Release SQL Gate
Turn a Git diff into a reviewable, immutable SQL release manifest without executing database changes.
Boundaries
- The helper is read-only with respect to Git and databases.
- It never connects to a database, applies SQL, deploys, commits, or pushes.
- Risk flags are lexical review cues, not a SQL parser or safety proof.
- The operator must still verify engine compatibility, transaction behavior, backup/rollback, permissions, locks, data volume, and environment-specific order.
Generate a manifest
Requires Ruby 2.6 or newer and only the standard library.
ruby scripts/release_sql_manifest.rb \
--repository /path/to/repository \
--base origin/main \
--head HEAD \
--output release-sql-manifest.json
If more than one SQL file is present, provide an exact order file containing one repository-relative path per line:
ruby scripts/release_sql_manifest.rb \
--repository . \
--base origin/main \
--head HEAD \
--order-file sql-order.txt
The command fails closed when refs are invalid, a changed SQL file is absent from the selected tree, order entries are missing or duplicated, or the order file does not exactly match the diff.
Review the output
- Confirm repository root and resolved base/head SHAs.
- Confirm the three-dot diff is the intended release comparison.
- Review every SQL path, byte count, SHA-256, and risk flag.
- Verify the declared order and its aggregate hash.
- Add engine-specific dry-run, migration, rollback, and runtime evidence outside this manifest.
- Bind release authorization to the exact manifest and head SHA.
Report PASS, FAIL, or BLOCKED with the exact comparison, manifest path or digest, and remaining database evidence gaps.
1---2name: release-sql-gate3description: Produce a deterministic manifest for SQL files changed between two Git refs, including exact order, SHA-256 hashes, and risk flags. Use before a release, deployment, migration handoff, or database runbook review; it inventories and validates SQL but never connects to a database or executes statements.4---56# Release SQL Gate78Turn a Git diff into a reviewable, immutable SQL release manifest without executing database changes.910## Boundaries1112- The helper is read-only with respect to Git and databases.13- It never connects to a database, applies SQL, deploys, commits, or pushes.14- Risk flags are lexical review cues, not a SQL parser or safety proof.15- The operator must still verify engine compatibility, transaction behavior, backup/rollback, permissions, locks, data volume, and environment-specific order.1617## Generate a manifest1819Requires Ruby 2.6 or newer and only the standard library.2021```bash22ruby scripts/release_sql_manifest.rb \23 --repository /path/to/repository \24 --base origin/main \25 --head HEAD \26 --output release-sql-manifest.json27```2829If more than one SQL file is present, provide an exact order file containing one repository-relative path per line:3031```bash32ruby scripts/release_sql_manifest.rb \33 --repository . \34 --base origin/main \35 --head HEAD \36 --order-file sql-order.txt37```3839The command fails closed when refs are invalid, a changed SQL file is absent from the selected tree, order entries are missing or duplicated, or the order file does not exactly match the diff.4041## Review the output42431. Confirm repository root and resolved base/head SHAs.442. Confirm the three-dot diff is the intended release comparison.453. Review every SQL path, byte count, SHA-256, and risk flag.464. Verify the declared order and its aggregate hash.475. Add engine-specific dry-run, migration, rollback, and runtime evidence outside this manifest.486. Bind release authorization to the exact manifest and head SHA.4950Report `PASS`, `FAIL`, or `BLOCKED` with the exact comparison, manifest path or digest, and remaining database evidence gaps.
levyflux