feat(deploy): add PlanetScale bootstrap and Vitess config by aparajon · Pull Request #75 · block/schemabot

aparajon · 2026-05-08T06:13:33Z

Summary

Add scripts and config to bootstrap a PlanetScale database for testing the Vitess engine with the PR workflow.

bootstrap-planetscale.sh — single command creates everything:

PlanetScale database with unsharded + sharded keyspaces
Safe migrations enabled on main branch
Service token with 11 required permissions
Vtgate password for progress polling
Credentials stored in AWS Secrets Manager
Cleans up service tokens and SM secrets on delete

Config changes:

Add commerce (Vitess) database to staging config example
Gitignore config.yaml — use config.yaml.example pattern (like terraform.tfvars)
Deploy script tags images with <sha>-<config-hash> for determinism
CI creates config.yaml from .example before Docker build

Error message improvement:

Replace "unknown deployment: default" with "database not found in server configuration" when a database isn't configured

🤖 Generated with Claude Code

Copilot

Pull request overview

Adds PlanetScale/ Vitess bootstrap + credential-secrets scripts to support a Vitess PR workflow in the AWS multi-env staging deployment, and registers an optional Vitess database entry in staging config.

Changes:

Add bootstrap-planetscale.sh to create a PlanetScale database with unsharded + sharded keyspaces, plus credentials.
Add setup-planetscale-token.sh to write the generated PlanetScale service token and vtgate DSN into AWS Secrets Manager.
Extend staging config.yaml with an optional commerce Vitess database configuration.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
deploy/aws-multi-env/staging/config.yaml	Adds an optional Vitess/PlanetScale database config for staging.
deploy/aws-multi-env/scripts/setup-planetscale-token.sh	New script to store PlanetScale token + vtgate DSN as Secrets Manager secrets.
deploy/aws-multi-env/scripts/bootstrap-planetscale.sh	New script to create/manage a PlanetScale database and generate required credentials.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Add scripts to bootstrap a PlanetScale database for testing the Vitess engine with the PR workflow: - bootstrap-planetscale.sh: creates database with sharded + unsharded keyspaces, service token with required permissions, and vtgate password for progress polling - setup-planetscale-token.sh: stores credentials in AWS Secrets Manager Add commerce (Vitess) database to staging config. Credentials are resolved lazily so MySQL-only deployments are unaffected. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Handle --help before --org validation so help works without flags - Use jq -re to fail on null/missing fields instead of silently producing "null" strings - Default terraform output to {} on failure so the prefix check produces the intended error message Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Replace internal "tern client: unknown deployment: default" error with user-friendly message: database "X" (env): not found in server configuration. Log a warning in resolveDeployment when falling back to the default deployment. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Save PlanetScale credentials to .planetscale-credentials (gitignored) instead of printing to console - setup-planetscale-token.sh reads from the file automatically - Add step to enable safe migrations on main branch (required for deploy requests) - Fix --org flag position (must be trailing, not before subcommand) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Service token access associations are lost after database deletion, making cleanup impossible. Delete tokens with access to the database first by checking each token's access list via show-access. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Follow the terraform.tfvars pattern: check in config.yaml.example with placeholders, gitignore config.yaml with actual deployment values. The deploy script auto-copies example → config.yaml on first run. This prevents org-specific values (like PlanetScale organization names) from being committed to the OSS repo. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pscale service-token delete doesn't support --force (only database delete does). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@tcp

The vtgate DSN contains parentheses in @tcp(...) which breaks when sourced as a shell script without quoting. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

setup-planetscale-token.sh runs from staging/ but the credentials file may be in the parent directory if bootstrap was run from deploy/aws-multi-env/. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Single command does everything: creates PlanetScale DB, credentials, and stores them in Secrets Manager. Uses --env to resolve the terraform state directory automatically — no need to cd first. Removes setup-planetscale-token.sh (functionality merged into bootstrap). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Delete now also removes Secrets Manager entries and the local credentials file. --env is required for both create and delete. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Use naming convention (schemabot-<env>) for Secrets Manager prefix instead of reading terraform state. PlanetScale infra isn't managed by terraform so the script shouldn't depend on it. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Show AWS profile, region, and prefix. Don't swallow errors from AWS CLI — show output on failure and exit. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…o image tag Dockerfile copies config.yaml.example (always in repo) instead of config.yaml (gitignored). Deploy script tags images with <sha>-<config-hash> for determinism and allows config.yaml to differ from committed code without failing the dirty-tree check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings May 8, 2026 06:13

Copilot started reviewing on behalf of aparajon May 8, 2026 06:14 View session

Copilot AI reviewed May 8, 2026

View reviewed changes

aparajon force-pushed the worktree-ps-bootstrap branch 2 times, most recently from c5f9f49 to aff1547 Compare May 9, 2026 21:55

aparajon and others added 7 commits May 9, 2026 18:08

fix(scripts): correct step count to 6

cd106d8

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

aparajon force-pushed the worktree-ps-bootstrap branch from 8422785 to 101e4fa Compare May 9, 2026 22:09

aparajon and others added 11 commits May 9, 2026 18:11

fix(scripts): remove --force from service-token delete

f4956d6

pscale service-token delete doesn't support --force (only database delete does). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(scripts): quote values in credentials file

6f33e7b

The vtgate DSN contains parentheses in @tcp(...) which breaks when sourced as a shell script without quoting. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(scripts): search parent dirs for credentials file

62cabf8

setup-planetscale-token.sh runs from staging/ but the credentials file may be in the parent directory if bootstrap was run from deploy/aws-multi-env/. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(scripts): clarify to run from environment directory

08592f9

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(scripts): require --env for delete, clean up Secrets Manager

d8db56b

Delete now also removes Secrets Manager entries and the local credentials file. --env is required for both create and delete. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(scripts): add success message after SM credential storage

8821815

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(scripts): log when SM secrets not found during delete

eed46dc

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(scripts): add verbose logging for Secrets Manager operations

8487d16

Show AWS profile, region, and prefix. Don't swallow errors from AWS CLI — show output on failure and exit. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

aparajon force-pushed the worktree-ps-bootstrap branch from fd27064 to 7272897 Compare May 11, 2026 02:18

aparajon marked this pull request as ready for review May 11, 2026 02:38

aparajon requested review from Kiran01bm and morgo as code owners May 11, 2026 02:38

aparajon changed the title ~~feat(deploy): add PlanetScale bootstrap scripts for Vitess PR workflow~~ feat(deploy): add PlanetScale bootstrap and Vitess config May 11, 2026

morgo approved these changes May 11, 2026

View reviewed changes

aparajon merged commit 2fcc0c6 into main May 11, 2026
23 checks passed

aparajon deleted the worktree-ps-bootstrap branch May 11, 2026 13:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(deploy): add PlanetScale bootstrap and Vitess config#75

feat(deploy): add PlanetScale bootstrap and Vitess config#75
aparajon merged 18 commits into
mainfrom
worktree-ps-bootstrap

aparajon commented May 8, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

aparajon commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aparajon commented May 8, 2026 •

edited

Loading