digitalservicebund/Generate tbls ER Report (PostgreSQL)
Checks out Flyway/SQL migration files from a configurable source repo, applies them against a throwaway PostgreSQL database running in an isolated Docker network (no outbound internet), documents the resulting schema with tbls (Markdown + Mermaid ERD), and uploads the output to an S3 bucket via digitalservicebund/add-ris-report.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 8, 2026
- License
- MIT
Pinned Snippet
uses: digitalservicebund/generate-tbls-er-report@b5c32596ab4529e5b3ef84a90de83ddf5633f791 # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| source_repo | Source repository containing migration files (org/repo) | yes | — |
| source_ref | Git ref in source repo to check out (branch / tag / SHA — prefer a SHA) | yes | — |
| database_name | Name of the database (used as title in generated docs) | yes | — |
| database_desc | Description of the database (shown in generated docs) | yes | — |
| migrations_path | Path to the Flyway migration folder inside the source repo | yes | — |
| destination_path | Destination path in the S3 bucket where artifacts are uploaded | yes | — |
| BUCKET_ACCESS_KEY_ID | S3 bucket access key ID. Required when skip_publish is false. | no | "" |
| BUCKET_SECRET_ACCESS_KEY | S3 bucket secret access key. Required when skip_publish is false. | no | "" |
| skip_publish | Set to 'true' to skip uploading artifacts to S3 (useful for testing). | no | false |
| flyway_version | flyway/flyway Docker image tag | no | 10 |
| postgres_version | postgres Docker image tag | no | 14 |
| postgres_extensions | Comma-separated list of PostgreSQL extensions to enable before running migrations (e.g. "uuid-ossp,pg_trgm"). Each is created with CREATE EXTENSION IF NOT EXISTS inside the docdb database. | no | "" |
| tbls_version | k1low/tbls Docker image tag | no | v1.94.5 |
| tbls_config | tbls YAML config string. dsn, docPath, name, and desc are always injected automatically and will override any values provided here. | no | format: adjust: true er: format: mermaid |
| local_artifact_path | Directory (relative to the source repo root) where tbls writes its output | no | _tbls_generated |
| GH_TOKEN | GitHub token for checking out private source repos. Defaults to GITHUB_TOKEN. | no | "" |
| slack_channel_id | Slack channel ID for failure notifications. Requires SLACK_BOT_TOKEN. | no | "" |
| SLACK_BOT_TOKEN | Slack bot token used for failure notifications. | no | "" |
Outputs
no outputs