From 1614ed20c64672677d2b772835fe1a6f63d70600 Mon Sep 17 00:00:00 2001
From: Jun-te Kim <junte.kim@mealcraft.com>
Date: Thu, 22 Jan 2026 00:00:00 +0000
Subject: [PATCH] propogate

---
 .github/workflows/stripe-to-invoice.yml | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/stripe-to-invoice.yml b/.github/workflows/stripe-to-invoice.yml
index 9c4803d..90bfd1c 100644
--- a/.github/workflows/stripe-to-invoice.yml
+++ b/.github/workflows/stripe-to-invoice.yml
@@ -278,23 +278,24 @@ jobs:
           echo "Postgres never became ready"
           exit 1
 
-
-      - name: Run migrations
+      - name: Run migrations (using K8s secret)
         run: |
           set -e
-          set -a
-          source db/.env
-          set +a
 
           if [[ "$ENV" == "prod" ]]; then
-            USER="$PROD_POSTGRES_USER"
-            PASS="$PROD_POSTGRES_PASSWORD"
+            SECRET=postgres-prod
+            NAMESPACE=default
           else
-            USER="$DEV_POSTGRES_USER"
-            PASS="$DEV_POSTGRES_PASSWORD"
+            SECRET=postgres-dev
+            NAMESPACE=dev
           fi
 
-          DATABASE_URL="postgres://${USER}:${PASS}@${POSTGRES_HOST}:5432/${POSTGRES_DB}?sslmode=disable"
+          DATABASE_URL=$(kubectl get secret "$SECRET" \
+            -n "$NAMESPACE" \
+            -o jsonpath='{.data.DATABASE_URL}' | base64 -d)
+
+          echo "Running Atlas migrations against $POSTGRES_HOST"
+
           atlas migrate apply \
             --dir file://db/atlas/stripe_invoice/migrations \
             --url "$DATABASE_URL"