ci(migrations): add immutability guard against sqlx checksum drift #62
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/LINKS-26-migration-immutability-guard"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
sqlx records a SHA-384 checksum of each migration in _sqlx_migrations on apply and re-verifies it on every startup, so editing an already-applied migration makes every database that ran it refuse to boot ("migration N was previously applied but has been modified"). This is what broke the mokosh-server v0.4.0 deploy on nc-01 (DEV-395); nothing in this repo caught the edit.
Add scripts/check-migration-immutability.nu, which diffs origin/main...HEAD with --diff-filter=MRD over migrations/ and fails (exit 1) listing any committed migration that was modified, renamed, or deleted, telling the author to add a new migration instead. Adding a new file passes. It exits 2 (fail loud) when the diff itself cannot run, so a broken base never reads as "nothing changed".
Wire it into .forgejo/workflows/check.yml as a step and set fetch-depth: 0 on the checkout so the merge-base with origin/main is available. Document the immutability rule and the guard in docs/DATABASE.md.
#LINKS-26
sqlx records a SHA-384 checksum of each migration in _sqlx_migrations on apply and re-verifies it on every startup, so editing an already-applied migration makes every database that ran it refuse to boot ("migration N was previously applied but has been modified"). This is what broke the mokosh-server v0.4.0 deploy on nc-01 (DEV-395); nothing in this repo caught the edit. Add scripts/check-migration-immutability.nu, which diffs origin/main...HEAD with --diff-filter=MRD over migrations/ and fails (exit 1) listing any committed migration that was modified, renamed, or deleted, telling the author to add a new migration instead. Adding a new file passes. It exits 2 (fail loud) when the diff itself cannot run, so a broken base never reads as "nothing changed". Wire it into .forgejo/workflows/check.yml as a step and set fetch-depth: 0 on the checkout so the merge-base with origin/main is available. Document the immutability rule and the guard in docs/DATABASE.md. #LINKS-26