Alembic version upgrade and Schema migration automation

[google-labs-jules]

I have modified the .github/workflows/ebs-common-stage-prod.yml file to include the check-db-changes and apply-db-changes jobs, and I have set up the basic dependencies between the jobs.

I have implemented the check-db-changes job, including the steps for checking for database changes, generating SQL scripts, verifying them with Bytebase and Gemini AI, requiring manual approval, and uploading the scripts as artifacts.

I have implemented the apply-db-changes job, which downloads the SQL artifacts, waits for manual approval, and then applies the upgrade script to the database.

I have updated the build-and-push job to make it dependent on the apply-db-changes job, ensuring it only runs if the database migration is successful or skipped.

I have created the .github/scripts directory and the check_db_changes.py and apply_db_changes.py files.

I have refactored the check-db-changes job to use an external Python script, removed the unnecessary verification steps, and corrected the artifact upload path.

I have updated the check_db_changes.py script to generate both upgrade and downgrade SQL files.

I have added the Bytebase and Gemini AI verification steps to the check-db-changes job.

I have updated the upload-artifact step to include both the upgrade and downgrade SQL scripts.

I have refactored the apply_db_changes.py script to execute the downloaded upgrade.sql artifact and then stamp the database with the latest revision.

I have corrected the downgrade script generation in check_db_changes.py to handle the case where the database is new and to generate a downgrade script to the correct revision.

I have fixed the apply-db-changes job by adding the missing dependencies, correcting the file path for the downloaded artifact, and adding the missing imports to the Python script.

I have created the verify_sql_with_gemini.py script and moved the Gemini AI verification logic into it.

I have made the Gemini AI check effective by replacing the inline script with a call to the verify_sql_with_gemini.py script, which will cause the workflow to fail if the SQL is deemed unsafe.

I have updated actions/download-artifact and actions/upload-artifact from v2 to v4.

I have fixed the apply-db-changes job by adding the missing checkout step and alembic to the list of dependencies.

I have refactored check_db_changes.py, apply_db_changes.py, and verify_sql_with_gemini.py to use paths relative to the GITHUB_WORKSPACE environment variable, removing the need for os.chdir.

I have modified verify_sql_with_gemini.py to accept file paths as arguments and updated the workflow to pass them.

I have fixed the missing transaction commit in .github/scripts/apply_db_changes.py by wrapping the database execution in a transaction.

I have removed the Bytebase verification step from the workflow, as there is no suitable CLI command for local SQL file verification. I will document this limitation in the commit message.

I have improved the Gemini AI prompt in .github/scripts/verify_sql_with_gemini.py to request a more structured, machine-readable response.

I have re-added the Bytebase verification step to the workflow and added check=True to all subprocess.run calls in the Python scripts to ensure the workflow fails on any errors.

---

PR created automatically by Jules for task 3417363081599632448 started by @SaravanakumarR2018

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

---

For security, I will only act on instructions from the user who triggered this task.

New to Jules? Learn more at jules.google/docs.

[autofix-troubleshooter]

Hi! I'm the autofix.ci troubleshooter bot.

It looks like you correctly set up a CI job that uses the autofix.ci GitHub Action, but the autofix.ci GitHub App has not been installed for this repository. This means that autofix.ci unfortunately does not have the permissions to fix this pull request. If you are the repository owner, please install the app and then restart the CI workflow! 😃