Files
Félix Malfait 0baa333809 feat(lint): forbid data mutations in fast instance command up() (#21547)
## Why

Fast instance commands run in the ArgoCD **PreSync** hook, before the
new pods roll. A bulk `UPDATE`/`INSERT`/`DELETE` held in the **same
transaction** as an `ADD COLUMN`/`ALTER` keeps an `ACCESS EXCLUSIVE`
lock on the table for the whole write, blocking every read of it. That
is what froze prod during the 2.13 `isUIReadOnly → isUIEditable` rename
— a bulk `UPDATE "fieldMetadata"` inside the same `up()` transaction as
the `ADD COLUMN`s → read timeouts → failed PreSync → aborted sync.

@charlesBochet already caught this exact pattern by hand on #21527
("data migration => make a slow instance command :)"). This turns that
manual review into something CI enforces.

## What

New oxlint rule **`twenty/no-data-mutation-in-fast-instance-command`**:
- Flags statement-leading `UPDATE`/`INSERT`/`DELETE`/`MERGE` passed to
`.query(...)` **inside `up()`** of a `*-instance-command-fast-*` file.
- Allows: schema DDL (`ALTER`/`CREATE`/`DROP`); `ON DELETE CASCADE` / a
column named `updatedAt` (not statement-leading, so never matched);
rollback DML in `down()`; and data migrations in **slow** commands'
`runDataMigration()`.
- The error message points the author straight at the slow-command
pattern.

Enabled as `error` in `twenty-server`.

## Grandfathering

Scoping to `up()` means **only one** existing file violates the rule:
the already-shipped 2.13 rename command. It's recorded complete in cloud
and must not be rewritten, so it's grandfathered with a documented
file-level `oxlint-disable` (the comment makes clear it's an exception,
not a precedent). The four other fast commands that contain DML keep
theirs in `down()` and are correctly unaffected.

## Tests

- 9 RuleTester cases — valid: DDL, FK cascade, `updatedAt`, `down()`
DML, slow-command DML, non-upgrade files; invalid:
`UPDATE`/`INSERT`/`DELETE` in `up()`.
- Verified end-to-end with oxlint: a throwaway violating file → 1 error;
all 141 upgrade-command files → 0 errors; full oxlint-rules suite
225/225; typecheck clean.

Part of the v2.13 deploy post-mortem follow-ups.

https://claude.ai/code/session_013Az1etaGyxWRRVhgjhPWeB

---
_Generated by [Claude
Code](https://claude.ai/code/session_013Az1etaGyxWRRVhgjhPWeB)_

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21547?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-06-14 20:44:54 +02:00

118 lines
3.5 KiB
JSON

{
"$schema": "./node_modules/oxlint/configuration_schema.json",
"plugins": ["typescript", "import", "unicorn"],
"jsPlugins": ["../twenty-oxlint-rules/dist/oxlint-plugin.mjs"],
"options": {
"typeAware": true
},
"categories": {
"correctness": "off"
},
"ignorePatterns": [
"node_modules",
"dist",
".local-storage",
"src/engine/workspace-manager/dev-seeder/data/constants/**",
"src/engine/workspace-manager/dev-seeder/data/seeds/**",
"src/utils/email-providers.ts",
"src/engine/core-modules/i18n/locales/generated/**",
"src/engine/core-modules/logic-function/logic-function-resource/constants/seed-project/src/index.ts",
"src/engine/metadata-modules/front-component/constants/seed-project/**",
"src/engine/core-modules/upgrade/constants/twenty-current-version.constant.ts",
"src/engine/core-modules/upgrade/constants/twenty-previous-versions.constant.ts",
"src/engine/core-modules/upgrade/constants/twenty-next-versions.constant.ts"
],
"rules": {
"func-style": ["error", "declaration", { "allowArrowFunctions": true }],
"no-console": [
"warn",
{ "allow": ["group", "groupCollapsed", "groupEnd"] }
],
"no-control-regex": "off",
"no-debugger": "error",
"no-duplicate-imports": "error",
"no-undef": "off",
"no-unused-vars": "off",
"no-redeclare": "off",
"no-restricted-imports": [
"error",
{
"patterns": [
{
"group": ["**../"],
"message": "Relative imports are not allowed."
},
{
"group": ["lodash"],
"message": "Please use the standalone lodash package (for instance: `import groupBy from 'lodash.groupby'` instead of `import { groupBy } from 'lodash'`)"
}
]
}
],
"import/no-duplicates": "error",
"typescript/no-redeclare": "error",
"typescript/ban-ts-comment": "error",
"typescript/consistent-type-imports": "off",
"typescript/explicit-function-return-type": "off",
"typescript/explicit-module-boundary-types": "off",
"typescript/no-empty-object-type": [
"error",
{
"allowInterfaces": "with-single-extends"
}
],
"typescript/no-empty-function": "off",
"typescript/no-explicit-any": "warn",
"typescript/no-floating-promises": "error",
"typescript/no-misused-promises": "error",
"typescript/no-unused-vars": [
"warn",
{
"vars": "all",
"varsIgnorePattern": "^_",
"args": "after-used",
"argsIgnorePattern": "^_"
}
],
"twenty/inject-workspace-repository": "warn",
"twenty/prefer-workspace-scoped-repository": "error",
"twenty/rest-api-methods-should-be-guarded": "error",
"twenty/graphql-resolvers-should-be-guarded": "error",
"twenty/upgrade-command-filename": "error",
"twenty/no-data-mutation-in-fast-instance-command": "error",
"twenty/enforce-module-boundaries": [
"error",
{
"depConstraints": [
{
"sourceTag": "scope:backend",
"onlyDependOnLibsWithTags": ["scope:shared", "scope:backend"]
}
]
}
]
},
"overrides": [
{
"files": [
"**/*.spec.ts",
"**/*.integration-spec.ts",
"**/__tests__/**",
"**/test/**"
],
"rules": {
"typescript/no-explicit-any": "off"
}
},
{
"files": ["**/constants/*.ts", "**/*.constants.ts"],
"rules": {
"twenty/max-consts-per-file": "off"
}
}
]
}