ci(db): automated database migration verification by michealross · Pull Request #141 · ASTROIDX556/astroid-api

michealross · 2026-08-30T17:35:06Z

Closes #81

Summary

Adds an automated script and CI job that verify the Prisma database migrations against a fresh PostgreSQL database, so broken or ungenerated migrations fail the pipeline before they reach review.

What changed

scripts/verify-migrations.sh (npm run db:verify) performs, in order:
1. prisma generate — ensures the generated client is current.
2. prisma migrate deploy — applies every pending migration to DATABASE_URL (fails if any migration SQL errors).
3. prisma migrate status — confirms the database is fully migrated.
4. Drift check (when SHADOW_DATABASE_URL is set): rebuilds the schema purely from the committed migrations in an ephemeral shadow database via prisma migrate diff, and fails if the result differs from prisma/schema.prisma. This catches schema edits that were never captured in a migration.
.github/workflows/ci.yml — new migrations job that:
- boots a postgres:16-alpine service container,
- creates a second empty astroid_shadow database,
- sets DATABASE_URL / SHADOW_DATABASE_URL,
- runs npm run db:verify.

Locally

export DATABASE_URL=postgresql://astroid:astroid@localhost:5432/astroid?schema=public
export SHADOW_DATABASE_URL=postgresql://astroid:astroid@localhost:5432/astroid_shadow?schema=public
npm run db:verify

SHADOW_DATABASE_URL is optional — without it the drift check is skipped and only apply + status are verified.

Validation

bash -n scripts/verify-migrations.sh — script syntax valid.
ci.yml parses cleanly (build, test, lint, typecheck, + migrations jobs).
package.json JSON valid; no dependency changes (existing prisma devDependency only).

Add a migrations job that runs against a fresh PostgreSQL service in CI: it generates the Prisma client, applies every pending migration, confirms the database is up to date, and drift-checks that the committed migrations fully rebuild the schema (in an ephemeral shadow database) compared to schema.prisma. Exposed locally via `npm run db:verify` (scripts/verify-migrations.sh), so a broken or ungenerated migration fails the pipeline before it reaches review. Closes ASTROIDX556#81 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>

drips-wave · 2026-08-30T17:35:11Z

@michealross Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

mergekeeper · 2026-08-30T17:35:13Z

Needs changes

Missing executable permission on scripts/verify-migrations.sh script file.

scripts/verify-migrations.sh:1: The verification script is executed via 'bash scripts/verify-migrations.sh', but it should also have executable permissions set or be handled properly.

Reviewed commit: 8c0abbea82680ba079a8a6152e151ebcd3ebb8b4.

mergekeeper

Needs changes

Duplicate script entries exist in package.json.

package.json:27: Duplicate "db:verify" script definition found in package.json.

Reviewed commit: 9c807afbffa4a86ea962aa603bbf76b3a40d11c6.

The CI migration verification exposed pre-existing drift: schema.prisma had moved ahead of the committed 0_init migration (passkey challenges/credentials, webhook deliveries, policy override fields, api key IP allowlist, and the outbox_events table were never captured). Add a generated migration that brings the applied schema in line with schema.prisma, restoring zero drift. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>

mergekeeper

Needs changes

Duplicate script entry found in package.json.

package.json:28: Duplicate entry for "db:verify" in package.json scripts.

Reviewed commit: e108c56386a0dba5139c6b09f1bd28da9fd2a812.

mergekeeper

Needs changes

Duplicate script entries exist in package.json and the verification script file is missing execution permissions and newline at EOF.

package.json:28: Duplicate "db:verify" script entry should be removed.
scripts/verify-migrations.sh:59: Missing newline at end of file.

Reviewed commit: d9c828be4d0fcb6e34cea92547884a40fb3d7b5a.

mergekeeper · 2026-08-30T18:09:07Z

Needs review

Linked to #81, but the diff does not match the issue scope.

The pull request includes a large unrequested migration file (prisma/migrations/20260830174000_sync_schema/migration.sql) which is out of scope for adding the automated database migration verification script and CI job.

Reviewed commit: 3f7261db5d69bb5f86dcb26060202be922bb6670.

mergekeeper

Needs changes

Package.json contains a duplicate script definition for db:verify.

package.json:28: Duplicate "db:verify" script entry in package.json.

Reviewed commit: 2048d6393c20c1cd6154f3b006e3e26744e0680b.

A merge left two identical db:verify entries in the scripts block. Drop the duplicate so the script is defined exactly once. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>

mergekeeper · 2026-08-30T18:22:11Z

MergeKeeper review

Scope: in scope for linked issue #81.
Verdict: clean

The PR successfully adds an automated database migration verification script and CI pipeline job fulfilling issue #81.

Reviewed commit: 9fadcfa0543fdb64fda4bf3431852ce9d4ade18b.
CI and merge eligibility are checked separately.

mergekeeper

Approved

The PR correctly implements the automated database migration verification script and CI job as requested.

mergekeeper · 2026-08-30T18:23:46Z

MergeKeeper merge status

Status: blocked
PR state: open
Mergeability: mergeable
Checked commit: 9fadcfa0543fdb64fda4bf3431852ce9d4ade18b.

Reason:
GitHub pull request merge request failed with 403: Resource not accessible by integration

Next steps:
GitHub rejected this as a permissions/ruleset problem, not a review problem — a maintainer merge override cannot force this through.

Confirm the MergeKeeper GitHub App has Contents: Read & write and Pull requests: Read & write permissions for this repository.
If this repository uses a ruleset, add the MergeKeeper GitHub App as a Bypass actor on it (Settings → Rules → Rulesets → the ruleset → Bypass list) — this is what the "bypass rules" checkbox on GitHub's merge button represents, and MergeKeeper can only do the same once it's listed there.
Retry the merge once either is fixed.

mergekeeper

Needs changes

Missing executable permission on scripts/verify-migrations.sh script file.

scripts/verify-migrations.sh:1: The verification script is executed via 'bash scripts/verify-migrations.sh', but it should also have executable permissions set or be handled properly.

Reviewed commit: 8c0abbea82680ba079a8a6152e151ebcd3ebb8b4.

Give scripts/verify-migrations.sh the executable bit and invoke it directly (via its shebang) instead of through `bash`, so the script is self-executing and works from any shell. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>

Merging main brought in schema changes (audit_logs.hash / previousHash) that were not captured in a migration, reintroducing drift. Add a new migration so migrations again fully reproduce schema.prisma. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>

mergekeeper

Approved

The PR successfully adds an automated database migration verification script and CI pipeline job fulfilling issue #81.

mergekeeper Bot requested changes Aug 30, 2026

View reviewed changes

Merge branch 'main' into chore/db-migration-verification

d9c828b

mergekeeper Bot requested changes Aug 30, 2026

View reviewed changes

Merge branch 'main' into chore/db-migration-verification

3f7261d

Merge branch 'main' into chore/db-migration-verification

2048d63

mergekeeper Bot requested changes Aug 30, 2026

View reviewed changes

fix(package.json): remove duplicate db:verify script entry

071a512

A merge left two identical db:verify entries in the scripts block. Drop the duplicate so the script is defined exactly once. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>

mergekeeper Bot approved these changes Aug 30, 2026

View reviewed changes

Merge branch 'main' into chore/db-migration-verification

8c0abbe

mergekeeper Bot requested changes Aug 30, 2026

View reviewed changes

michealross and others added 2 commits August 30, 2026 19:13

mergekeeper Bot approved these changes Aug 30, 2026

View reviewed changes

Navigation Menu

Uh oh!

ci(db): automated database migration verification - #141

ci(db): automated database migration verification#141
michealross wants to merge 9 commits into
ASTROIDX556:mainfrom
michealross:chore/db-migration-verification

michealross commented Aug 30, 2026

Uh oh!

drips-wave Bot commented Aug 30, 2026

Uh oh!

mergekeeper Bot commented Aug 30, 2026 •

edited

Loading

Uh oh!

mergekeeper Bot left a comment

Uh oh!

mergekeeper Bot left a comment

Uh oh!

mergekeeper Bot left a comment

Uh oh!

mergekeeper Bot commented Aug 30, 2026

Uh oh!

mergekeeper Bot left a comment

Uh oh!

mergekeeper Bot commented Aug 30, 2026 •

edited

Loading

Uh oh!

mergekeeper Bot left a comment

Uh oh!

mergekeeper Bot commented Aug 30, 2026 •

edited

Loading

Uh oh!

mergekeeper Bot left a comment

Uh oh!

mergekeeper Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

michealross commented Aug 30, 2026

Summary

What changed

Locally

Validation

Uh oh!

drips-wave Bot commented Aug 30, 2026

Uh oh!

mergekeeper Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mergekeeper Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mergekeeper Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mergekeeper Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mergekeeper Bot commented Aug 30, 2026

Uh oh!

mergekeeper Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mergekeeper Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mergekeeper Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mergekeeper Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mergekeeper Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mergekeeper Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

mergekeeper Bot commented Aug 30, 2026 •

edited

Loading

mergekeeper Bot commented Aug 30, 2026 •

edited

Loading

mergekeeper Bot commented Aug 30, 2026 •

edited

Loading