skypilot-nightly 1.0.0.dev20250720__py3-none-any.whl → 1.0.0.dev20250724__py3-none-any.whl

sky/logs/aws.py

@@ -0,0 +1,276 @@
+"""AWS CloudWatch logging agent."""
+
+from typing import Any, Dict, Optional
+
+import pydantic
+
+from sky.logs.agent import FluentbitAgent
+from sky.skylet import constants
+from sky.utils import common_utils
+from sky.utils import resources_utils
+
+
+class _CloudwatchLoggingConfig(pydantic.BaseModel):
+    """Configuration for AWS CloudWatch logging agent."""
+    region: Optional[str] = None
+    credentials_file: Optional[str] = None
+    log_group_name: str = 'skypilot-logs'
+    log_stream_prefix: str = 'skypilot-'
+    auto_create_group: bool = True
+    additional_tags: Optional[Dict[str, str]] = None
+
+
+class _CloudWatchOutputConfig(pydantic.BaseModel):
+    """Auxiliary model for building CloudWatch output config in YAML.
+
+    Ref: https://docs.fluentbit.io/manual/pipeline/outputs/cloudwatch
+    """
+    name: str = 'cloudwatch_logs'
+    match: str = '*'
+    region: Optional[str] = None
+    log_group_name: Optional[str] = None
+    log_stream_prefix: Optional[str] = None
+    auto_create_group: bool = True
+    additional_tags: Optional[Dict[str, str]] = None
+
+    def to_dict(self) -> Dict[str, Any]:
+        config = self.model_dump(exclude_none=True)
+        if 'auto_create_group' in config:
+            config['auto_create_group'] = 'true' if config[
+                'auto_create_group'] else 'false'
+        return config
+
+
+class CloudwatchLoggingAgent(FluentbitAgent):
+    """AWS CloudWatch logging agent.
+
+    This agent forwards logs from SkyPilot clusters to AWS CloudWatch using
+    Fluent Bit. It supports authentication via IAM roles (preferred), AWS
+    credentials file, or environment variables.
+
+    Example configuration:
+    ```yaml
+    logs:
+      store: aws
+      aws:
+        region: us-west-2
+        log_group_name: skypilot-logs
+        log_stream_prefix: my-cluster-
+        auto_create_group: true
+    ```
+    """
+
+    def __init__(self, config: Dict[str, Any]):
+        """Initialize the CloudWatch logging agent.
+
+        Args:
+            config: The configuration for the CloudWatch logging agent.
+                   See the class docstring for the expected format.
+        """
+        self.config = _CloudwatchLoggingConfig(**config)
+        super().__init__()
+
+    def get_setup_command(self,
+                          cluster_name: resources_utils.ClusterName) -> str:
+        """Get the command to set up the CloudWatch logging agent.
+
+        Args:
+            cluster_name: The name of the cluster.
+
+        Returns:
+            The command to set up the CloudWatch logging agent.
+        """
+
+        if self.config.credentials_file:
+            credential_path = self.config.credentials_file
+
+        # Set AWS credentials and check whether credentials are valid.
+        # CloudWatch plugin supports IAM roles, credentials file, and
+        # environment variables. We prefer IAM roles when available
+        # (on EC2 instances). If credentials file is provided, we use
+        # it. Otherwise, we check if credentials are available in
+        # the environment.
+        pre_cmd = ''
+        if self.config.credentials_file:
+            pre_cmd = (
+                f'export AWS_SHARED_CREDENTIALS_FILE={credential_path}; '
+                f'if [ ! -f {credential_path} ]; then '
+                f'echo "ERROR: AWS credentials file {credential_path} '
+                f'not found. Please check if the file exists and is '
+                f'accessible." && exit 1; '
+                f'fi; '
+                f'if ! grep -q "\\[.*\\]" {credential_path} || '
+                f'! grep -q "aws_access_key_id" {credential_path}; then '
+                f'echo "ERROR: AWS credentials file {credential_path} is '
+                f'invalid. It should contain a profile section '
+                f'[profile_name] and aws_access_key_id." && exit 1; '
+                f'fi;')
+        else:
+            # Check if we're running on EC2 with an IAM role or if
+            # AWS credentials are available in the environment
+            pre_cmd = (
+                'if ! curl -s -m 1 http://169.254.169.254'
+                '/latest/meta-data/iam/security-credentials/ > /dev/null; '
+                'then '
+                # failed EC2 check, look for env vars
+                'if [ -z "$AWS_ACCESS_KEY_ID" ] || '
+                '[ -z "$AWS_SECRET_ACCESS_KEY" ]; then '
+                'echo "ERROR: AWS CloudWatch logging configuration error. '
+                'Not running on EC2 with IAM role and AWS credentials not '
+                'found in environment. Please do one of the following: '
+                '1. Run on an EC2 instance with an IAM role that has '
+                'CloudWatch permissions, 2. Set AWS_ACCESS_KEY_ID and '
+                'AWS_SECRET_ACCESS_KEY environment variables, or '
+                '3. Provide a credentials file via logs.aws.credentials_file '
+                'in SkyPilot config." && exit 1; '
+                'fi; '
+                'fi;')
+
+        # If region is specified, set it in the environment
+        if self.config.region:
+            pre_cmd += f' export AWS_REGION={self.config.region};'
+        else:
+            # If region is not specified, check if it's available in
+            # the environment or credentials file
+            pre_cmd += (
+                ' if [ -z "$AWS_REGION" ] && '
+                '[ -z "$AWS_DEFAULT_REGION" ]; then '
+                'echo "WARNING: AWS region not specified in configuration or '
+                'environment. CloudWatch logging may fail if the region '
+                'cannot be determined. Consider setting logs.aws.region in '
+                'SkyPilot config."; '
+                'fi; ')
+
+        # Add a test command to verify AWS credentials work with CloudWatch
+        pre_cmd += (
+            ' echo "Verifying AWS CloudWatch access..."; '
+            'if command -v aws > /dev/null; then '
+            'aws cloudwatch list-metrics --namespace AWS/Logs --max-items 1 '
+            '> /dev/null 2>&1 || '
+            '{ echo "ERROR: Failed to access AWS CloudWatch. Please check '
+            'your credentials and permissions."; '
+            'echo "The IAM role or user must have cloudwatch:ListMetrics '
+            'and logs:* permissions."; '
+            'exit 1; }; '
+            'else echo "AWS CLI not installed, skipping CloudWatch access '
+            'verification."; '
+            'fi; ')
+
+        return pre_cmd + ' ' + super().get_setup_command(cluster_name)
+
+    def fluentbit_config(self,
+                         cluster_name: resources_utils.ClusterName) -> str:
+        """Get the Fluent Bit configuration for CloudWatch.
+
+        This overrides the base method to add a fallback output for local file
+        logging in case CloudWatch logging fails.
+
+        Args:
+            cluster_name: The name of the cluster.
+
+        Returns:
+            The Fluent Bit configuration as a YAML string.
+        """
+        display_name = cluster_name.display_name
+        unique_name = cluster_name.name_on_cloud
+        # Build tags for the log stream
+        tags = {
+            'skypilot.cluster_name': display_name,
+            'skypilot.cluster_id': unique_name,
+        }
+
+        # Add additional tags if provided
+        if self.config.additional_tags:
+            tags.update(self.config.additional_tags)
+
+        log_processors = []
+        for key, value in tags.items():
+            log_processors.append({
+                'name': 'content_modifier',
+                'action': 'upsert',
+                'key': key,
+                'value': value
+            })
+
+        cfg_dict = {
+            'pipeline': {
+                'inputs': [{
+                    'name': 'tail',
+                    'path': f'{constants.SKY_LOGS_DIRECTORY}/*/*.log',
+                    'path_key': 'log_path',
+                    # Shorten the refresh interval from 60s to 1s since every
+                    # job creates a new log file and we must be responsive
+                    # for this: the VM might be autodown within a minute
+                    # right after the job completion.
+                    'refresh_interval': 1,
+                    'processors': {
+                        'logs': log_processors,
+                    }
+                }],
+                'outputs': [self.fluentbit_output_config(cluster_name)],
+            }
+        }
+
+        # Add fallback outputs for graceful failure handling
+        cfg_dict = self.add_fallback_outputs(cfg_dict)
+
+        return common_utils.dump_yaml_str(cfg_dict)
+
+    def add_fallback_outputs(self, cfg_dict: Dict[str, Any]) -> Dict[str, Any]:
+        """Add fallback outputs to the Fluent Bit configuration.
+
+        This adds a local file output as a fallback in case
+        CloudWatch logging fails.
+
+        Args:
+            cfg_dict: The Fluent Bit configuration dictionary.
+
+        Returns:
+            The updated configuration dictionary.
+        """
+        # Add a local file output as a fallback
+        fallback_output = {
+            'name': 'file',
+            'match': '*',
+            'path': '/tmp/skypilot_logs_fallback.log',
+            'format': 'out_file',
+        }
+
+        # Add the fallback output to the configuration
+        cfg_dict['pipeline']['outputs'].append(fallback_output)
+
+        return cfg_dict
+
+    def fluentbit_output_config(
+            self, cluster_name: resources_utils.ClusterName) -> Dict[str, Any]:
+        """Get the Fluent Bit output configuration for CloudWatch.
+
+        Args:
+            cluster_name: The name of the cluster.
+
+        Returns:
+            The Fluent Bit output configuration for CloudWatch.
+        """
+        unique_name = cluster_name.name_on_cloud
+
+        # Format the log stream name to include cluster information
+        # This helps with identifying logs in CloudWatch
+        log_stream_prefix = f'{self.config.log_stream_prefix}{unique_name}-'
+
+        # Create the CloudWatch output configuration with error handling options
+        return _CloudWatchOutputConfig(
+            region=self.config.region,
+            log_group_name=self.config.log_group_name,
+            log_stream_prefix=log_stream_prefix,
+            auto_create_group=self.config.auto_create_group,
+        ).to_dict()
+
+    def get_credential_file_mounts(self) -> Dict[str, str]:
+        """Get the credential file mounts for the CloudWatch logging agent.
+
+        Returns:
+            A dictionary mapping local credential file paths to remote paths.
+        """
+        if self.config.credentials_file:
+            return {self.config.credentials_file: self.config.credentials_file}
+        return {}

sky/provision/nebius/utils.py

@@ -41,10 +41,7 @@ def get_project_by_region(region: str) -> str:
 
     #  Check is there project if in config
     project_id = skypilot_config.get_effective_region_config(
-        cloud='nebius',
-        region=None,
-        keys=(region, 'project_id'),
-        default_value=None)
+        cloud='nebius', region=region, keys=('project_id',), default_value=None)
     if project_id is not None:
         return project_id
     for project in projects.items:
@@ -189,8 +186,8 @@ def launch(cluster_name_on_cloud: str,
         if preset == '8gpu-128vcpu-1600gb':
             fabric = skypilot_config.get_effective_region_config(
                 cloud='nebius',
-                region=None,
-                keys=(region, 'fabric'),
+                region=region,
+                keys=('fabric',),
                 default_value=None)
 
             # Auto-select fabric if network_tier=best and no fabric configured

sky/server/common.py

@@ -132,6 +132,8 @@ def get_api_cookie_jar() -> requests.cookies.RequestsCookieJar:
 def set_api_cookie_jar(cookie_jar: CookieJar,
                        create_if_not_exists: bool = True) -> None:
     """Updates the file cookie jar with the given cookie jar."""
+    if len(cookie_jar) == 0:
+        return
     cookie_path = get_api_cookie_jar_path()
     if not cookie_path.exists() and not create_if_not_exists:
         # if the file doesn't exist and we don't want to create it, do nothing
@@ -252,8 +254,9 @@ def get_dashboard_url(server_url: str,
 
 
 @annotations.lru_cache(scope='global')
-def is_api_server_local():
-    return get_server_url() in AVAILABLE_LOCAL_API_SERVER_URLS
+def is_api_server_local(endpoint: Optional[str] = None):
+    server_url = endpoint if endpoint is not None else get_server_url()
+    return server_url in AVAILABLE_LOCAL_API_SERVER_URLS
 
 
 def _handle_non_200_server_status(
@@ -350,7 +353,9 @@ def get_api_server_status(endpoint: Optional[str] = None) -> ApiServerInfo:
                                      error=version_info.error)
 
             cookies = get_cookies_from_response(response)
-            set_api_cookie_jar(cookies, create_if_not_exists=False)
+            # Save or refresh the cookie jar in case of session affinity and
+            # OAuth.
+            set_api_cookie_jar(cookies, create_if_not_exists=True)
             return server_info
         except (json.JSONDecodeError, AttributeError) as e:
             # Try to check if we got redirected to a login page.
@@ -566,7 +571,7 @@ def check_server_healthy(
     api_server_status = api_server_info.status
     if api_server_status == ApiServerStatus.VERSION_MISMATCH:
         msg = api_server_info.error
-        if is_api_server_local():
+        if is_api_server_local(endpoint):
             # For local server, just hint user to restart the server to get
             # a consistent version.
             msg = _LOCAL_API_SERVER_RESTART_HINT

sky/server/requests/payloads.py

@@ -203,17 +203,33 @@ class DagRequestBody(RequestBody):
         return kwargs
 
 
-class ValidateBody(DagRequestBody):
+class DagRequestBodyWithRequestOptions(DagRequestBody):
+    """Request body base class for endpoints with a dag and request options."""
+    request_options: Optional[admin_policy.RequestOptions]
+
+    def get_request_options(self) -> Optional[admin_policy.RequestOptions]:
+        """Get the request options."""
+        if self.request_options is None:
+            return None
+        if isinstance(self.request_options, dict):
+            return admin_policy.RequestOptions(**self.request_options)
+        return self.request_options
+
+    def to_kwargs(self) -> Dict[str, Any]:
+        kwargs = super().to_kwargs()
+        kwargs['request_options'] = self.get_request_options()
+        return kwargs
+
+
+class ValidateBody(DagRequestBodyWithRequestOptions):
     """The request body for the validate endpoint."""
     dag: str
-    request_options: Optional[admin_policy.RequestOptions]
 
 
-class OptimizeBody(DagRequestBody):
+class OptimizeBody(DagRequestBodyWithRequestOptions):
     """The request body for the optimize endpoint."""
     dag: str
     minimize: common_lib.OptimizeTarget = common_lib.OptimizeTarget.COST
-    request_options: Optional[admin_policy.RequestOptions]
 
 
 class LaunchBody(RequestBody):

sky/server/rest.py

@@ -89,6 +89,12 @@ def retry_transient_errors(max_retries: int = 3,
                 for retry_cnt in range(max_retries):
                     try:
                         return func(*args, **kwargs)
+                    # Occurs when the server proactively interrupts the request
+                    # during rolling update, we can retry immediately on the
+                    # new replica.
+                    except exceptions.RequestInterruptedError:
+                        logger.debug('Request interrupted. Retry immediately.')
+                        continue
                     except Exception as e:  # pylint: disable=broad-except
                         if retry_cnt >= max_retries - 1:
                             # Retries exhausted.

sky/server/server.py

@@ -827,7 +827,8 @@ async def validate(validate_body: payloads.ValidateBody) -> None:
         # added RTTs. For now, we stick to doing the validation inline in the
         # server thread.
         with admin_policy_utils.apply_and_use_config_in_current_request(
-                dag, request_options=validate_body.request_options) as dag:
+                dag,
+                request_options=validate_body.get_request_options()) as dag:
             # Skip validating workdir and file_mounts, as those need to be
             # validated after the files are uploaded to the SkyPilot API server
             # with `upload_mounts_to_api_server`.

sky/setup_files/MANIFEST.in

@@ -18,5 +18,5 @@ include sky/server/html/*
 recursive-include sky/dashboard/out *
 include sky/users/*.conf
 include sky/utils/*.sh
-include alembic.ini
+include sky/setup_files/alembic.ini
 recursive-include sky/schemas/db *

sky/setup_files/alembic.ini

@@ -94,10 +94,6 @@ version_table = alembic_version_state_db
 version_locations = %(here)s/../schemas/db/spot_jobs
 version_table = alembic_version_spot_jobs_db
 
-[sky_config_db]
-version_locations = %(here)s/../schemas/db/skypilot_config
-version_table = alembic_version_sky_config_db
-
 [post_write_hooks]
 # post_write_hooks defines scripts or Python functions that are run
 # on newly generated revision scripts.  See the documentation for further

sky/skylet/constants.py

@@ -1,4 +1,5 @@
 """Constants for SkyPilot."""
+import os
 from typing import List, Tuple
 
 from packaging import version
@@ -491,3 +492,6 @@ DEFAULT_PRIORITY = 0
 
 GRACE_PERIOD_SECONDS_ENV_VAR = SKYPILOT_ENV_VAR_PREFIX + 'GRACE_PERIOD_SECONDS'
 COST_REPORT_DEFAULT_DAYS = 30
+
+# The directory for file locks.
+SKY_LOCKS_DIR = os.path.expanduser('~/.sky/locks')

sky/skypilot_config.py

@@ -58,10 +58,8 @@ import threading
 import typing
 from typing import Any, Dict, Iterator, List, Optional, Tuple, Union
 
-from alembic import command as alembic_command
 import filelock
 import sqlalchemy
-from sqlalchemy import exc as sqlalchemy_exc
 from sqlalchemy import orm
 from sqlalchemy.dialects import postgresql
 from sqlalchemy.dialects import sqlite
@@ -78,7 +76,6 @@ from sky.utils import context
 from sky.utils import schemas
 from sky.utils import ux_utils
 from sky.utils.db import db_utils
-from sky.utils.db import migration_utils
 from sky.utils.kubernetes import config_map_utils
 
 if typing.TYPE_CHECKING:
@@ -574,17 +571,11 @@ def _reload_config_as_server() -> None:
             'if db config is specified, no other config is allowed')
 
     if db_url:
-        with migration_utils.db_lock(migration_utils.SKYPILOT_CONFIG_DB_NAME):
+        with _DB_USE_LOCK:
             sqlalchemy_engine = sqlalchemy.create_engine(db_url,
                                                          poolclass=NullPool)
-
-            # Get alembic config for sky config db and run migrations
-            alembic_config = migration_utils.get_alembic_config(
-                sqlalchemy_engine, migration_utils.SKYPILOT_CONFIG_DB_NAME)
-            # pylint: disable=line-too-long
-            alembic_config.config_ini_section = migration_utils.SKYPILOT_CONFIG_DB_NAME
-            alembic_command.upgrade(alembic_config,
-                                    migration_utils.SKYPILOT_CONFIG_VERSION)
+            db_utils.add_tables_to_db_sqlalchemy(Base.metadata,
+                                                 sqlalchemy_engine)
 
             def _get_config_yaml_from_db(
                     key: str) -> Optional[config_utils.Config]:
@@ -872,25 +863,8 @@ def update_api_server_config_no_lock(config: config_utils.Config) -> None:
             with _DB_USE_LOCK:
                 sqlalchemy_engine = sqlalchemy.create_engine(existing_db_url,
                                                              poolclass=NullPool)
-
-                # Get alembic config for sky config db and run migrations
-                alembic_config = migration_utils.get_alembic_config(
-                    sqlalchemy_engine, 'sky_config_db')
-                alembic_config.config_ini_section = 'sky_config_db'
-                try:
-                    alembic_command.upgrade(alembic_config, '001')
-                except (sqlalchemy_exc.IntegrityError,
-                        sqlalchemy_exc.OperationalError) as e:
-                    # If the version already exists (due to concurrent
-                    # initialization), we can safely ignore this error
-                    if ('UNIQUE constraint failed: '
-                            'alembic_version_sky_config_db.version_num'
-                            in str(e) or
-                            'table alembic_version_sky_config_db already exists'
-                            in str(e)):
-                        pass
-                    else:
-                        raise
+                db_utils.add_tables_to_db_sqlalchemy(Base.metadata,
+                                                     sqlalchemy_engine)
 
                 def _set_config_yaml_to_db(key: str,
                                            config: config_utils.Config):

sky/utils/common_utils.py

@@ -562,8 +562,9 @@ def read_yaml_all(path: str) -> List[Dict[str, Any]]:
         return read_yaml_all_str(f.read())
 
 
-def dump_yaml(path: str, config: Union[List[Dict[str, Any]],
-                                       Dict[str, Any]]) -> None:
+def dump_yaml(path: str,
+              config: Union[List[Dict[str, Any]], Dict[str, Any]],
+              blank: bool = False) -> None:
     """Dumps a YAML file.
 
     Args:
@@ -571,7 +572,11 @@ def dump_yaml(path: str, config: Union[List[Dict[str, Any]],
         config: the configuration to dump.
     """
     with open(path, 'w', encoding='utf-8') as f:
-        f.write(dump_yaml_str(config))
+        contents = dump_yaml_str(config)
+        if blank and isinstance(config, dict) and len(config) == 0:
+            # when dumping to yaml, an empty dict will go in as {}.
+            contents = ''
+        f.write(contents)
 
 
 def dump_yaml_str(config: Union[List[Dict[str, Any]], Dict[str, Any]]) -> str:

sky/utils/config_utils.py

@@ -6,6 +6,8 @@ from sky import sky_logging
 
 logger = sky_logging.init_logger(__name__)
 
+_REGION_CONFIG_CLOUDS = ['nebius', 'oci']
+
 
 class Config(Dict[str, Any]):
     """SkyPilot config that supports setting/getting values with nested keys."""
@@ -248,6 +250,8 @@ def get_cloud_config_value_from_dict(
     region_key = None
     if cloud == 'kubernetes':
         region_key = 'context_configs'
+    elif cloud in _REGION_CONFIG_CLOUDS:
+        region_key = 'region_configs'
 
     per_context_config = None
     if region is not None and region_key is not None:
@@ -255,6 +259,19 @@ def get_cloud_config_value_from_dict(
             keys=(cloud, region_key, region) + keys,
             default_value=None,
             override_configs=override_configs)
+        if not per_context_config and cloud in _REGION_CONFIG_CLOUDS:
+            # TODO (kyuds): Backward compatibility, remove after 0.11.0.
+            per_context_config = input_config.get_nested(
+                keys=(cloud, region) + keys,
+                default_value=None,
+                override_configs=override_configs)
+            if per_context_config is not None:
+                logger.info(
+                    f'{cloud} configuration is using the legacy format. \n'
+                    'This format will be deprecated after 0.11.0, refer to '
+                    '`https://docs.skypilot.co/en/latest/reference/config.html` '  # pylint: disable=line-too-long
+                    'for the new format. Please use `region_configs` to specify region specific configuration.'
+                )
     # if no override found for specified region
     general_config = input_config.get_nested(keys=(cloud,) + keys,
                                              default_value=default_value,

sky/utils/db/migration_utils.py

@@ -1,9 +1,12 @@
 """Constants for the database schemas."""
 
 import contextlib
+import logging
 import os
 
+from alembic import command as alembic_command
 from alembic.config import Config
+from alembic.runtime import migration
 import filelock
 import sqlalchemy
 
@@ -13,10 +16,6 @@ GLOBAL_USER_STATE_DB_NAME = 'state_db'
 GLOBAL_USER_STATE_VERSION = '001'
 GLOBAL_USER_STATE_LOCK_PATH = '~/.sky/locks/.state_db.lock'
 
-SKYPILOT_CONFIG_DB_NAME = 'skypilot_config_db'
-SKYPILOT_CONFIG_VERSION = '001'
-SKYPILOT_CONFIG_LOCK_PATH = '~/.sky/locks/.skypilot_config_db.lock'
-
 SPOT_JOBS_DB_NAME = 'spot_jobs_db'
 SPOT_JOBS_VERSION = '001'
 SPOT_JOBS_LOCK_PATH = '~/.sky/locks/.spot_jobs_db.lock'
@@ -51,3 +50,44 @@ def get_alembic_config(engine: sqlalchemy.engine.Engine, section: str):
     alembic_cfg.set_section_option(section, 'sqlalchemy.url', url)
 
     return alembic_cfg
+
+
+def safe_alembic_upgrade(engine: sqlalchemy.engine.Engine,
+                         alembic_config: Config, target_revision: str):
+    """Only upgrade if current version is older than target.
+
+    This handles the case where a database was created with a newer version of
+    the code and we're now running older code. Since our migrations are purely
+    additive, it's safe to run a newer database with older code.
+
+    Args:
+        engine: SQLAlchemy engine for the database
+        alembic_config: Alembic configuration object
+        target_revision: Target revision to upgrade to (e.g., '001')
+    """
+    # set alembic logger to warning level
+    alembic_logger = logging.getLogger('alembic')
+    alembic_logger.setLevel(logging.WARNING)
+
+    current_rev = None
+
+    # Get the current revision from the database
+    version_table = alembic_config.get_section_option(
+        alembic_config.config_ini_section, 'version_table', 'alembic_version')
+
+    with engine.connect() as connection:
+        context = migration.MigrationContext.configure(
+            connection, opts={'version_table': version_table})
+        current_rev = context.get_current_revision()
+
+    if current_rev is None:
+        alembic_command.upgrade(alembic_config, target_revision)
+        return
+
+    # Compare revisions - assuming they are numeric strings like '001', '002'
+    current_rev_num = int(current_rev)
+    target_rev_num = int(target_revision)
+
+    # only upgrade if current revision is older than target revision
+    if current_rev_num < target_rev_num:
+        alembic_command.upgrade(alembic_config, target_revision)