v0.9.34: oauth reconnect conflicts, sandbox host drain, token sealing backfill, migrate guards

.github/workflows/ci.yml

@@ -657,6 +657,7 @@ jobs:
     permissions:
       contents: read
       actions: read
+      checks: read
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
@@ -666,27 +667,31 @@ jobs:
         with:
           bun-version: 1.4.4
 
-      # Diff from the head of the last earlier run whose submission succeeded, not the previous
+      # Diff from the last earlier main commit whose `indexnow` check succeeded, not the previous
       # push: a push that never deployed, or whose submission failed, would otherwise drop its
-      # changed URLs for good. Falls back to the previous push when no such run is in view. The
-      # diff needs only the two trees, so that one commit is fetched alone; an all-zero `before`
-      # (the branch's first push) has no base, which the script skips.
+      # changed URLs for good. The check-runs lookup asks for this one check per commit, so it
+      # stays small and counts every attempt of a re-run; a lookup that errors counts as no
+      # success. With no success in view, the base is the oldest run in view, so URLs that no
+      # submission ever covered are sent now. The diff needs only the two trees, so that one
+      # commit is fetched alone; an all-zero `before` (the branch's first push) has no base,
+      # which the script skips.
       - name: Submit changed URLs to IndexNow
         env:
           GH_TOKEN: ${{ github.token }}
           PUSH_BEFORE: ${{ github.event.before }}
         run: |
           BASE_SHA=""
-          while read -r run_id head_sha; do
-            conclusion="$(gh api --paginate "repos/$GITHUB_REPOSITORY/actions/runs/$run_id/jobs?per_page=100" \
-              --jq '.jobs[] | select(.name == "indexnow") | .conclusion')"
-            if [[ "$conclusion" == "success" ]]; then
+          OLDEST_SHA=""
+          while read -r head_sha; do
+            OLDEST_SHA="$head_sha"
+            if succeeded="$(gh api "repos/$GITHUB_REPOSITORY/commits/$head_sha/check-runs?check_name=indexnow&filter=all" \
+              --jq '[.check_runs[] | select(.conclusion == "success")] | length')" && [[ "$succeeded" -gt 0 ]]; then
               BASE_SHA="$head_sha"
               break
             fi
           done < <(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?branch=main&event=push&per_page=30" \
-            --jq ".workflow_runs[] | select(.id < $GITHUB_RUN_ID) | \"\\(.id) \\(.head_sha)\"")
-          BASE_SHA="${BASE_SHA:-$PUSH_BEFORE}"
+            --jq ".workflow_runs[] | select(.id < $GITHUB_RUN_ID) | .head_sha")
+          BASE_SHA="${BASE_SHA:-${OLDEST_SHA:-$PUSH_BEFORE}}"
           echo "Submitting URLs changed in $BASE_SHA..$GITHUB_SHA"
           if [[ ! "$BASE_SHA" =~ ^0+$ ]]; then
             git fetch --no-tags --depth=1 origin "$BASE_SHA"

.github/workflows/migrate.yml

@@ -38,8 +38,41 @@ jobs:
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     # Bulk projection loads and concurrent index builds can outlast ordinary schema changes.
     timeout-minutes: 300
+    # One migrate job per environment at a time, so a manual dispatch queues
+    # behind a CI run instead of racing it for migrate.ts's advisory lock, which
+    # gives up after 30 minutes. Job-level because a called workflow evaluates
+    # workflow-level concurrency with the caller's github context; the group
+    # must also never equal ci.yml's ci-<ref> group or the two deadlock.
+    concurrency:
+      group: migrate-${{ inputs.environment }}
+      cancel-in-progress: false
 
     steps:
+      # An environment only migrates from its own branch, so a manual dispatch
+      # from a feature branch cannot apply that branch's migrations to a shared
+      # database. Under workflow_call github.ref is the caller's ref (ci.yml's
+      # push to main/staging/dev). This fails rather than skips: ci.yml's
+      # promote gates on migrate succeeding, and a skipped run must never read
+      # as a migration that happened. It runs before any secret is read.
+      - name: Require the environment's own branch
+        env:
+          ENVIRONMENT: ${{ inputs.environment }}
+          REF: ${{ github.ref }}
+        run: |
+          case "${ENVIRONMENT}" in
+            production) expected=refs/heads/main ;;
+            staging) expected=refs/heads/staging ;;
+            dev) expected=refs/heads/dev ;;
+            *)
+              echo "::error::Unknown migrate environment '${ENVIRONMENT}'"
+              exit 1
+              ;;
+          esac
+          if [ "${REF}" != "${expected}" ]; then
+            echo "::error::Refusing to migrate ${ENVIRONMENT} from ${REF}; ${ENVIRONMENT} migrates only from ${expected}"
+            exit 1
+          fi
+
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with: