Skip to content

Commit 233e153

Browse files
adela-bytebaseadela-bytebase
committed
update
1 parent 7da97f1 commit 233e153

File tree

2 files changed

+200
-0
lines changed

2 files changed

+200
-0
lines changed

‎.github/workflows/hello-world.yml

+182
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
name: Hello World Action
2+
on:
3+
pull_request:
4+
types: [opened, synchronize, reopened]
5+
branches:
6+
- main
7+
- develop
8+
workflow_dispatch:
9+
inputs:
10+
name:
11+
description: "Who to greet"
12+
required: true
13+
default: "World"
14+
15+
jobs:
16+
hello-world:
17+
runs-on: ubuntu-latest
18+
permissions:
19+
pull-requests: write
20+
issues: write
21+
contents: read
22+
steps:
23+
- name: Checkout code
24+
uses: actions/checkout@v4
25+
26+
- name: Login Bytebase
27+
id: bytebase-login
28+
uses: bytebase/[email protected]
29+
with:
30+
bytebase-url: ${{ secrets.BYTEBASE_URL }}
31+
service-key: ${{ secrets.BYTEBASE_SERVICE_KEY }}
32+
service-secret: ${{ secrets.BYTEBASE_SERVICE_SECRET }}
33+
34+
- name: Get changed files
35+
id: changed-files
36+
uses: tj-actions/changed-files@v42
37+
with:
38+
files: |
39+
masking/databases/**/**/column-masking.json
40+
masking/projects/**/masking-exception.json
41+
42+
- name: Debug changed files in detail
43+
run: |
44+
echo "All changed files:"
45+
echo "${{ steps.changed-files.outputs.all_changed_files }}"
46+
echo "Contains column-masking.json: ${{ contains(steps.changed-files.outputs.all_changed_files, 'column-masking.json') }}"
47+
echo "Contains masking-exception.json: ${{ contains(steps.changed-files.outputs.all_changed_files, 'masking-exception.json') }}"
48+
echo "Raw output:"
49+
echo "${{ toJSON(steps.changed-files.outputs) }}"
50+
51+
- name: Apply column masking policy
52+
id: apply-column-masking
53+
if: ${{ steps.changed-files.outputs.any_changed == 'true' && contains(steps.changed-files.outputs.all_changed_files, '/column-masking.json') }}
54+
run: |
55+
# Process all column-masking.json files
56+
echo "${{ steps.changed-files.outputs.all_changed_files }}" | tr ' ' '\n' | grep "column-masking.json" | while read -r CHANGED_FILE; do
57+
echo "Processing: $CHANGED_FILE"
58+
INSTANCE_NAME=$(echo "$CHANGED_FILE" | sed -n 's/masking\/databases\/\([^/]*\)\/\([^/]*\).*/\1/p')
59+
DATABASE_NAME=$(echo "$CHANGED_FILE" | sed -n 's/masking\/databases\/\([^/]*\)\/\([^/]*\).*/\2/p')
60+
echo "INSTANCE_NAME=$INSTANCE_NAME"
61+
echo "DATABASE_NAME=$DATABASE_NAME"
62+
63+
response=$(curl -s -w "\n%{http_code}" --request PATCH "${{ steps.bytebase-login.outputs.api_url }}/instances/${INSTANCE_NAME}/databases/${DATABASE_NAME}/policies/masking?allow_missing=true&update_mask=payload" \
64+
--header "Authorization: Bearer ${{ steps.bytebase-login.outputs.token }}" \
65+
--header "Content-Type: application/json" \
66+
--data @"$CHANGED_FILE")
67+
68+
# Extract status code and response body
69+
status_code=$(echo "$response" | tail -n1)
70+
body=$(echo "$response" | sed '$d')
71+
72+
echo "Status code: $status_code"
73+
echo "Response body: $body"
74+
75+
# Append to outputs (with unique identifiers)
76+
echo "status_code_${DATABASE_NAME}=${status_code}" >> $GITHUB_OUTPUT
77+
echo "response_${DATABASE_NAME}<<EOF" >> $GITHUB_OUTPUT
78+
echo "${body}" >> $GITHUB_OUTPUT
79+
echo "EOF" >> $GITHUB_OUTPUT
80+
81+
if [[ $status_code -lt 200 || $status_code -ge 300 ]]; then
82+
echo "Failed with status code: $status_code for database: $DATABASE_NAME"
83+
exit 1
84+
fi
85+
done
86+
87+
- name: Apply masking exception policy
88+
id: apply-masking-exception
89+
if: ${{ steps.changed-files.outputs.any_changed == 'true' && contains(steps.changed-files.outputs.all_changed_files, '/masking-exception.json') }}
90+
run: |
91+
# Process all masking-exception.json files
92+
echo "${{ steps.changed-files.outputs.all_changed_files }}" | tr ' ' '\n' | grep "masking-exception.json" | while read -r CHANGED_FILE; do
93+
echo "Processing: $CHANGED_FILE"
94+
PROJECT_NAME=$(echo "$CHANGED_FILE" | sed -n 's/masking\/projects\/\([^/]*\).*/\1/p')
95+
echo "PROJECT_NAME=$PROJECT_NAME"
96+
97+
response=$(curl -s -w "\n%{http_code}" --request PATCH "${{ steps.bytebase-login.outputs.api_url }}/projects/${PROJECT_NAME}/policies/masking_exception?allow_missing=true&update_mask=payload" \
98+
--header "Authorization: Bearer ${{ steps.bytebase-login.outputs.token }}" \
99+
--header "Content-Type: application/json" \
100+
--data @"$CHANGED_FILE")
101+
102+
# Extract status code and response body
103+
status_code=$(echo "$response" | tail -n1)
104+
body=$(echo "$response" | sed '$d')
105+
106+
echo "Status code: $status_code"
107+
echo "Response body: $body"
108+
109+
# Append to outputs (with unique identifiers)
110+
echo "status_code_${PROJECT_NAME}=${status_code}" >> $GITHUB_OUTPUT
111+
echo "response_${PROJECT_NAME}<<EOF" >> $GITHUB_OUTPUT
112+
echo "${body}" >> $GITHUB_OUTPUT
113+
echo "EOF" >> $GITHUB_OUTPUT
114+
115+
if [[ $status_code -lt 200 || $status_code -ge 300 ]]; then
116+
echo "Failed with status code: $status_code for project: $PROJECT_NAME"
117+
exit 1
118+
fi
119+
done
120+
121+
- name: Comment on PR
122+
if: github.event_name == 'pull_request'
123+
uses: actions/github-script@v7
124+
env:
125+
CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
126+
with:
127+
script: |
128+
const changedFiles = process.env.CHANGED_FILES || '';
129+
let commentBody = `### Masking Policy Update Summary\n\n`;
130+
131+
// Add changed files section
132+
commentBody += `📝 **Changed Files:**\n\n`;
133+
if (changedFiles.trim()) {
134+
commentBody += changedFiles.split(' ').map(f => `- ${f}`).join('\n');
135+
} else {
136+
commentBody += `None`;
137+
}
138+
commentBody += '\n\n';
139+
140+
// Add API calls summary
141+
commentBody += `🔄 **API Calls:**\n\n`;
142+
let apiCallsFound = false;
143+
144+
if (changedFiles.includes('column-masking.json')) {
145+
const maskingStatuses = Object.keys(${{ toJSON(steps.apply-column-masking.outputs) }} || {})
146+
.filter(key => key.startsWith('status_code_'))
147+
.map(key => ({
148+
name: key.replace('status_code_', ''),
149+
status: ${{ toJSON(steps.apply-column-masking.outputs) }}[key]
150+
}));
151+
152+
maskingStatuses.forEach(({name, status}) => {
153+
apiCallsFound = true;
154+
const success = status >= 200 && status < 300;
155+
commentBody += `- Column Masking (${name}): ${success ? '✅' : '❌'} ${status}\n`;
156+
});
157+
}
158+
159+
if (changedFiles.includes('masking-exception.json')) {
160+
const exceptionStatuses = Object.keys(${{ toJSON(steps.apply-masking-exception.outputs) }} || {})
161+
.filter(key => key.startsWith('status_code_'))
162+
.map(key => ({
163+
name: key.replace('status_code_', ''),
164+
status: ${{ toJSON(steps.apply-masking-exception.outputs) }}[key]
165+
}));
166+
167+
exceptionStatuses.forEach(({name, status}) => {
168+
apiCallsFound = true;
169+
const success = status >= 200 && status < 300;
170+
commentBody += `- Masking Exception (${name}): ${success ? '✅' : '❌'} ${status}\n`;
171+
});
172+
}
173+
174+
if (!apiCallsFound) {
175+
commentBody += `None`;
176+
}
177+
178+
await github.rest.issues.createComment({
179+
...context.repo,
180+
issue_number: context.issue.number,
181+
body: commentBody
182+
});

‎masking/databases/test-sample-instance/hr_test/column-masking.json

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"inheritFromParent": false,
3+
"type": "MASKING",
4+
"maskingPolicy": {
5+
"maskData": [
6+
{
7+
"schema": "public",
8+
"table": "salary",
9+
"column": "amount",
10+
"maskingLevel": "PARTIAL",
11+
"fullMaskingAlgorithmId": "",
12+
"partialMaskingAlgorithmId": ""
13+
}
14+
]
15+
},
16+
"enforce": true,
17+
"resourceType": "DATABASE"
18+
}

0 commit comments

Comments
 (0)