3598eb41d1
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
59 lines
2.3 KiB
YAML
59 lines
2.3 KiB
YAML
name: Check migration collisions
|
|
|
|
# Hard gate (#2341): fails a PR that adds a migration prefix already
|
|
# claimed by the base branch or another open PR. Caught manually 2026-04-30
|
|
# during PR #2276 rebase: 044_runtime_image_pins collided with
|
|
# 044_platform_inbound_secret from RFC #2312. This workflow makes that
|
|
# check automatic.
|
|
#
|
|
# Trigger model: pull_request only — there's no value running this on
|
|
# pushes to staging or main (those are post-merge; the gate must fire
|
|
# pre-merge to be useful). Path filter scopes to PRs that actually touch
|
|
# migrations.
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
paths:
|
|
- 'workspace-server/migrations/**'
|
|
- 'scripts/ops/check_migration_collisions.py'
|
|
- '.github/workflows/check-migration-collisions.yml'
|
|
|
|
permissions:
|
|
contents: read
|
|
# gh pr list/diff need read access to other PRs
|
|
pull-requests: read
|
|
|
|
jobs:
|
|
check:
|
|
name: Migration version collision check
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
# Need history to diff against base ref
|
|
fetch-depth: 0
|
|
|
|
- name: Detect collisions
|
|
env:
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
BASE_REF: origin/${{ github.event.pull_request.base.ref }}
|
|
HEAD_REF: ${{ github.event.pull_request.head.sha }}
|
|
GITHUB_REPOSITORY: ${{ github.repository }}
|
|
# gh CLI uses GH_TOKEN from env
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
# Ensure the named base ref exists locally. checkout@v4 with
|
|
# fetch-depth=0 pulls full history, but the explicit fetch is
|
|
# cheap insurance against form-of-ref differences across runs.
|
|
#
|
|
# IMPORTANT: do NOT pass --depth=1 here. The script below uses
|
|
# `git diff origin/<base>...<head>` (three-dot, merge-base form),
|
|
# which fails with "fatal: no merge base" if the base ref is
|
|
# shallow. The auto-promote staging→main PR (#2361) was blocked
|
|
# by exactly this for ~5h on 2026-04-30 — the depth=1 fetch
|
|
# overwrote checkout@v4's full-history clone with a shallow tip.
|
|
git fetch origin "${{ github.event.pull_request.base.ref }}" || true
|
|
python3 scripts/ops/check_migration_collisions.py
|