fix(db): forward force flags for local and dev schema pushes

Author: icecrasher321

.github/CONTRIBUTING.md

@@ -254,7 +254,7 @@ If you prefer not to use Docker. **All commands run from the repository root unl
    cd packages/db && bun run db:migrate && cd ../..
    ```
 
-   For ad-hoc schema iteration during development you can also use `bun run db:push` from `packages/db`, but `db:migrate` is the canonical command for both local and CI/CD setups.
+   For ad-hoc schema iteration during development you can also use `bun run db:push` from `packages/db`, but `db:migrate` is the canonical command for staging and production. `db:push` reconciles directly to the current schema without running versioned migration guards or backfills. For disposable local/dev databases, `bun run db:push --force` accepts Drizzle's data-loss prompts, including column drops.
 
 4. **Run the Development Servers:**
 

.github/workflows/migrations.yml

@@ -71,6 +71,8 @@ jobs:
 
           if [ "${ENVIRONMENT}" = "dev" ]; then
             echo "Dev environment — pushing schema directly (db:push)"
+            # Dev deliberately forces direct schema reconciliation; staging and
+            # production use guarded versioned migrations in the other branch.
             # drizzle-kit push needs a TTY to resolve ambiguous renames (--force only
             # covers data-loss). In CI it throws "Interactive prompts require a TTY
             # terminal" but still exits 0, so the job goes green without applying the

packages/db/package.json

@@ -28,7 +28,7 @@
   },
   "scripts": {
     "db:generate": "bunx drizzle-kit generate --config=./drizzle.config.ts",
-    "db:push": "bunx drizzle-kit push --config=./drizzle.config.ts && bun --env-file=.env run ./scripts/reconcile-credential-group-resource-policies.ts && bun --env-file=.env run ./scripts/reconcile-oauth-provider.ts && bun --env-file=.env run ./script-migrations/0016_backfill_search_vectors.ts",
+    "db:push": "bun --env-file=.env run ./scripts/push.ts",
     "db:migrate": "bun --env-file=.env run ./scripts/migrate.ts",
     "db:reconcile-fork-kb-file-ownership": "bun --env-file=.env run ./scripts/reconcile-fork-kb-file-ownership.ts",
     "db:reconcile-workspace-storage": "bun --env-file=.env run ./scripts/reconcile-workspace-storage.ts",

packages/db/script-migrations/0010_backfill_credential_group_resource_policies.test.ts

@@ -358,9 +358,9 @@ describe('Credential Group resource policy lifecycle', () => {
 
     expect(migration).toContain('CREATE TABLE "resource_policy"')
     expect(migration).not.toContain('credential_group_resource_policy_lifecycle')
-    expect(packageJson.scripts['db:push']).toContain(
-      'scripts/reconcile-credential-group-resource-policies.ts'
-    )
+    expect(packageJson.scripts['db:push']).toContain('scripts/push.ts')
+    const pushSource = await readFile(new URL('../scripts/push.ts', import.meta.url), 'utf8')
+    expect(pushSource).toContain('scripts/reconcile-credential-group-resource-policies.ts')
     expect(helperSource).not.toContain('LegacyResourcePolicy')
     expect(helperSource).not.toContain("document ? 'grants'")
   })

packages/db/scripts/push.ts

@@ -0,0 +1,13 @@
+/** Forward push flags to Drizzle before running the schema reconciliation steps. */
+const commands = [
+  ['bunx', 'drizzle-kit', 'push', '--config=./drizzle.config.ts', ...process.argv.slice(2)],
+  ['bun', '--env-file=.env', 'run', './scripts/reconcile-credential-group-resource-policies.ts'],
+  ['bun', '--env-file=.env', 'run', './scripts/reconcile-oauth-provider.ts'],
+  ['bun', '--env-file=.env', 'run', './script-migrations/0016_backfill_search_vectors.ts'],
+]
+
+for (const command of commands) {
+  const child = Bun.spawn(command, { stdin: 'inherit', stdout: 'inherit', stderr: 'inherit' })
+  const exitCode = await child.exited
+  if (exitCode !== 0) process.exit(exitCode)
+}