fix(gate): exclude base-tree renames from the migration collision recheck and harden the tsx shebang

Renaming an already-merged base migration (same number, e.g. a typo fix)
unioned both the old name (still live on main pre-merge) and the new name,
self-colliding even though the merged tree would only ever have one file at
that number. Now the PR's own removed/renamed-away base filenames are
subtracted from the live tree before the union.

Also harden scripts/check-migrations.mjs's shebang with --no-install so a
missing local tsx fails closed instead of npx silently fetching an
unverified package from the registry, per the security scanner finding.

Author: JSONbored

scripts/check-migrations.mjs

@@ -1,4 +1,4 @@
-#!/usr/bin/env -S npx tsx
+#!/usr/bin/env -S npx --no-install tsx
 // Guards the D1 migration set against the silent failure modes that git can't catch:
 //   • two PRs that each grab the same next number (e.g. `0038_foo.sql` + `0038_bar.sql`) are DIFFERENT
 //     files, so git reports no conflict and both merge — then `wrangler d1 migrations apply` runs both

src/queue/processors.ts

@@ -1578,10 +1578,13 @@ export function changedPathsForGuardrail(
  * Live premerge migrations/** collision recheck (#2550). `check-migrations.mjs` (CI) only validates against
  * THIS PR's own branch snapshot at the time CI ran — it can never see a sibling PR that merged a
  * same-numbered migration file to `baseRef` in the meantime. This does the live check right before the
- * merge-decision moment: fetch the base branch's CURRENT migration filenames, union them with THIS PR's own
- * new migration filenames (the live tree never contains this PR's own not-yet-merged files, so checking main
- * alone could never detect a collision from this PR's perspective — the union is load-bearing, not optional),
- * then run the SAME collision-detection function scripts/check-migrations.mjs uses.
+ * merge-decision moment: fetch the base branch's CURRENT migration filenames, drop any filename THIS PR's
+ * own diff removes from the base (an outright deletion, or a rename's pre-rename name — otherwise renaming
+ * an existing base migration self-collides with its own old name, which is still live on `baseRef` until
+ * this PR merges), union what's left with THIS PR's own new migration filenames (the live tree never
+ * contains this PR's own not-yet-merged files, so checking main alone could never detect a collision from
+ * this PR's perspective — the union is load-bearing, not optional), then run the SAME collision-detection
+ * function scripts/check-migrations.mjs uses.
  *
  * Deliberately scoped to a collision involving THIS PR's own migration number(s) only (via `prNumbers`) — a
  * pre-existing collision between two OTHER already-merged files (which would mean `main` itself is already
@@ -1605,12 +1608,15 @@ async function resolveLiveMigrationCollisionHold(
     token: string | undefined;
     admissionKey: GitHubRateLimitAdmissionKey | undefined;
     prMigrationFilenames: string[];
+    prRemovedMigrationFilenames: string[];
   },
 ): Promise<{ reason: string; comment: string } | undefined> {
   if (!args.baseRef) return undefined;
   const liveFilenames = await listMigrationFilenamesAtRef(args.repoFullName, args.baseRef, args.token, args.admissionKey);
   if (liveFilenames === null) return undefined;
-  const union = [...new Set([...liveFilenames, ...args.prMigrationFilenames])];
+  const removedFromBase = new Set(args.prRemovedMigrationFilenames);
+  const effectiveLiveFilenames = liveFilenames.filter((f) => !removedFromBase.has(f));
+  const union = [...new Set([...effectiveLiveFilenames, ...args.prMigrationFilenames])];
   const prNumbers = new Set(args.prMigrationFilenames.map((f) => extractMigrationNumber(f)).filter((n): n is number => n !== null));
   const collisions = detectMigrationCollisions(union, KNOWN_MIGRATION_DUPLICATES).filter((c) => prNumbers.has(c.number));
   if (collisions.length === 0) return undefined;
@@ -1888,9 +1894,32 @@ async function runAgentMaintenancePlanAndExecute(
   const prMigrationFilenames = changedFiles
     .filter((f) => f.status !== "removed" && f.path.startsWith("migrations/") && f.path.endsWith(".sql"))
     .map((f) => f.path.slice("migrations/".length));
+  // Base filenames this PR's diff removes from `migrations/**` — an outright deletion's own `.path`, or a
+  // rename's pre-rename `.previousFilename` — so a filename that won't exist once this PR merges isn't still
+  // counted from the live base fetch below. Without this, renaming an EXISTING base migration within the same
+  // number (e.g. `migrations/0099_old.sql` -> `migrations/0099_new.sql`, fixing a typo on an already-merged
+  // file) unions both the old (still live) and new (this PR's) name and self-collides, even though the merged
+  // tree would only ever contain the new file.
+  const prRemovedMigrationFilenames = changedFiles.flatMap((f) => {
+    const removed: string[] = [];
+    if (f.status === "removed" && f.path.startsWith("migrations/") && f.path.endsWith(".sql")) {
+      removed.push(f.path.slice("migrations/".length));
+    }
+    if (f.previousFilename && f.previousFilename.startsWith("migrations/") && f.previousFilename.endsWith(".sql")) {
+      removed.push(f.previousFilename.slice("migrations/".length));
+    }
+    return removed;
+  });
   const migrationCollisionHold =
     settings.premergeContentRecheck === true && prMigrationFilenames.length > 0
-      ? await resolveLiveMigrationCollisionHold({ repoFullName, baseRef, token, admissionKey, prMigrationFilenames })
+      ? await resolveLiveMigrationCollisionHold({
+          repoFullName,
+          baseRef,
+          token,
+          admissionKey,
+          prMigrationFilenames,
+          prRemovedMigrationFilenames,
+        })
       : undefined;
   const repoOwner = repoFullName.includes("/")
     ? repoFullName.slice(0, repoFullName.indexOf("/"))

test/unit/queue.test.ts

@@ -5979,6 +5979,55 @@ describe("queue processors", () => {
       expect(seen.labels).not.toContain("gittensory:migration-collision");
     });
 
+    it("REGRESSION: renaming an EXISTING base migration (same number) does NOT self-collide with its own old name still live on main", async () => {
+      // Before the fix, liveFilenames (fetched from main, which still has the pre-rename name until this PR
+      // merges) was unioned as-is with prMigrationFilenames (the new name only) — so a same-number typo-fix
+      // rename of an ALREADY-MERGED base migration counted as two distinct files at one number and
+      // self-collided, even though the merged tree would only ever contain the renamed file.
+      const env = createTestEnv({ GITHUB_APP_PRIVATE_KEY: await generatePrivateKeyPem() });
+      await seedMigrationRecheckRepo(env, 73, { premergeContentRecheck: true });
+      const seen = { closed: false, merged: false, labels: [] as string[], comments: [] as string[], treeCalls: 0 };
+      vi.stubGlobal("fetch", async (input: RequestInfo | URL, init?: RequestInit) => {
+        const url = input.toString();
+        const method = (init?.method ?? "GET").toUpperCase();
+        if (url === "https://api.gittensor.io/miners") return Response.json([]);
+        if (url.includes("/access_tokens")) return Response.json({ token: "installation-token" });
+        if (url.includes("/check-runs/") && method === "PATCH") return Response.json({ id: 901 });
+        if (url.includes("/git/trees/main")) {
+          seen.treeCalls += 1;
+          // main still has the PRE-rename name — this PR's rename hasn't merged yet.
+          return Response.json({ tree: [{ type: "blob", path: "migrations/0099_old.sql" }] });
+        }
+        if (/\/pulls\/\d+(?:\?|$)/.test(url) && method === "GET" && !url.includes("/pulls/73/")) {
+          return Response.json({ number: 73, state: "open", user: { login: "contributor" }, head: { sha: "sha1" }, base: { ref: "main", sha: "base" }, mergeable_state: "clean", labels: [] });
+        }
+        // Renames an EXISTING base migration (same number 0099), not a file this PR itself added.
+        if (url.includes("/pulls/73/files")) return Response.json([{ filename: "migrations/0099_new.sql", previous_filename: "migrations/0099_old.sql", status: "renamed", additions: 1, deletions: 1, changes: 2, patch: "@@\n rename" }]);
+        if (url.includes("/commits/sha1/check-runs")) return Response.json({ total_count: 0, check_runs: [] });
+        if (url.includes("/commits/sha1/status")) return Response.json({ state: "success", statuses: [{ context: "ci/build", state: "success", description: "ok" }] });
+        if (url.includes("/commits/sha1/check-suites")) return Response.json({ check_suites: [] });
+        if (url.includes("/branches/")) return Response.json({ contexts: [] });
+        if (url === "https://api.github.com/graphql") return Response.json({ data: { repository: { pullRequest: { reviewDecision: "APPROVED" } } } });
+        if (url.includes("/pulls/73/merge") && method === "PUT") {
+          seen.merged = true;
+          return Response.json({ merged: true, sha: "merged-sha1" });
+        }
+        if (url.includes("/issues/73/labels") && method === "GET") return Response.json([]);
+        if (url.includes("/issues/73/labels") && method === "POST") {
+          seen.labels.push(...((JSON.parse(String(init?.body ?? "{}")).labels ?? []) as string[]));
+          return Response.json([]);
+        }
+        if (url.endsWith("/labels") && method === "POST") return Response.json({ name: "x" }, { status: 201 });
+        if (url.includes("/issues/73/comments")) return Response.json([]);
+        return Response.json({});
+      });
+
+      await processJob(env, { type: "agent-regate-pr", deliveryId: "migration-rename-existing-base", repoFullName: "owner/repo", prNumber: 73, installationId: 123 });
+
+      expect(seen.merged).toBe(true); // the pre-rename name still live on main must not count against this PR
+      expect(seen.labels).not.toContain("gittensory:migration-collision");
+    });
+
     it("REGRESSION: renumbering (renaming) this PR's migration to resolve a real collision does not leave a stale hold from the old filename", async () => {
       // Before the fix, the stale previousFilename (the OLD number) stayed in prMigrationFilenames forever,
       // colliding with an unrelated already-merged file at that old number and permanently re-holding a PR