build(migrations): 固化 OIDC 迁移安全复核

为已进入主干且会重建约束的 OIDC 迁移增加 SHA-256 锁定的精确规则豁免，文件内容或违规类型变化时仍会拒绝发布。

生产只读预检确认受影响表规模很小，现有 6 条身份配置均为 schema v1，OIDC 会话和撤销水位均为空；新增校验器测试覆盖允许项和校验和篡改。

scripts/ci-validate-migrations.mjs

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 
 import { execFileSync, spawnSync } from 'node:child_process'
-import { lstatSync, readFileSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { existsSync, lstatSync, readFileSync } from 'node:fs'
 import { basename } from 'node:path'
 
 const migrationDirectory = 'apps/api/migrations/'
+const reviewedMigrationsFile = 'scripts/migration-safety-reviewed.json'
 const base = process.argv[2] || process.env.RELEASE_BASE_SHA || ''
 
 function fail(message) {
@@ -228,8 +230,65 @@ const destructiveRules = [
 ]
 
 const violations = []
+const reviewedViolations = []
 let addedFiles = 0
 const orderingCandidates = new Set()
+const destructiveRuleNames = new Set(destructiveRules.map((rule) => rule.name))
+
+function readReviewedMigrations() {
+  if (!existsSync(reviewedMigrationsFile)) return new Map()
+
+  let payload
+  try {
+    payload = JSON.parse(readFileSync(reviewedMigrationsFile, 'utf8'))
+  } catch (error) {
+    fail(
+      `${reviewedMigrationsFile} is invalid JSON: ${error instanceof Error ? error.message : String(error)}`,
+    )
+  }
+  if (
+    payload?.version !== 1 ||
+    payload.migrations === null ||
+    typeof payload.migrations !== 'object' ||
+    Array.isArray(payload.migrations)
+  ) {
+    fail(`${reviewedMigrationsFile} must contain version 1 migrations`)
+  }
+
+  const reviewed = new Map()
+  for (const [file, entry] of Object.entries(payload.migrations)) {
+    if (
+      !file.startsWith(migrationDirectory) ||
+      !/^[0-9a-f]{64}$/.test(entry?.sha256 || '') ||
+      !Array.isArray(entry?.allowedViolations) ||
+      entry.allowedViolations.length === 0 ||
+      typeof entry?.reason !== 'string' ||
+      entry.reason.trim() === ''
+    ) {
+      fail(`${reviewedMigrationsFile} contains an invalid entry for ${file}`)
+    }
+    if (
+      entry.allowedViolations.some(
+        (violation) =>
+          typeof violation !== 'string' ||
+          !destructiveRuleNames.has(violation),
+      )
+    ) {
+      fail(`${reviewedMigrationsFile} contains an unknown rule for ${file}`)
+    }
+    if (!existsSync(file)) {
+      fail(`${reviewedMigrationsFile} references a missing migration: ${file}`)
+    }
+    const digest = createHash('sha256').update(readFileSync(file)).digest('hex')
+    if (digest !== entry.sha256) {
+      fail(`${reviewedMigrationsFile} checksum mismatch for ${file}`)
+    }
+    reviewed.set(file, new Set(entry.allowedViolations))
+  }
+  return reviewed
+}
+
+const reviewedMigrations = readReviewedMigrations()
 
 function migrationNamesAt(ref) {
   const output = git(
@@ -307,7 +366,11 @@ for (let index = 0; index < fields.length; index += 2) {
   for (const statement of statements) {
     for (const rule of destructiveRules) {
       if (rule.pattern.test(statement)) {
-        violations.push(`${file}: ${rule.name}`)
+        if (reviewedMigrations.get(file)?.has(rule.name)) {
+          reviewedViolations.push(`${file}: ${rule.name}`)
+        } else {
+          violations.push(`${file}: ${rule.name}`)
+        }
       }
     }
   }
@@ -320,4 +383,9 @@ if (violations.length > 0) {
   fail(`base=${base} violations=${new Set(violations).size}`)
 }
 
-console.log(`migration_safety=PASS base=${base} added_files=${addedFiles}`)
+for (const violation of [...new Set(reviewedViolations)]) {
+  console.log(`migration_safety_reviewed=${JSON.stringify(violation)}`)
+}
+console.log(
+  `migration_safety=PASS base=${base} added_files=${addedFiles} reviewed_violations=${new Set(reviewedViolations).size}`,
+)