add script to check for migration order (#7803)

Related to #6142, this adds a CI check for the order of migrations.

As I noted in a comment on the workflow file, it's important to keep in mind that some migrations might still go unnoticed even with this check, example:

1. PR1 adds a migration, CI check pass
2. PR2 adds a migration, CI pass, gets merged
3. PR1 can still be merged because the CI checks aren't run again

The check will fail in `main` however, so if we find the current script to be reliable, we could setup a Slack ping or something similar, to make sure somebody takes a look

.github/workflows/test-db-changes.yml

@@ -0,0 +1,75 @@
+name: Test DB Changes
+
+on:
+  push:
+    branches:
+      - main
+      - patch-*
+  pull_request:
+    paths:
+      - 'server/datastore/mysql/schema.sql'
+      - 'server/datastore/mysql/migrations/**.go'
+      - '.github/workflows/test-schema-changes.yml'
+  workflow_dispatch: # Manual
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
+    shell: bash
+
+jobs:
+  test-db-changes:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Install Go
+      uses: actions/setup-go@84cbf8094393cdc5fe1fe1671ff2647332956b1a # v2
+      with:
+        go-version: '^1.19.1'
+    - name: Checkout Code
+      uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
+      with:
+        fetch-depth: 0
+
+    - name: Start Infra Dependencies
+      # Use & to background this
+      run: docker-compose up -d mysql_test &
+
+    - name: Verify test schema changes
+      run: |
+        make dump-test-schema
+        if [[ $(git diff server/datastore/mysql/schema.sql) ]]; then
+          echo "❌ fail: uncommited changes in schema.sql"
+          echo "please run `make dump-test-schema` and commit the changes"
+          exit 1
+        fi
+
+    # TODO: This doesn't cover all scenarios since other PRs might
+    # be merged into `main` after this check has passed.
+    #
+    # We should add a Slack notification or something similar for
+    # when this check fails on `main`.
+    - name: Check migration order
+      run: |
+        # if the workflow is run during a push event (on merges to main and
+        # tags,) use the latest created tag as a reference
+        base_ref=origin/${{github.base_ref}}
+        if [ "${{github.event_name}}" == "push" ]; then
+          base_ref=$(git tag --list "fleet-v*" --sort=-creatordate | head -n 1)
+        fi
+
+        all_migrations=($(ls server/datastore/mysql/migrations/tables/20*_*.go | sort -r))
+        new_migrations=($(git diff --name-only $base_ref -- server/datastore/mysql/migrations/tables/20*_*.go | sort -r))
+
+        index=0
+        for migration in "${new_migrations[@]}"; do
+          if [ "$migration" != "${all_migrations[$index]}" ]; then
+            echo "❌ fail: $migration has an older timestamp than ${all_migrations[$index]}"
+            echo "this might cause problems if this change is merged"
+            echo "please update the timestamp of $migration"
+            exit 1
+          fi
+          index=$((index+1))
+        done

.github/workflows/test-schema-changes.yml

@@ -1,48 +0,0 @@
-name: Schema Change Tests
-
-on:
-  push:
-    branches:
-      - main
-      - patch-*
-  pull_request:
-    paths:
-      - 'server/datastore/mysql/schema.sql'
-      - 'server/datastore/mysql/migrations/**.go'
-      - '.github/workflows/test-schema-changes.yml'
-  workflow_dispatch: # Manual
-
-defaults:
-  run:
-    # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
-    shell: bash
-
-permissions:
-  contents: read
-
-jobs:
-  test-schema-changes:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Install Go
-      uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # v2
-      with:
-        go-version: '^1.19.1'
-    - name: Checkout Code
-      uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
-
-    - name: Start Infra Dependencies
-      # Use & to background this
-      run: docker-compose up -d mysql_test &
-
-    - name: Dump test schema
-      run: make dump-test-schema
-
-    - name: Verify changes
-      run: |
-        if [[ $(git diff server/datastore/mysql/schema.sql) ]]; then
-          echo "❌ fail: uncommited changes in schema.sql"
-          echo "please run make dump-test-schema and commit the changes"
-          exit 1
-        fi
-