From 7b4617db703199c0c6ee91b05a1014c3497827de Mon Sep 17 00:00:00 2001 From: agent_coder Date: Sun, 5 Jul 2026 02:27:16 +0300 Subject: [PATCH] fix(#363 review F1): make the migration-order gate fail CLOSED (not open) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The CI gate — whose whole job is to BLOCK a back-dated migration — could pass open in exactly the scenario it guards (a long branch vs a moving base, i.e. #361): - Dropped the redundant `git fetch --depth=1`: the checkout already did fetch-depth:0 (full history), and the shallow graft truncated the BASE history, so `merge-base` (thus the three-dot `origin/base...HEAD` diff) failed when the base had moved ahead of the PR merge commit. - Removed `|| true` on the diff: it swallowed that failure → `added` empty → loop skipped → bad=0 → gate PASS. Now `set -e` aborts the job (fail CLOSED) on any diff error — a gate must never pass on error. Verified: yaml parses (jobs migration-order, test); a broken-ref diff with set -e and no `|| true` aborts before bad=0 (fail-closed) instead of passing. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/test.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 5eb5c9f4..a0943391 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -34,9 +34,16 @@ jobs: run: | set -euo pipefail MIG_DIR="apps/server/src/database/migrations" - git fetch --no-tags --depth=1 origin "$TARGET_BRANCH" + # checkout above already did fetch-depth:0 (full history). Fetch the base + # WITHOUT --depth (a shallow graft would truncate the base history and + # break the merge-base when the base has moved ahead of the PR merge — + # exactly the long-branch-vs-moving-base case this gate guards, #361). + git fetch --no-tags origin "$TARGET_BRANCH" newest_on_target=$(git ls-tree -r --name-only "origin/${TARGET_BRANCH}" "$MIG_DIR" | sort | tail -1) - added=$(git diff --diff-filter=A --name-only "origin/${TARGET_BRANCH}...HEAD" -- "$MIG_DIR" || true) + # NO `|| true`: a diff failure (e.g. an unresolved merge-base) must fail + # the job CLOSED — a gate whose job is to BLOCK must never pass on error. + # `set -e` above already aborts on a non-zero diff exit. + added=$(git diff --diff-filter=A --name-only "origin/${TARGET_BRANCH}...HEAD" -- "$MIG_DIR") bad=0 for f in $added; do if [[ "$f" < "$newest_on_target" || "$f" == "$newest_on_target" ]]; then