From 04b64d1dd225d1273cd261be293e9558306d4c48 Mon Sep 17 00:00:00 2001
From: Marcus Pasell <3690498+rickyrombo@users.noreply.github.com>
Date: Mon, 18 May 2026 23:58:06 -0700
Subject: [PATCH] fix(migrations): propagate pg_migrate.sh failure to exit code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `migrate` subcommand (and every other binary entrypoint) called
ddl.RunMigrations() and discarded its returned error, so when
pg_migrate.sh exited non-zero the process still reached os.Exit(0) in
the switch's `case "migrate":` arm.

This silently broke the K8s migration Job's success contract: a failed
migration ended in a successful-looking pod, the Job flipped to
condition=Complete, the dependent serving Deployments' DependsOn
unblocked, and pods rolled out against a half-migrated DB.

Discovered today (2026-05-19) when a manually-killed 0201 backfill exited
2 but the bridge Deployment rolled anyway. The k8s/Pulumi side was
behaving correctly given the inputs it got — the API binary was just
reporting success on failure.

Check the error and os.Exit(1) at the migration site, before the switch.
Affects every command (server, indexer, es-indexer, solana-indexer,
migrate) — none of them should run against a half-migrated DB.
---
 main.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/main.go b/main.go
index 7c35268e..ca551b87 100644
--- a/main.go
+++ b/main.go
@@ -27,7 +27,10 @@ func main() {
 		fmt.Println("Skipping migrations. Set env runMigrations=true to run.")
 	} else {
 		fmt.Println("Running migrations...")
-		ddl.RunMigrations()
+		if err := ddl.RunMigrations(); err != nil {
+			fmt.Println("migration failed:", err)
+			os.Exit(1)
+		}
 	}
 
 	switch command {