ci: prevent edits to existing migrations

.gitea/workflows/ci.yml

@@ -9,6 +9,7 @@ on:
   pull_request:
     branches:
       - main
+      - develop
 jobs:
   test:
     name: 🧪 Tests Laravel
@@ -19,6 +20,23 @@ jobs:
     steps:
       - name: 📥 Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: 🔒 Vérifier l’immutabilité des migrations
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PUSH_BASE_SHA: ${{ github.event.before }}
+        run: |
+          case "$EVENT_NAME" in
+            pull_request) base_sha="$PR_BASE_SHA" ;;
+            push) base_sha="$PUSH_BASE_SHA" ;;
+            *) echo "Événement non supporté : $EVENT_NAME"; exit 1 ;;
+          esac
+
+          sh scripts/ci/check-migration-immutability.sh "$base_sha"
+
       - name: 🐘 Setup PHP
         uses: shivammathur/setup-php@v2
         with:

scripts/ci/check-migration-immutability.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env sh
+
+set -eu
+
+base_sha="${1:-}"
+head_sha="${2:-HEAD}"
+
+if [ -z "$base_sha" ] || printf '%s' "$base_sha" | grep -Eq '^0+$'; then
+    echo 'Impossible de déterminer le commit de référence.'
+    exit 1
+fi
+
+git cat-file -e "$base_sha^{commit}"
+git cat-file -e "$head_sha^{commit}"
+
+violations="$(
+    git diff \
+        --name-status \
+        --diff-filter=MDTR \
+        "$base_sha" \
+        "$head_sha" \
+        -- database/migrations/
+)"
+
+if [ -n "$violations" ]; then
+    echo 'Les migrations existantes sont immuables.'
+    echo 'Crée une nouvelle migration corrective :'
+    printf '%s\n' "$violations"
+    exit 1
+fi
+
+echo 'Aucune migration existante modifiée.'