ci(migrations): run the chain on a schedule, so a break nobody committed still lands (#17490)

[mrveiss]

Thinking Path

#17490's remaining criterion. Its version-pin half landed in 62041b574c; this closes the other one — the blind spot that let the break reach main in the first place.

The issue's own framing of that blind spot was wrong, and the correction matters for the fix. It says the gate is path-filtered so "the chain is only exercised by PRs that touch migrations". migration-gate.yml:44 has no pull_request.paths filter, and the comment at :37-43 says so explicitly — the gate runs on every PR. What skips is the matrix, via if: needs.changes.outputs.migrations != 'false' at :92.

That makes the real gap narrower and sharper: every trigger is diff-driven, so a break whose cause is not a commit is invisible to all of them. #17490 was exactly that — SQLAlchemy 2.1.0 was published, an unpinned install took it, and no diff in this repository caused the failure. The push coverage the issue suggests adding would not have caught it either, because a scheduled release elsewhere touches no path here. Only a schedule does.

What Changed

.github/workflows/migration-gate.yml:

• schedule: '40 4 * * *' — offset from the 02:00 cron cluster (coverage.yml, branch-cleanup.yml) so a Postgres service container is not competing with them.
• workflow_dispatch — confirm a fix without pushing a path-touching commit.
• migration-tests now runs when github.event_name is schedule or workflow_dispatch, ignoring the path filter. A scheduled run has no diff to filter on, so gating it would rebuild the blind spot it exists to close.

Verification

• yaml.safe_load parses; triggers confirmed as merge_group, pull_request, push, schedule, workflow_dispatch.
• migration-tests if: expression confirmed to carry both event-name clauses.
• Pre-push hook ran in full — [pre-push OK] pytest: all relevant tests pass. Recording how, because it is reusable: the hook calls bare python3, which is 3.10.12 here with unsatisfied dependency floors, and it timed out at 186s across three attempts. Running it as PATH="$HOME/.venv-python-suite/bin:$PATH" git push uses the CI-parity interpreter (3.14.6, pytest 9.1.1) and the same selection completes inside the budget. Neither AUTOBOT_PREPUSH_ALLOW_TIMEOUT=1 nor --no-verify was used.
• The selection was also run by hand beforehand under the degraded interpreter: 346 passed, 1 xfailed.

Consequence for #17409, which I will correct there: my reported 218s was measured on 3.10 with 104 floors unsatisfied, not on a CI-equivalent runtime. It is a measurement of a degraded environment, and the coefficient analysis built on it needs re-deriving against the parity venv.

Single-issue rationale

A CI-trigger change shares no file and no reviewer surface with any open code PR, so it cannot ride with one. It does not close #17490 — the issue also tracks the version-pin work already merged, and closing is the merger's call once both halves are verified against main.

Refs #17490
Refs #17439

Model Used

Claude Opus 5 (1M context)

Summary by CodeRabbit

• Chores
  • Migration tests now run daily at 04:40 UTC and can be started manually, as well as running when relevant files change.
  • CI dependency installation is limited to the storage requirements.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 2 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: mrveiss/AutoBot-AI/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 38b173e6-7960-4fcd-ae69-d62f72f5b011

📥 Commits

Reviewing files that changed from the base of the PR and between 6a0fbcd and 42c0529.

📒 Files selected for processing (1)

• .github/workflows/migration-gate.yml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: mrveiss/AutoBot-AI/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a05a891c-b43f-4d3e-9abe-c9d9620cae4c

📥 Commits

Reviewing files that changed from the base of the PR and between 327241f and 6a0fbcd.

📒 Files selected for processing (1)

• .github/workflows/migration-gate.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The migration gate adds a daily schedule and manual dispatch. The migration test job runs for either event regardless of the path filter. Dependency installation is constrained by requirements-ci/storage.txt.

Changes

Migration gate

Layer / File(s)	Summary
Workflow triggers and test execution .github/workflows/migration-gate.yml	The workflow adds a daily trigger at 04:40 UTC and manual dispatch. The migration test job runs for these events regardless of the path-filter result. Dependency installation uses requirements-ci/storage.txt.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 6a0fb

The daily and manual triggers are configured to run migration tests even without migration-path changes. No merge-blocking issue was found.

Architecture Summary

Architecture risk: 🔵 Low · up to 6a0fb

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/migration-gate.yml: The workflow adds a daily schedule trigger at 04:40 and a workflow_dispatch trigger.
• observed — Modified behavior in .github/workflows/migration-gate.yml: migration-tests previously ran whenever the migration filter output was not 'false'. It now also runs for schedule and workflow_dispatch events, regardless of that filter output.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: running the migration chain on a schedule to detect failures without a new commit.
Linked Issues check	✅ Passed	Issue #17490 requires reconsideration of diff-driven migration-gate coverage. The workflow adds a daily schedule trigger at 40 4 * * * and a workflow_dispatch trigger. The migration-tests job …
Out of Scope Changes check	✅ Passed	The changes are limited to .github/workflows/migration-gate.yml. The schedule, manual trigger, condition update, and related comments directly support the coverage objective in issue #17490. No unre…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.