zyycnandClaude c6444b2bf1 ci: assert the migration freeze manifest is append-only vs the PR base ...

Follow-up to 720eb0c2: the manifest was self-attested — editing a released
migration and regenerating its sha256 line in the same PR passed the
checksum and membership checks, and the next release then bricked every
deployment on the startup checksum mismatch the guard exists to prevent.
On pull requests, fetch the base commit and require every line in the base
manifest to survive verbatim, so a changed hash (edit) or a dropped line
(delete) fails CI; genuinely new migrations only add lines and still pass.

Co-authored-by: Claude <noreply@anthropic.com>

2026-07-27 00:12:44 +08:00

..

_container.yml

chore(release): prepare v3.0.0

2026-07-25 01:54:18 +08:00

_quality.yml

ci: assert the migration freeze manifest is append-only vs the PR base

2026-07-27 00:12:44 +08:00

ci.yml

ci: speed up validation pipelines

2026-07-16 16:07:55 +08:00

release.yml

docs: phrase the clean-break warning per major, not 2.x/3.x

2026-07-26 23:43:14 +08:00

security-scan.yml

chore(deps): bump setup-node to 7.0.0

2026-07-16 01:51:31 +08:00