gogo1414/ormguard

Fail-fast schema validation for SQLAlchemy — validate a live database, replay migrations offline, or run a multi-target config in CI.

Trust Signals

workflow.ymlSHA-pinned

uses: gogo1414/ormguard@80e40e5c576a5a87e995f4c8f220d48247112433 # v0.2.0

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
command	What to run: 'validate' (live DB, default), 'replay' (offline migration replay — no database), or 'check' (multi-target ormguard.toml).	no	validate
database-url	SQLAlchemy database URL (required for command: validate).	no	""
metadata	ORM metadata as 'package.module:attr' (required for validate and replay).	no	""
migrations	Migrations directory, e.g. 'migration/versions' (required for command: replay).	no	""
config	Path to the multi-target config file (command: check). Default: ormguard.toml.	no	ormguard.toml
format	Output format: text (default), json, sarif, or github. 'sarif' also writes ormguard.sarif (see the sarif-file output) for github/codeql-action/upload-sarif; 'github' emits inline workflow annotations.	no	text
baseline	Baseline file of accepted findings — only NEW drift fails the run (validate and replay).	no	""
args	Extra ormguard CLI flags, e.g. '--schema public --check-indexes' or '--tenant cafe24:shop_a --tenant larosee:larosee_co_kr'.	no	""
notify-webhook	Slack/Discord incoming webhook to POST the report to when drift is found (command: validate).	no	""
version	pip install target for ormguard (e.g. 'ormguard[replay]==0.2.0', or a VCS URL).	no	ormguard[replay,config]
python-version	Python version used to run ormguard.	no	3.12

name	description
sarif-file	Path to the SARIF report (only when format: sarif) — pass to github/codeql-action/upload-sarif.