From 09efc1615da6e6cf0b1490a8a3de9637277be0df Mon Sep 17 00:00:00 2001
From: 732642856 <732642856@qq.com>
Date: Mon, 20 Jul 2026 02:55:18 +0800
Subject: [PATCH] fix: correct production migration manifest

---
 .../workflows/apply-supabase-profile-migrations.yml    |  8 ++++----
 tests/test_supabase_profile_migration_workflow.py      | 10 ++++++++--
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/apply-supabase-profile-migrations.yml b/.github/workflows/apply-supabase-profile-migrations.yml
index 108fa767..96ac8053 100644
--- a/.github/workflows/apply-supabase-profile-migrations.yml
+++ b/.github/workflows/apply-supabase-profile-migrations.yml
@@ -39,12 +39,12 @@ jobs:
           RSYNC_SSH="ssh $SSH_OPTIONS"
           ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" "install -m 700 -d '$DEPLOY_PATH/tmp/profile-migrations'"
           rsync -az -e "$RSYNC_SSH" \
-            frontend/supabase/migrations/20260718010000_recover_missing_profile_rows.sql \
-            frontend/supabase/migrations/20260718020000_profiles_service_role_upsert_grants.sql \
             frontend/supabase/migrations/20260718050000_profiles_service_role_upsert_grants.sql \
+            frontend/supabase/migrations/20260718060000_profiles_service_role_least_privilege.sql \
             frontend/supabase/migrations/20260718070000_profiles_service_role_upsert_id.sql \
             frontend/supabase/migrations/20260718080000_profiles_service_role_account_upsert_selects.sql \
             frontend/supabase/migrations/20260718100000_repair_missing_chart_profiles.sql \
+            frontend/supabase/migrations/20260718102000_recover_missing_profile_rows.sql \
             frontend/supabase/migrations/20260718103000_profile_birth_time_declaration_grants.sql \
             "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/tmp/profile-migrations/"
 
@@ -68,12 +68,12 @@ jobs:
             exit 1
           fi
           for SQL_FILE in \
-            tmp/profile-migrations/20260718010000_recover_missing_profile_rows.sql \
-            tmp/profile-migrations/20260718020000_profiles_service_role_upsert_grants.sql \
             tmp/profile-migrations/20260718050000_profiles_service_role_upsert_grants.sql \
+            tmp/profile-migrations/20260718060000_profiles_service_role_least_privilege.sql \
             tmp/profile-migrations/20260718070000_profiles_service_role_upsert_id.sql \
             tmp/profile-migrations/20260718080000_profiles_service_role_account_upsert_selects.sql \
             tmp/profile-migrations/20260718100000_repair_missing_chart_profiles.sql \
+            tmp/profile-migrations/20260718102000_recover_missing_profile_rows.sql \
             tmp/profile-migrations/20260718103000_profile_birth_time_declaration_grants.sql
           do
             echo "applying $(basename "$SQL_FILE")"
diff --git a/tests/test_supabase_profile_migration_workflow.py b/tests/test_supabase_profile_migration_workflow.py
index f951cc80..a7840760 100644
--- a/tests/test_supabase_profile_migration_workflow.py
+++ b/tests/test_supabase_profile_migration_workflow.py
@@ -20,10 +20,16 @@ def test_profile_migration_workflow_is_manual_and_uses_vps_env_without_printing_
 def test_profile_migration_workflow_includes_chart_library_and_birth_time_profile_migrations() -> None:
     text = WORKFLOW.read_text(encoding="utf-8")
 
-    assert "20260718010000_recover_missing_profile_rows.sql" in text
-    assert "20260718020000_profiles_service_role_upsert_grants.sql" in text
     assert "20260718050000_profiles_service_role_upsert_grants.sql" in text
+    assert "20260718060000_profiles_service_role_least_privilege.sql" in text
     assert "20260718070000_profiles_service_role_upsert_id.sql" in text
     assert "20260718080000_profiles_service_role_account_upsert_selects.sql" in text
     assert "20260718100000_repair_missing_chart_profiles.sql" in text
+    assert "20260718102000_recover_missing_profile_rows.sql" in text
     assert "20260718103000_profile_birth_time_declaration_grants.sql" in text
+
+
+def test_profile_migration_workflow_does_not_reference_missing_sql_files() -> None:
+    text = WORKFLOW.read_text(encoding="utf-8")
+    assert "20260718010000_recover_missing_profile_rows.sql" not in text
+    assert "20260718020000_profiles_service_role_upsert_grants.sql" not in text