fix(strix): supply sibling SQL migrations as PR-scope context

[seonghobae]

문제

Strix 필수 게이트는 PR의 변경 파일만 스캔 스코프로 복사합니다(__PR_SCOPE__). 이전 마이그레이션이 만든 테이블을 ALTER/참조만 하는 마이그레이션 한 개가 바뀌면, 격리된 스코프에서는 그 테이블이 존재하지 않는 것처럼 보여 모델이 "relation/table does not exist" 유령 CRITICAL을 보고합니다. 이 finding의 PoC는 전적으로 스코프에서 제외된 파일(형제 마이그레이션)에 의존합니다.

재현

ContextualWisdomLab/gyeot#11 — 마이그레이션 변경은 0003_cbt_envelope.sql(ALTER TABLE momentary_response ...) 하나뿐인데, 테이블을 만드는 0001_init.sql/0002_auth.sql이 스코프 밖이라 **VULN-0005 CRITICAL(CVSS 9.1) "migration 0003 references a nonexistent base table"**가 떴습니다. 실제로는 3개 마이그레이션을 모두 적용하면 정상 부팅합니다(해당 repo의 test_server.sh가 Docker Postgres에서 PASS).

변경

pull_request_scope_context_files에 범용 규칙(프로젝트 전용 경로 하드코딩 없음)을 추가:

• 변경 파일이 */migrations/*.sql이면 그 마이그레이션 디렉토리를 수집하고,
• PR head에서 git ls-tree(읽기 전용)로 형제 .sql을 열거해 컨텍스트로 방출.

방출 경로는 기존 신뢰 PR-head 복사 경로를 그대로 타므로 비신뢰 콘텐츠·실행 비트가 유입되지 않습니다. 열거는 fail-open — head SHA가 없거나 유효하지 않으면 컨텍스트를 추가하지 않고 기존 changed-file 스캔에 영향이 없습니다. 게이트/심각도/신뢰 로직은 불변(추가만).

테스트

• 정적 어서션(신규 분기·열거·fail-open 문서화 확인) + 두 마이그레이션 디렉토리에서 두 번째만 변경 시 첫 마이그레이션이 컨텍스트에 포함되는 기능 테스트 추가.
• 로컬 검증: bash -n 통과, 함수 격리 실행에서 형제 마이그레이션 방출 확인, 신규 어서션 3/3 PASS.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the Strix quick gate’s PR-scope context selection so SQL migrations are scanned with their sibling migrations available as context, reducing false-positive “relation/table does not exist” findings when only a later migration is changed.

Changes:

• Extend pull_request_scope_context_files() to detect touched migrations/*.sql paths and emit sibling .sql files from the PR head for additional scan context.
• Add assertions and a functional self-test ensuring sibling migrations are enumerated and included when only a later migration is changed.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
scripts/ci/strix_quick_gate.sh	Collect touched migrations directories and enumerate sibling .sql files via git ls-tree for PR-scope scan context.
scripts/ci/test_strix_quick_gate.sh	Add static assertions + a functional regression test for sibling migration context emission.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

scripts/ci/strix_quick_gate.sh:1215

• The loop over sql_migration_dirs uses an unnecessary ${arr[@]+"${arr[@]}"} expansion without quoting the for list, which makes the code harder to reason about and can mis-handle directory names containing whitespace or glob characters. Since sql_migration_dirs is always initialized (local -a sql_migration_dirs=()), you can iterate safely with a normal quoted array expansion.

			local seen_migration_dir=0 known_migration_dir
			for known_migration_dir in ${sql_migration_dirs[@]+"${sql_migration_dirs[@]}"}; do
				if [ "$known_migration_dir" = "$migration_dir" ]; then

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

scripts/ci/strix_quick_gate.sh:1214

• The dedupe loop iterates over sql_migration_dirs using an unquoted parameter-expansion pattern. If a migrations directory path contains spaces (allowed by normalize_changed_file_path), word-splitting can break the equality check and lead to duplicate dirs or missed matches. Iterate over the array directly with proper quoting.

			local seen_migration_dir=0 known_migration_dir
			for known_migration_dir in ${sql_migration_dirs[@]+"${sql_migration_dirs[@]}"}; do

scripts/ci/strix_quick_gate.sh:1318

• git ls-tree output is affected by core.quotepath; for non-ASCII paths it may emit quoted/escaped names containing backslashes. Those paths will be rejected by normalize_changed_file_path later, silently dropping sibling migrations from context. Use -c core.quotepath=false here (as done elsewhere in this script) so paths are emitted verbatim.

				git ls-tree -r --name-only "$head_sha_for_migration_context" -- "$migration_context_dir/" 2>/dev/null |

scripts/ci/test_strix_quick_gate.sh:170

• This assertion hard-codes the git ls-tree invocation string. If the gate switches to git -c core.quotepath=false ls-tree ... (to avoid quoted/escaped paths), update this expected substring accordingly so the self-test continues to validate the behavior.

	assert_file_contains "$GATE_SCRIPT" "git ls-tree -r --name-only \"\$head_sha_for_migration_context\" -- \"\$migration_context_dir/\"" "strix gate enumerates sibling migrations from the PR head"

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.