PROJECT_ID }}

  deploy:
    if: github.ref == 'refs/heads/main'
    needs: checks
    runs-on: ubuntu-latest
    env: { SOVARIA_API_KEY: ${{ secrets.SOVARIA_API_KEY }} }
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install sovaria-cli
      - run: sov db migrations push --project ${{ vars.SOVARIA_PROJECT_ID }}
      - run: sov fn deploy ./functions/send-receipt --name send-receipt --note "${{ github.sha }}" --project ${{ vars.SOVARIA_PROJECT_ID }}

Every step exits non-zero on failure (1 for a failed request or check, 2 for wrong usage), so the job stops there. Flags for each command: CLI reference.

#When a step fails