zyycnandClaude c6444b2bf1 ci: assert the migration freeze manifest is append-only vs the PR base ...

Follow-up to 720eb0c2: the manifest was self-attested — editing a released
migration and regenerating its sha256 line in the same PR passed the
checksum and membership checks, and the next release then bricked every
deployment on the startup checksum mismatch the guard exists to prevent.
On pull requests, fetch the base commit and require every line in the base
manifest to survive verbatim, so a changed hash (edit) or a dropped line
(delete) fails CI; genuinely new migrations only add lines and still pass.

Co-authored-by: Claude <noreply@anthropic.com>

2026-07-27 00:12:44 +08:00

..

workflows

ci: assert the migration freeze manifest is append-only vs the PR base

2026-07-27 00:12:44 +08:00

dependabot.yml

chore(deps): delay fresh npm updates

2026-07-15 11:13:50 +08:00