Warehouse schema migration rehearsal

Status

illustrative

Industry

Data warehouse

Language

Bash

Framework

curl + jq

CI

any

Fulfilment

LEASE_CERTIFIED_VERSION

Profile

warehouse-migration

About this example

All data is synthetic. DataNivra provisions approved test data into a customer-controlled target; it does not run these tests. Credentials for the target are never returned by DataNivra — your runner holds its own.

Why test data matters

Migrations must keep foreign keys intact on realistic volumes before they touch production.

What is requested

A one-hour lease of the certified, masked warehouse-migration dataset version.

Policy gates

The certified version must be provisionable; one isolated pool target per rehearsal.

What is provisioned

The certified version hydrated into a free pool target (secret reference resolved by the agent).

Expected output

AUTO_APPROVED for a caller holding dataset.provision; otherwise PENDING_HUMAN_APPROVAL.

Cleanup

trap release EXIT releases the lease; the shared certified version is never revoked.

Files

• request.yaml
• rehearse.sh

Run

1. A tenant administrator defines and a second person approves the profile (datanivra test-data define ../../profiles/warehouse-migration.yaml --submit, then datanivra policies approve).
2. datanivra test-data validate request.yaml && datanivra test-data plan request.yaml
3. Run the example with DATANIVRA_BASE_URL and a session or workload token.

# yaml-language-server: $schema=../../../../packages/contracts/schemas/v1/manifests/test-data-request.schema.json
# DataNivra test-data-request manifest (apiVersion datanivra.io/v1alpha1). Validate: datanivra test-data validate <file>
apiVersion: datanivra.io/v1alpha1
kind: TestDataRequest
metadata:
  name: migration-rehearsal
spec:
  profile: { name: warehouse-migration, version: 1 }
  ttl_seconds: 3600

#!/usr/bin/env bash
# Warehouse migration rehearsal — REST with curl + jq (no SDK needed). Needs DATANIVRA_BASE_URL and DATANIVRA_TOKEN.
# DataNivra returns metadata only; connect to the approved target with your own credentials.
set -euo pipefail
API="${DATANIVRA_BASE_URL:?}/v1/test-data/requests"
AUTH=(-H "Authorization: Bearer ${DATANIVRA_TOKEN:?}" -H "Content-Type: application/json")
BODY='{"profile":{"name":"warehouse-migration","version":1},"ttl_seconds":3600}'
created=$(curl -fsS "${AUTH[@]}" -H "Idempotency-Key: ${CI_RUN_KEY:-local-$}" -d "$BODY" "$API")
id=$(jq -r .id <<<"$created")
release() { curl -fsS "${AUTH[@]}" -d '{"reason_code":"TEST_RUN_FINISHED"}' "$API/$id/release" >/dev/null; }
trap release EXIT
for _ in $(seq 1 120); do
  state=$(curl -fsS "${AUTH[@]}" "$API/$id" | jq -r .state)
  [[ "$state" == READY ]] && break
  [[ "$state" =~ ^(RELEASED|REJECTED|CANCELLED|FAILED)$ ]] && { echo "ended: $state" >&2; exit 26; }
  sleep 5
done
[[ "$state" == READY ]] || { echo "timed out: $state" >&2; exit 27; }
./run-migrations.sh && ./verify-foreign-keys.sh   # your migration tooling, your target credentials

# yaml-language-server: $schema=../../../packages/contracts/schemas/v1/manifests/test-data-profile.schema.json
# DataNivra test-data-profile manifest (apiVersion datanivra.io/v1alpha1). Validate: datanivra test-data validate <file>
# Placeholder ids (00000000-0000-4000-8000-0000000000NN): replace with your ids.
# 01 = approved target environment, 11 = certified dataset, 21 = customer agent,
# 99 = workload identity trust (datanivra workload-identities list).
apiVersion: datanivra.io/v1alpha1
kind: TestDataProfile
metadata:
  name: warehouse-migration
  description: Certified, masked warehouse slice leased for schema-migration rehearsals
spec:
  fulfilment: LEASE_CERTIFIED_VERSION
  lease:
    dataset_id: 00000000-0000-4000-8000-000000000011
    agent_id: 00000000-0000-4000-8000-000000000021
    provider_kind: POSTGRESQL_CONTAINER
    default_ttl_seconds: 1800
    max_ttl_seconds: 7200
    target_pool:
      - vault://ci/warehouse-migration-db-1
      - vault://ci/warehouse-migration-db-2