From 7aa5c4e659c65caffbbc8d4eed6f98f4d31a817d Mon Sep 17 00:00:00 2001
From: Leon Morival <leon.morival@gmail.com>
Date: Sun, 16 Aug 2026 13:16:15 +0200
Subject: [PATCH] ci: prevent edits to existing migrations

---
 .gitea/workflows/ci.yml                    | 18 ++++++++++++
 scripts/ci/check-migration-immutability.sh | 32 ++++++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100755 scripts/ci/check-migration-immutability.sh

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 9335f92..250bb2b 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -9,6 +9,7 @@ on:
   pull_request:
     branches:
       - main
+      - develop
 jobs:
   test:
     name: 🧪 Tests Laravel
@@ -19,6 +20,23 @@ jobs:
     steps:
       - name: 📥 Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: 🔒 Vérifier l’immutabilité des migrations
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PUSH_BASE_SHA: ${{ github.event.before }}
+        run: |
+          case "$EVENT_NAME" in
+            pull_request) base_sha="$PR_BASE_SHA" ;;
+            push) base_sha="$PUSH_BASE_SHA" ;;
+            *) echo "Événement non supporté : $EVENT_NAME"; exit 1 ;;
+          esac
+
+          sh scripts/ci/check-migration-immutability.sh "$base_sha"
+
       - name: 🐘 Setup PHP
         uses: shivammathur/setup-php@v2
         with:
diff --git a/scripts/ci/check-migration-immutability.sh b/scripts/ci/check-migration-immutability.sh
new file mode 100755
index 0000000..9fc4b4b
--- /dev/null
+++ b/scripts/ci/check-migration-immutability.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env sh
+
+set -eu
+
+base_sha="${1:-}"
+head_sha="${2:-HEAD}"
+
+if [ -z "$base_sha" ] || printf '%s' "$base_sha" | grep -Eq '^0+$'; then
+    echo 'Impossible de déterminer le commit de référence.'
+    exit 1
+fi
+
+git cat-file -e "$base_sha^{commit}"
+git cat-file -e "$head_sha^{commit}"
+
+violations="$(
+    git diff \
+        --name-status \
+        --diff-filter=MDTR \
+        "$base_sha" \
+        "$head_sha" \
+        -- database/migrations/
+)"
+
+if [ -n "$violations" ]; then
+    echo 'Les migrations existantes sont immuables.'
+    echo 'Crée une nouvelle migration corrective :'
+    printf '%s\n' "$violations"
+    exit 1
+fi
+
+echo 'Aucune migration existante modifiée.'