feat(run-ops): dedicated run-ops database package + docker service + migration runner

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: d-cs

.github/workflows/unit-tests-internal.yml

@@ -95,6 +95,7 @@ jobs:
           }
           echo "Pre-pulling Docker images with authenticated session..."
           pull postgres:14
+          pull postgres:17 # for the heterogeneous PG14/17 test fixture gate (heteroPostgresTest)
           pull clickhouse/clickhouse-server:26.2.19.43-alpine@sha256:c6ad6a7eb2fb5999df3adfb8b69a0c7222c68fa9b8f6b04a088564ebbc959251
           pull redis:7.2
           pull testcontainers/ryuk:0.14.0

docker/Dockerfile.postgres17

@@ -0,0 +1,5 @@
+FROM postgres:17
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends postgresql-17-partman \
+    && rm -rf /var/lib/apt/lists/*

docker/docker-compose.yml

@@ -11,6 +11,7 @@ name: triggerdotdev-docker
 volumes:
   database-data:
   database-data-alt:
+  database-runops-data:
   database-replica-data:
   redis-data:
   minio-data:
@@ -51,6 +52,36 @@ services:
       - -c
       - max_connections=500
 
+  # Opt-in NEW run-ops database, PG17 (the `database` above is PG14) — a separate cluster
+  # so the run-ops split's distinct-DB sentinel passes. Start with:
+  #   COMPOSE_PROFILES=runops pnpm run docker
+  database-runops:
+    container_name: ${CONTAINER_PREFIX:-}database-runops
+    profiles: ["runops"]
+    build:
+      context: .
+      dockerfile: Dockerfile.postgres17
+    restart: always
+    volumes:
+      - ${DB_RUNOPS_VOLUME:-database-runops-data}:/var/lib/postgresql/data/
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: postgres
+    networks:
+      - app_network
+    ports:
+      - "${POSTGRES_RUNOPS_HOST_PORT:-5434}:5432"
+    command:
+      - -c
+      - listen_addresses=*
+      - -c
+      - wal_level=logical
+      - -c
+      - shared_preload_libraries=pg_partman_bgw
+      - -c
+      - max_connections=500
+
   # Opt-in streaming read replica with configurable apply lag — a dial-a-lag rig for
   # testing replica-race behavior (e.g. the realtime read-your-writes gate) locally.
   # Start with: COMPOSE_PROFILES=replica pnpm run docker

internal-packages/database/package.json

@@ -18,6 +18,7 @@
     "generate": "prisma generate",
     "db:migrate:dev:create": "prisma migrate dev --create-only",
     "db:migrate:deploy": "prisma migrate deploy",
+    "db:migrate:run-ops": "node scripts/migrate-run-ops.mjs",
     "db:push": "prisma db push",
     "db:studio": "prisma studio",
     "db:reset": "prisma migrate reset",

internal-packages/database/scripts/migrate-run-ops.mjs

@@ -0,0 +1,62 @@
+// Apply Prisma migrations to the RUN-OPS database — the second physical DB in the run-ops
+// split. The standard `db:migrate` only targets DATABASE_URL (the control-plane DB), so the
+// run-ops DB must be migrated explicitly or its schema drifts (e.g. cross-DB FKs that were
+// dropped on the control-plane DB linger on the run-ops DB and break inserts).
+//
+// The run-ops connection comes from TASK_RUN_DATABASE_URL / TASK_RUN_DATABASE_DIRECT_URL
+// (set directly in deploy environments; read from the local .env otherwise). We then run
+// `prisma migrate deploy` with DATABASE_URL/DIRECT_URL pointed at it.
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const dbPackageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+function readFromEnvFiles(key) {
+  for (const file of [resolve(dbPackageRoot, ".env"), resolve(dbPackageRoot, "../../.env")]) {
+    let contents;
+    try {
+      contents = readFileSync(file, "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of contents.split("\n")) {
+      const match = line.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);
+      if (!match || match[1] !== key) continue;
+      let value = match[2];
+      if (
+        (value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))
+      ) {
+        value = value.slice(1, -1);
+      }
+      if (value) return value;
+    }
+  }
+  return undefined;
+}
+
+const resolveVar = (key) => process.env[key] || readFromEnvFiles(key);
+const redact = (url) => url.replace(/:\/\/[^@]*@/, "://***@");
+
+const databaseUrl = resolveVar("TASK_RUN_DATABASE_URL");
+const directUrl = resolveVar("TASK_RUN_DATABASE_DIRECT_URL") || databaseUrl;
+
+if (!databaseUrl) {
+  console.error(
+    "db:migrate:run-ops: TASK_RUN_DATABASE_URL is not set (checked env and .env). " +
+      "It is the run-ops database in the split — nothing to migrate without it."
+  );
+  process.exit(1);
+}
+
+console.log(`Applying Prisma migrations to the run-ops database (${redact(databaseUrl)})`);
+
+const result = spawnSync("prisma", ["migrate", "deploy"], {
+  cwd: dbPackageRoot,
+  stdio: "inherit",
+  env: { ...process.env, DATABASE_URL: databaseUrl, DIRECT_URL: directUrl },
+});
+
+process.exit(result.status ?? 1);

internal-packages/run-ops-database/.env

@@ -0,0 +1 @@
+../../.env

internal-packages/run-ops-database/.gitignore

@@ -0,0 +1,6 @@
+node_modules
+dist
+generated/run-ops
+
+# Ensure the .env symlink is not removed by accident
+!.env

internal-packages/run-ops-database/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@internal/run-ops-database",
+  "private": true,
+  "version": "0.0.1",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "@triggerdotdev/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./prisma/schema.prisma": "./prisma/schema.prisma",
+    "./prisma/*": "./prisma/*",
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@prisma/client": "6.14.0",
+    "prisma": "6.14.0"
+  },
+  "devDependencies": {
+    "rimraf": "6.0.1",
+    "vitest": "4.1.7"
+  },
+  "scripts": {
+    "clean": "rimraf dist",
+    "generate": "prisma generate",
+    "db:migrate:dev:create": "prisma migrate dev --create-only",
+    "db:migrate:deploy": "prisma migrate deploy",
+    "db:push": "prisma db push",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "build": "pnpm run clean && tsc --noEmit false --outDir dist --declaration",
+    "dev": "tsc --noEmit false --outDir dist --declaration --watch",
+    "db:studio": "prisma studio",
+    "db:reset": "prisma migrate reset"
+  }
+}