name: Check migration collisions

# Hard gate (#2341): fails a PR that adds a migration prefix already
# claimed by the base branch or another open PR. Caught manually 2026-04-30
# during PR #2276 rebase: 044_runtime_image_pins collided with
# 044_platform_inbound_secret from RFC #2312. This workflow makes that
# check automatic.
#
# Trigger model: pull_request only — there's no value running this on
# pushes to staging or main (those are post-merge; the gate must fire
# pre-merge to be useful). Path filter scopes to PRs that actually touch
# migrations.

on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - 'workspace-server/migrations/**'
      - 'scripts/ops/check_migration_collisions.py'
      - '.github/workflows/check-migration-collisions.yml'

permissions:
  contents: read
  # gh pr list/diff need read access to other PRs
  pull-requests: read

jobs:
  check:
    name: Migration version collision check
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # Need history to diff against base ref
          fetch-depth: 0

      - name: Detect collisions
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          BASE_REF: origin/${{ github.event.pull_request.base.ref }}
          HEAD_REF: ${{ github.event.pull_request.head.sha }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          # gh CLI uses GH_TOKEN from env
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Ensure the named base ref exists locally. checkout@v4 with
          # fetch-depth=0 pulls full history, but the explicit fetch is
          # cheap insurance against form-of-ref differences across runs.
          #
          # IMPORTANT: do NOT pass --depth=1 here. The script below uses
          # `git diff origin/<base>...<head>` (three-dot, merge-base form),
          # which fails with "fatal: no merge base" if the base ref is
          # shallow. The auto-promote staging→main PR (#2361) was blocked
          # by exactly this for ~5h on 2026-04-30 — the depth=1 fetch
          # overwrote checkout@v4's full-history clone with a shallow tip.
          git fetch origin "${{ github.event.pull_request.base.ref }}" || true
          python3 scripts/ops/check_migration_collisions.py
