#262 ci: enforce append-only migrations server-side + harden pre-commit hook

[Anonymous]

Originally created by: Akarsh-Hegde

Why

[#250] edited the header of all 34 shipped migrations, which changed their sqlx checksums and crash-looped the daemon on every existing install (migration N was previously applied but has been modified). [#261] added a self-heal so the daemon recovers — but that's a safety net, not prevention. This PR closes the prevention gap.

A pre-commit hook already blocked modifying migrations… but it was added by [#250] itself, and pre-commit hooks are:

• opt-in — only active if the dev ran setup-hooks.sh (which sets core.hooksPath), and
• bypassable — git commit --no-verify skips them.

So nothing enforced it where it counts. That's why [#250] sailed through.

What

1. migration-guard CI job (ci.yml) — on every PR, fails if the diff modifies, renames, or deletes any src/migrations/*.sql file. Adding a new numbered migration (A) is allowed. Runs server-side, so it can't be skipped with --no-verify:

bash git diff --name-status "$base"...HEAD -- src/migrations | grep -E '^(M|D|R)'

1. Hardened pre-commit hook — the existing check only caught modifications (M); now it also catches deletes (D) and renames (R), which break checksums/ordering just as badly.

Verification

• ci.yml parses as valid YAML; the hook passes bash -n.
• Detection logic checked against sample --name-status output: M/D/R on a migration are caught (rename reports the old path), while a new migration (A) and non-migration edits are ignored.

Note

Scoped to the modification guard you asked about. A second, distinct migration footgun also surfaced today — two branches each adding a 035_* file (duplicate version → UNIQUE constraint failed: _sqlx_migrations.version, which broke [#257]'s CI after the [#258] merge). I can add a duplicate-version check to the same CI job as a follow-up if you want it.

https://claude.ai/code/session_013mv3epyceLahz9Cue1mtPj

---

Generated by Claude Code

[Anonymous]

Ticket changed by: Akarsh-Hegde

• status: open --> closed

[Anonymous]

Originally posted by: adityaharishch

🎉 This PR is included in version 1.48.2 🎉

The release is available on:

• GitHub release
• v1.48.2
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀