From ec535233fa9a74332d1606778baa6fff0091547e Mon Sep 17 00:00:00 2001
From: enlineawork <enlinea.work@gmail.com>
Date: Tue, 8 Sep 2026 22:08:54 -0300
Subject: [PATCH] ci: prove F5 migrations revert and reapply cleanly

---
 .github/workflows/ci.yml | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 858bdaa..a89354b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -141,6 +141,38 @@ jobs:
             END IF;
           END $$;
           SQL
+
+          # Prove the four F5 migrations are actually reversible on a clean state.
+          for _ in 1 2 3 4; do
+            docker compose --env-file .env.example --profile tools run --rm migrate npm run migration:revert
+          done
+
+          docker compose --env-file .env.example exec -T db \
+            psql -v ON_ERROR_STOP=1 -U dhv2_owner -d dhv2 <<'SQL'
+          DO $$
+          DECLARE f5_migrations integer; instance_column integer;
+          BEGIN
+            SELECT COUNT(*) INTO f5_migrations
+            FROM typeorm_migrations
+            WHERE name LIKE 'F5%1790087%';
+            IF f5_migrations <> 0 THEN
+              RAISE EXCEPTION 'F5 rollback left % migration rows behind', f5_migrations;
+            END IF;
+            SELECT COUNT(*) INTO instance_column
+            FROM information_schema.columns
+            WHERE table_schema='public' AND table_name='assets' AND column_name='is_inventory_instance';
+            IF instance_column <> 0 THEN
+              RAISE EXCEPTION 'F5 rollback left is_inventory_instance behind';
+            END IF;
+          END $$;
+          SQL
+
+          # Reapply them once more. Each F5 migration performs its own source/cardinality checks.
+          docker compose --env-file .env.example --profile tools run --rm migrate
+          docker compose --env-file .env.example exec -T db \
+            psql -v ON_ERROR_STOP=1 -U dhv2_owner -d dhv2 -Atc \
+              "SELECT CASE WHEN COUNT(*)=4 THEN 'F5_REAPPLY_OK' ELSE 'F5_REAPPLY_FAILED:'||COUNT(*) END FROM typeorm_migrations WHERE name IN ('F5InventoryPhysicalInstance1790087100000','F5AuthoritativeTerritory1790087200000','F5OperationalContextCompatibility1790087250000','F5AuthoritativeInventoryCatalog1790087300000');" \
+            | grep -Fx 'F5_REAPPLY_OK'
       - name: VPS-equivalent isolated API preflight
         run: |
           set -Eeuo pipefail