check-fk-targets.sh exits silently on ALTER-only migrations and false-flags SQL comments #1

New issue

Closed

opened 2026-07-09 21:45:51 -03:00 by navigator · 0 comments

navigator commented

2026-07-09 21:45:51 -03:00

Owner

Found when the Forgejo Actions runner was commissioned (2026-07-09) and the boundaries job ran for the first time since June.

Bug 1: under set -euo pipefail, own=$(grep ... ) exits 1 when a migration has no CREATE TABLE (any ALTER-only migration, e.g. 0516), killing the script before any check runs — with no output and a misleading green history.

Bug 2: the REFERENCES scan is case-insensitive over the whole file, so prose in SQL comments (e.g. "references the RSA keypair" in 0400) is reported as an FK violation.

Bug 3: the rule only allowed same-FILE self-references, so a legitimate intra-crate FK across migration files (0501 amendment → proposal, both owned by the proposals crate) had no way to be declared.

Fix in PR: || true on the grep, comment stripping before the scan, and a reviewable allowlist at scripts/fk-allow.txt.

Found when the Forgejo Actions runner was commissioned (2026-07-09) and the `boundaries` job ran for the first time since June. **Bug 1:** under `set -euo pipefail`, `own=$(grep ... )` exits 1 when a migration has no `CREATE TABLE` (any ALTER-only migration, e.g. 0516), killing the script before any check runs — with no output and a misleading green history. **Bug 2:** the `REFERENCES` scan is case-insensitive over the whole file, so prose in SQL comments (e.g. "references the RSA keypair" in 0400) is reported as an FK violation. **Bug 3:** the rule only allowed same-FILE self-references, so a legitimate intra-crate FK across migration files (0501 amendment → proposal, both owned by the proposals crate) had no way to be declared. Fix in PR: `|| true` on the grep, comment stripping before the scan, and a reviewable allowlist at `scripts/fk-allow.txt`.