fix(ci): stop the migration safety audit from passing on a branch it never read

[waleedlatif1]

The check reports success when it cannot run

check-migrations-safety.ts returns the same empty file list for "this branch adds no migrations" and "I could not diff against the base". The second prints as a pass:

$ bun run scripts/check-migrations-safety.ts origin/does-not-exist-branch
✓ No new migrations to check.     exit=0

changedMigrationFiles returned [] whenever git diff failed, with a comment deferring the call to the caller — but resolveFiles only ever recognised a missing git binary (git rev-parse HEAD === null), never an unusable ref.

CI supplies exactly that input

test-build.yml:

git fetch --depth=1 origin "${{ github.base_ref }}" 2>/dev/null || true

The || true swallows a failed fetch, which leaves origin/<base> absent — the precise condition above. A PR adding a destructive DROP COLUMN then clears the only guard on production DDL with a green check.

This is the one audit in the repo whose failure mode is silent and whose subject is irreversible.

The fix, both halves

The audit distinguishes the two cases. Absent git remains the one legitimate skip and is now checked before the diff; a diff that fails with git present raises BaseRefUnusableError and exits 1 with a message naming the ref.

The fetch is its own step with no || true, so a failed fetch fails the job instead of quietly degrading the next one.

Depth stays at 1 deliberately. Without a merge-base the audit falls back to diffing the two tips, and under --diff-filter=AM that is exactly the set of migrations new on the branch — so a shallow fetch is correct here and a full-history fetch would slow every PR for nothing.

Testing

The defect lived in the exit code, not in any function's return value, so the test runs the script end to end and asserts on the code and stderr.

Verified it can fail: reverting the throw to return [] turns the first case red with expected +0 to be 1, and restoring it goes green.

✓ fails loudly when the base ref cannot be diffed
✓ passes against a real base ref with no new migrations

Also confirmed the real-base path still exits 0, so this does not turn every PR red.

Provenance

Found while auditing the repo's custom gates for blind spots — the same sweep that produced #7020 (where \buseQuery\s*\( never matched useQuery<T>(, leaving 10 strict-zone queries unscanned). A passing gate that cannot see part of its own domain is the most expensive kind of green.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 24, 2026 1:59am

[cursor]

PR Summary

Medium Risk
Tightens a CI gate over production DDL rather than changing migrations themselves. A failed base-ref fetch now fails the job instead of silently skipping the audit.

Overview
The migration safety check no longer treats an unusable git base the same as “no new migrations.” A failed git diff now raises BaseRefUnusableError and exits 1; only a missing git binary still skips.

CI fetch of the PR base is its own step with no || true, so a swallowed fetch cannot leave origin/<base> absent. Shallow --depth=1 is kept: without a merge-base the audit diffs the two tips, which under --diff-filter=AM is the set of new migration files.

Adds an end-to-end test that a nonexistent base fails loudly and a real HEAD still reports no new migrations.

^{Reviewed by Cursor Bugbot for commit cb74e15. Configure here.}

[greptile-apps]

Greptile Summary

This PR makes the migration safety audit fail closed when its base reference cannot be diffed.

• Fetches the pull request base ref in a required, dedicated CI step.
• Distinguishes an unavailable Git executable from an unusable base ref.
• Adds end-to-end regression coverage for failing and successful audit invocations.

Confidence Score: 5/5

The PR appears safe to merge, with the migration audit now failing explicitly when it cannot inspect the requested base.

The workflow no longer suppresses base-fetch failures, and the audit preserves its intentional Git-unavailable skip while converting failed base comparisons into a nonzero exit.

Important Files Changed

Filename	Overview
.github/workflows/test-build.yml	Moves the base-ref fetch into a required pull-request-only step so fetch failures stop the CI job.
scripts/check-migrations-safety.ts	Separates an unavailable Git executable from a failed base comparison and reports the latter as an audit error.
scripts/check-migrations-safety.test.ts	Adds process-level regression tests covering an unusable base ref and a valid no-change comparison.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  PR[Pull request job] --> Fetch[Fetch base ref]
  Fetch -->|failure| JobFail[Fail CI job]
  Fetch -->|success| Audit[Run migration safety audit]
  Audit --> GitCheck{Git available?}
  GitCheck -->|no| Skip[Warn and skip]
  GitCheck -->|yes| Diff{Base ref can be diffed?}
  Diff -->|no| AuditFail[Exit 1 with unusable-ref error]
  Diff -->|yes| Scan[Scan changed migration files]
  Scan --> Result[Report audit result]

Loading

_{Reviews (1): Last reviewed commit: "fix(ci): stop the migration safety audit..." | Re-trigger Greptile}