Migration and API safety

Some changes pass every test and still cause an incident: an index build that blocks writes to a large table, a column dropped while the previous release still reads it, a protobuf field renumbered under a mobile app that ships monthly. MergeHarbor checks every pull request for these with built-in rules. They run on every review, use no model and cost nothing.

Findings carry a Migration or Breaking API badge in the console and name their rule on the code host, for example deterministic check migration.drop-column.

Database migrations

MergeHarbor reads migrations written in plain SQL (dbmate, goose, golang-migrate, Flyway, Liquibase, Prisma) and in Rails, Django, Alembic, Knex and TypeORM. It looks only at the direction that runs on deploy, and never at tables the same migration creates (they are empty).

Rule	What it reports	Why it matters
migration.index-blocking	An index built without CONCURRENTLY on PostgreSQL	Writes to the table wait until the build finishes.
migration.not-null-no-default	A NOT NULL column added without a default	The migration fails on a table that has rows.
migration.column-type-change	A column type changed in place	The table is rewritten under an exclusive lock.
migration.set-not-null	SET NOT NULL on an existing column	Every row is scanned under an exclusive lock.
migration.constraint-validated	A foreign key or check constraint validated in place	Writes are blocked while existing rows are checked.
migration.drop-column, migration.drop-table	A column or table dropped	Dropped data is gone, and the previous release breaks during the deploy.
migration.rename	A column or table renamed in one step	The previous release breaks during the deploy.
migration.backfill-in-transaction	Rows updated in the same transaction as a schema change	The schema lock is held for the whole backfill.
migration.data-wipe	TRUNCATE or DELETE without WHERE	Every row is deleted.
migration.irreversible	No down step where the framework expects one	The deploy cannot be rolled back cleanly.
migration.edited	An existing migration edited	Databases that already ran it drift; Flyway, Liquibase and Prisma refuse to deploy.

Each comment explains the safer way to make the same change, for your framework.

API contracts

When a pull request edits an OpenAPI or Swagger file (contract.openapi), a .proto file (contract.protobuf) or a GraphQL schema (contract.graphql), MergeHarbor compares it with the base version and lists every change that breaks an existing client: removed endpoints, operations, messages, types, fields and enum values; changed field types, numbers and names; inputs that became required. Adding things is never reported.

If the repository belongs to a cluster or has related repositories, the finding also names the repositories whose indexed code uses the changed contract, so you know who to tell before you merge.

Turn rules off

Every rule can be turned off for an organization, a repository or a folder:

review:
  checks:
    disable: [migration.edited]

See Configure reviews for where settings live.