chore(api): Prohibit new direct SQLAlchemy in controller

[cqjjjzr]

Important

1. Make sure you have read our contribution guidelines
2. Ensure there is an associated issue and you have been assigned to it
3. Use the correct syntax to link this PR: Fixes #<issue number>.

Summary

No issue

This extracts the common pattern for ast-grep based lints, and adds a script with CI guard to prevent new directly SQLAlchemy code in controllers.

Checklist

• This change requires a documentation update, included: Dify Document
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.
• I ran make lint && make type-check (backend) and cd web && pnpm exec vp staged (frontend) to appease the lint gods

[Copilot]

Pull request overview

Adds an ast-grep–based CI guard to prevent introducing new direct SQLAlchemy usage in api/controllers, while also extracting shared “net-new violation” logic into a reusable helper module for similar lints.

Changes:

• Introduces a shared scripts/ast_grep_guard.py module and refactors check_no_new_getattr.py to use it.
• Adds a new controller-focused guard (check_no_new_controller_sqlalchemy.py) plus a full-tree inventory scanner (lint_controller_sqlalchemy.py).
• Wires the new guard/rules into existing GitHub Actions workflows.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/ast_grep_guard.py	Adds shared diff/hunk parsing + ast-grep execution utilities for “net-new” lint guards.
scripts/check_no_new_getattr.py	Refactors the getattr guard to use the shared helper API.
scripts/check_no_new_controller_sqlalchemy.py	New CI guard to block net-new direct SQLAlchemy usage in controllers (with allow/suppress logic).
scripts/lint_controller_sqlalchemy.py	New report/inventory script to enumerate direct SQLAlchemy patterns in controller code.
scripts/ast_grep_rules/no_new_controller_sqlalchemy.yml	New ast-grep rule defining what “direct SQLAlchemy usage” matches.
.github/workflows/style.yml	Runs the new controller SQLAlchemy guard in the style workflow when relevant files change.
.github/workflows/main-ci.yml	Ensures CI considers the new guard/rule files as “api” changes for workflow filtering.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Pyrefly Type Coverage

Metric	Base	PR	Delta
Type coverage	52.64%	52.64%	0.00%
Strict coverage	52.16%	52.16%	0.00%
Typed symbols	32,618	32,618	0
Untyped symbols	29,619	29,619	0
Modules	2986	2986	0