make migrate-safe runs from the new release's image (#1045) #1062

Merged

claude-bot merged 2 commits from fix/1045-migrate-safe-new-release into main 2026-10-04 02:27:07 +00:00

Conversation 0 Commits 2 Files changed 7 +206 -23

claude-bot commented 2026-10-04 02:00:50 +00:00

Collaborator

Copy link

Closes #1045. The owner's answer to Q146 (D274).

Summary

make migrate-safe ran its preflight, backup and migration with docker compose exec backend, which is the container that is running now: on an upgrade it checked and migrated with the old release's code. It now runs them from the release about to start, and touches no running service.

scripts/migrate-safe.sh (POSIX sh), called by the Makefile target:

1. Fetch the new release. docker compose pull on an image host, docker compose build on a source build. Which one is asked of compose itself: whether the rendered config gives the migrate service a build: section.
2. Preflight and backup in throwaway backend containers: the same user and ./backups mount as make backup-now, so the dump lands where that one writes, owned the same way.
3. Migrate in a throwaway migrate container, run as that service's own command, so its backups-directory preparation and migrate credentials are used as they stand.

Every step is run --rm --no-deps, so db and redis are not touched. The script stops at the first failure and names the step.

Docs. docs/OPERATIONS.md (install, Updating Production, Running from Published Images, Safety rules), the comment by the migrate service, and the profile's prod-deploy line now recommend the command. #1044 had told image hosts not to use it.

Changelog

• changelog.d/1045-migrate-safe-new-release.fixed.md

Test plan

Proved on docker-test in a throwaway compose project, with no published ports and a dummy .env; the dev stack was not touched.

• Image host (COMPOSE_FILE with the images overlay, 4.5.0-rc2):
  • the three steps ran in three new run containers;
  • the dump appeared in ./backups;
  • the running backend kept the same container id and start time before and after.
• Failure path: with db stopped, step 1 failed, the message named it, make exited non-zero, and nothing after it ran.
• Source build: with the overlay removed, it built instead of pulling, then ran the same three steps.
• Four unit tests of the build-or-pull detection. ruff clean; version sync and changelog checks OK.
• Not seen: a real network pull of a newer tag on an image host. The image was already present locally, so pull had nothing to fetch.
• Full suites: CI.

🤖 Generated with Claude Code

Closes #1045. The owner's answer to Q146 (D274). ## Summary `make migrate-safe` ran its preflight, backup and migration with `docker compose exec backend`, which is the container that is running now: on an upgrade it checked and migrated with the old release's code. It now runs them from the release about to start, and touches no running service. `scripts/migrate-safe.sh` (POSIX sh), called by the Makefile target: 1. **Fetch the new release.** `docker compose pull` on an image host, `docker compose build` on a source build. Which one is asked of compose itself: whether the rendered config gives the `migrate` service a `build:` section. 2. **Preflight and backup** in throwaway `backend` containers: the same user and `./backups` mount as `make backup-now`, so the dump lands where that one writes, owned the same way. 3. **Migrate** in a throwaway `migrate` container, run as that service's own command, so its backups-directory preparation and migrate credentials are used as they stand. Every step is `run --rm --no-deps`, so db and redis are not touched. The script stops at the first failure and names the step. **Docs.** `docs/OPERATIONS.md` (install, Updating Production, Running from Published Images, Safety rules), the comment by the `migrate` service, and the profile's prod-deploy line now recommend the command. #1044 had told image hosts not to use it. ## Changelog - [x] `changelog.d/1045-migrate-safe-new-release.fixed.md` ## Test plan Proved on docker-test in a throwaway compose project, with no published ports and a dummy `.env`; the dev stack was not touched. - [x] **Image host** (`COMPOSE_FILE` with the images overlay, `4.5.0-rc2`): - the three steps ran in three new `run` containers; - the dump appeared in `./backups`; - the running backend kept the same container id and start time before and after. - [x] **Failure path:** with db stopped, step 1 failed, the message named it, `make` exited non-zero, and nothing after it ran. - [x] **Source build:** with the overlay removed, it built instead of pulling, then ran the same three steps. - [x] Four unit tests of the build-or-pull detection. ruff clean; version sync and changelog checks OK. - [ ] **Not seen:** a real network pull of a newer tag on an image host. The image was already present locally, so pull had nothing to fetch. - [ ] Full suites: CI. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 2 commits 2026-10-04 02:00:50 +00:00

make migrate-safe runs from the new release's image (#1045) ... bc9d709034

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Format the migrate-safe detection test (#1045) ... 89bfe2d11a

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

claude-bot merged commit 2c2dd29327 into main 2026-10-04 02:27:07 +00:00

claude-bot deleted branch fix/1045-migrate-safe-new-release 2026-10-04 02:27:08 +00:00

claude-bot referenced this pull request from a commit 2026-10-04 02:27:08 +00:00

Merge PR #1062: make migrate-safe runs from the new release's image (#1045)

claude-bot referenced this pull request 2026-10-04 02:27:08 +00:00

make migrate-safe migrates with the running release's code, not the one being installed #1045

rbrooks referenced this pull request from a commit 2026-10-04 06:57:14 +00:00

chore(release): v4.5.0-rc3

claude-bot referenced this pull request 2026-10-04 06:57:21 +00:00

chore(release): v4.5.0-rc3 #1073

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

backend

Issue related to the backend

  

bot

Issue related to the bot

  

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

frontend

Issue related to the frontend

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

recording

Issue related to the recording system

  

security

Security hardening / vulnerability work

  

wontfix

This won't be fixed

No labels

backend

bot

bug

duplicate

enhancement

frontend

help wanted

invalid

question

recording

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/Quest-Board!1062

No description provided.