[Makisuo]

Why

The prd deploy (deploy-prd-instance.yml) and the quarterly restore drill (backup-restore-test.yml) each read a long-lived PlanetScale service token from Infisical. The deploy token can change prd schema. PlanetScale now trades a GitHub Actions OIDC token for a short-lived service token, the same way we already authenticate to AWS and Infisical.

What changes

• Both jobs run planetscale/auth-action (pinned to v1.0.0's SHA) after Infisical loads. They pass the minted token only to the step that needs it:
  • deploy: PLANETSCALE_API_TOKEN_ID / PLANETSCALE_API_TOKEN for alchemy
  • drill: PLANETSCALE_SERVICE_TOKEN_ID / PLANETSCALE_SERVICE_TOKEN for pscale
• Each GitHub environment gets its own trust, conditioned on that environment, so a maintenance job can't mint a deploy token.
• The trust ID is a GitHub environment variable, PLANETSCALE_OIDC_TRUST_ID. The org slug stays in Infisical (PLANETSCALE_ORGANIZATION / PLANETSCALE_ORG) because it's masked there and these run logs are public.
• docs/persistence.md and docs/backup-and-recovery.md describe the trusts and include the pscale oidc-trust create commands. This also drops the stale claim that the preview-orphan sweep uses the drill's token: previews moved to Neon and the sweep no longer touches PlanetScale.

Rollout (needs a PlanetScale org admin; do 1 and 2 before merging)

Merging triggers a prd deploy. Without the trust variable, auth-action fails and the deploy stops before alchemy runs.

1. Create three trusts with --max-ttl 2700, which is the 45-minute job timeout. Use pscale 0.351 or newer, or the dashboard under Settings > OpenID Connect.
   • production and production-eu: copy the accesses of the current deploy token (pscale service-token show-access <id>) on each instance's database.
   • maintenance: the drill's seven accesses on maple, listed in docs/backup-and-recovery.md.
   • Run pscale oidc-trust providers show github_actions first to see which conditions the provider requires.
2. Set PLANETSCALE_OIDC_TRUST_ID on the GitHub environments production, production-eu and maintenance.
3. Merge, then watch the prd deploy (us + eu) and run gh workflow run backup-restore-test.yml.
4. Once both are green, delete PLANETSCALE_API_TOKEN_ID / PLANETSCALE_API_TOKEN from Infisical prod and prod-eu, and PLANETSCALE_SERVICE_TOKEN_ID / PLANETSCALE_SERVICE_TOKEN from dev. Then revoke those service tokens in PlanetScale.

Verification

• actionlint and oxfmt --check pass on the changed files.
• I read the action's source at the pinned SHA. It calls core.setSecret on the minted token, and its outputs match the names alchemy (AuthProvider.ts env resolution) and pscale read.
• Not exercised end to end: OIDC tokens only exist inside the trusted environments, so the first real run is the post-merge deploy and the dispatched drill (step 3).

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn