Gate and review migration scripts - #5469
Open
aasaa444 wants to merge 1 commit into
Open
Conversation
Author
|
@dotnet-policy-service agree |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The TOC is malformed, and the pipeline references an invalid download target and a bundle it never creates.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds guidance for reviewing and gating EF Core migration scripts in deployment pipelines.
Changes:
- Adds Azure DevOps pipeline and approval examples.
- Documents forward, rollback, and idempotent scripts.
- Compares scripts with migration bundles.
File summaries
| File | Description |
|---|---|
entity-framework/toc.yml |
Adds the new migration guidance to navigation. |
entity-framework/core/managing-schemas/migrations/review-gates.md |
Introduces migration review, rollback, and deployment guidance. |
Review details
Suppressed comments (2)
entity-framework/core/managing-schemas/migrations/review-gates.md:79
- This repeats the unsupported
Latestsentinel, so the documented rollback command fails for normal migration names. Use the same concrete newer and older migration identifiers as the paired example above.
dotnet ef migrations script Latest PreviousMigration -o artifacts/rollback.sql
entity-framework/core/managing-schemas/migrations/review-gates.md:76
- This repeats the forward-only inclusion rule for a rollback range. When
fromis newer thanto, the generated script runsDownfor the newerfrommigration and leaves thetomigration applied, so describe the arguments as starting and target states instead.
A forward script without a tested rollback script is only half the artifact. For every `apply.sql`, generate the matching rollback with `migrations script <from> <to>` (from is excluded, to is included):
- Files reviewed: 2/2 changed files
- Comments generated: 8
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+30
to
+31
| dotnet ef migrations script PreviousMigration Latest -o artifacts/apply.sql | ||
| dotnet ef migrations script Latest PreviousMigration -o artifacts/rollback.sql |
| jobs: | ||
| - job: build | ||
| steps: | ||
| - script: dotnet ef migrations script --idempotent -o $(Build.ArtifactStagingDirectory)/migrate.sql |
Comment on lines
+68
to
+69
| - download: sql | ||
| - script: dotnet $(System.ArtifactsDirectory)/sql/MigrationsBundle.dll --connection "$(ProdConnectionString)" |
|
|
||
| ## Generate scripts for review | ||
|
|
||
| An idempotent script can be applied to a database at any migration level and skips migrations that have already been applied. Generate it as a build artifact so reviewers always see the full pending SQL: |
| dotnet ef migrations script --idempotent -o artifacts/migrate.sql | ||
| ``` | ||
|
|
||
| For a single deployment, a versioned pair of scripts is often easier to review. The `from` migration is excluded, the `to` migration is included. These commands generate the forward script for the latest migration and the script that undoes it: |
| dotnet ef migrations script Latest PreviousMigration -o artifacts/rollback.sql | ||
| ``` | ||
|
|
||
| Test the rollback the same way the forward script is tested: apply it to a copy of the production schema, and check that the schema and data end up in the expected state. Store both scripts together so reviewers see them side by side. |
|
|
||
| ## Scripts or bundles | ||
|
|
||
| [Migration bundles](applying.md#bundles) are the right artifact when deployments are automated end to end. Plain scripts are the right artifact when the SQL must be reviewed, signed off, or handed to a DBA. A gated deployment usually needs both: the script for the review gate, and a bundle built from the same migration for the deployment itself. |
| ms.date: 09/04/2026 | ||
| uid: core/managing-schemas/migrations/review-gates | ||
| --- | ||
| # Gate and review migration scripts |
Member
There was a problem hiding this comment.
Move this to core/managing-schemas/migrations/teams.md
Per AndriySvyryd's review: the gated review and rollback workflow belongs in teams.md rather than a standalone page. Documents the idempotent script review gate with provider caveats, an Azure DevOps approvals example that deploys the reviewed script, and rollback script generation with the data-loss warning. Closes dotnet#3515
aasaa444
force-pushed
the
review-gates-docs
branch
from
September 13, 2026 17:03
e89de5f to
a4f9563
Compare
Author
|
Thanks for the review, @AndriySvyryd. Moved the gating and rollback guidance into teams.md as you suggested, and removed the standalone page with its TOC entry. Also fixed what Copilot flagged on the old version:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #3515
Adds a page under the migrations section covering how to gate EF Core migration scripts in a deployment pipeline:
dotnet ef migrations script --idempotent);migrations script <from> <to>and testing them against a copy of the production schema;The workflow described is the one I run in production (EF Core 10 on SQL Server, gated SQL review, rollback scripts generated per migration).