Keep an Audit History with a Trigger
Create a trigger that writes the old and new values to an audit table on every update so changes are traceable without app code.
Task
Apply CREATE TRIGGER audit_update AFTER UPDATE ON orders FOR EACH ROW EXECUTE FUNCTION audit_fn(); so the schema change is safe, reversible, and does not lock the table during peak traffic.
When to use this
A migration deploys CREATE TRIGGER audit_update AFTER UPDATE ON orders FOR EACH ROW EXECUTE FUNCTION audit_fn(); during peak hours, takes a 40-second lock, and causes a connection pool exhaustion.
Prerequisites
- A database with migration tooling configured
- A staging environment mirroring production schema
Steps
1. Configure CREATE TRIGGER audit_update AFTER UPDATE ON orders FOR EACH ROW EXECUTE FUNCTION audit_fn(); in the project configuration file with the recommended defaults.
CREATE TRIGGER audit_update AFTER UPDATE ON orders FOR EACH ROW EXECUTE FUNCTION audit_fn();
Expected output: The configuration is accepted and CREATE TRIGGER audit_update AFTER UPDATE ON orders FOR EACH ROW EXECUTE FUNCTION audit_fn(); runs without errors on the first invocation.
2. Run the check locally to verify CREATE TRIGGER audit_update AFTER UPDATE ON orders FOR EACH ROW EXECUTE FUNCTION audit_fn(); produces the expected result before pushing.
pnpm test
Expected output: Local run matches CI behavior; no surprises after push.
3. Add the gate to the CI pipeline so CREATE TRIGGER audit_update AFTER UPDATE ON orders FOR EACH ROW EXECUTE FUNCTION audit_fn(); blocks merge on failure.
- name: Run add audit trigger history
run: pnpm test
Expected output: Pull requests with failing CREATE TRIGGER audit_update AFTER UPDATE ON orders FOR EACH ROW EXECUTE FUNCTION audit_fn(); are blocked from merging.
Troubleshooting
Problem
The check passes locally but fails in CI
Solution
Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.
Problem
Configuration is rejected with a schema error
Solution
Check the tool version matches the config schema; older versions may not support newer fields.
Limitations
- The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
- Configuration drift is possible if someone edits settings outside version control.
Make migrations safe
Start by measuring the problem. Create a trigger that writes the old and new values to an audit table on every update so changes are traceable without app code. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run CREATE TRIGGER audit_update AFTER UPDATE ON orders FOR EACH ROW EXECUTE FUNCTION audit_fn(); against the current codebase and inspect the output before wiring it into CI.
CREATE TRIGGER audit_update AFTER UPDATE ON orders FOR EACH ROW EXECUTE FUNCTION audit_fn();Verify and roll back
Once the gate is in place, make failures actionable. A failing CREATE TRIGGER audit_update AFTER UPDATE ON orders FOR EACH ROW EXECUTE FUNCTION audit_fn(); should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.