test: out-of-order migration (DO NOT MERGE) - #1401
Conversation
Add a GitHub Actions workflow that runs on PRs touching packages/db/prisma/**. It verifies migrations apply cleanly in sequence and reproduce schema.prisma (drift check via prisma migrate diff), and that no newly added migration predates the latest migration on main (out-of-order timestamp check). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the standalone migration workflow with a composite action (.github/actions/check-prisma-migrations) and embed it in: - pr-gate.yml's build job, so migration drift or out-of-order timestamps fail the required PR check before merge. - _build.yml's build job (amd64 only) as a release-time backstop for schema drift. The action self-contains Postgres via docker run, detects whether Prisma files changed (skipping fast on PRs that don't), verifies migrations apply in sequence and reproduce schema.prisma, and checks no new migration predates the latest on the base branch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
DO NOT MERGE. No-op migration timestamped 2020-01-01, earlier than the latest migration on main, to verify the ordering check fails. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
@brendan-kellam your pull request is missing a changelog! |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
WalkthroughA new Prisma migration SQL file is added as a no-op dummy ( ChangesDummy Out-of-Order Migration Fixture
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/check-prisma-migrations/action.yml:
- Around line 71-77: The current Prisma migration check only runs migrate deploy
via the Apply migrations step, so it misses edited, renamed, or deleted
migration history under packages/db/prisma/migrations. Update the
check-prisma-migrations workflow to explicitly fail on any non-addition in that
migrations tree, while keeping the existing timestamp validation for newly added
migration folders; use the existing migration-detection logic and the Apply
migrations step as the place to enforce the rejection.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a35e86cb-953d-4bd4-b11d-056d2e1663da
📒 Files selected for processing (4)
.github/actions/check-prisma-migrations/action.yml.github/workflows/_build.yml.github/workflows/pr-gate.ymlpackages/db/prisma/migrations/20200101000000_dummy_out_of_order/migration.sql
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/check-prisma-migrations/action.yml:
- Around line 71-77: The current Prisma migration check only runs migrate deploy
via the Apply migrations step, so it misses edited, renamed, or deleted
migration history under packages/db/prisma/migrations. Update the
check-prisma-migrations workflow to explicitly fail on any non-addition in that
migrations tree, while keeping the existing timestamp validation for newly added
migration folders; use the existing migration-detection logic and the Apply
migrations step as the place to enforce the rejection.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a35e86cb-953d-4bd4-b11d-056d2e1663da
📒 Files selected for processing (4)
.github/actions/check-prisma-migrations/action.yml.github/workflows/_build.yml.github/workflows/pr-gate.ymlpackages/db/prisma/migrations/20200101000000_dummy_out_of_order/migration.sql
🛑 Comments failed to post (1)
.github/actions/check-prisma-migrations/action.yml (1)
71-77: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Doesprisma migrate deployfail when a previously applied migration file or folder has been modified or renamed, and how does Prisma validate migration checksums/history?💡 Result:
The command
prisma migrate deploydoes not fail if a previously applied migration file has been modified or renamed; instead, it proceeds with the deployment while issuing a warning [1][2]. Prisma Migrate validates migration history using a checksum mechanism stored in the_prisma_migrationstable in your database [3][4]. Mechanism details: - Validation: Prisma calculates the SHA-256 checksum of the migration files present in yourprisma/migrationsfolder and compares them against the checksums recorded in the_prisma_migrationstable for every migration that was previously applied [3][5]. - Behavior on modification: If the content of a migration file is altered (even by reformatting or adding comments), the calculated checksum will no longer match the one in the database [2][3]. Whenprisma migrate deploydetects this discrepancy, it triggers a warning message informing you that the migration has been modified since it was applied, but the command itself does not stop or fail [1][2]. - Renaming: Renaming a migration folder or file disrupts the identity of that migration in the history, as the system relies on the file structure and names to identify which migrations have already been processed [3][6]. It is strongly recommended to maintain the integrity of your migration history. If you modify or rename applied migrations, Prisma will continue to warn you upon every execution ofmigrate deploy[6]. The official recommendation is to fix the root cause—such as restoring the file to its original state or reverting changes—rather than ignoring these warnings, as they ensure that your production database state remains synchronized with your source-controlled migration history [6].Citations:
- 1: https://www.prisma.io/docs/orm/prisma-migrate/workflows/development-and-production
- 2: prisma/prisma#11376
- 3: https://github.com/prisma/prisma-engines/blob/6be410e/migration-engine/ARCHITECTURE.md
- 4: https://www.prisma.io/docs/orm/v6/prisma-migrate/understanding-prisma-migrate/shadow-database
- 5: prisma/prisma-engines#1887
- 6: https://www.prisma.io/docs/orm/prisma-migrate/understanding-prisma-migrate/migration-histories
🏁 Script executed:
sed -n '1,180p' .github/actions/check-prisma-migrations/action.ymlRepository: sourcebot-dev/sourcebot
Length of output: 4751
Reject edits to existing Prisma migrations. This job only proves the current tree boots on a fresh database; it won’t catch edited, renamed, or deleted migration history, and Prisma only warns when a previously applied migration changes. Fail the check on any non-addition under
packages/db/prisma/migrations, and keep the timestamp check for new folders.🧰 Tools
🪛 Checkov (3.3.2)
[medium] 76-77: Basic Auth Credentials
(CKV_SECRET_4)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/actions/check-prisma-migrations/action.yml around lines 71 - 77, The current Prisma migration check only runs migrate deploy via the Apply migrations step, so it misses edited, renamed, or deleted migration history under packages/db/prisma/migrations. Update the check-prisma-migrations workflow to explicitly fail on any non-addition in that migrations tree, while keeping the existing timestamp validation for newly added migration folders; use the existing migration-detection logic and the Apply migrations step as the place to enforce the rejection.
1 participant
DO NOT MERGE — test PR.
Branched off
brendan-kellam/enforce-prisma-migration-order(so it carries the new PR Gate migration check + composite action) and adds a no-op migration timestamped20200101000000, earlier than the latest migration onmain.Expected: the PR Gate → Check Prisma migrations step fails at the ordering check with:
The drift check should pass (the migration is a no-op
SELECT 1;), so this isolates the ordering check.Delete this branch/PR once the check is verified.
Summary by CodeRabbit