feat(webapp): CI guard for unindexed onDelete cascade FK columns

A relation with onDelete Cascade/SetNull whose child FK column has no index
makes every parent delete fire a cascade that sequentially scans the whole
child table. This shipped three times recently (ProjectAlert.channelId,
EnvironmentVariableValue.valueReferenceId, PersonalAccessToken.userId).

Adds a schema-aware guard (modeled on runOpsLegacyGuard) that parses both
Prisma schemas and flags any cascade/SetNull FK whose leading scalar is not
the leading column of an index. Whether a missing index is a live bug depends
on whether the parent is hard- or soft-deleted, which is not in the schema, so
the guard carries a baseline of the 72 currently-accepted cases and only fails
--check on new un-baselined violations. Wired into pr_checks as fk-cascade-guard.

Author: ericallam

.github/workflows/fk-cascade-guard.yml

@@ -0,0 +1,35 @@
+name: "🛡️ FK Cascade Index Guard"
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  fk-cascade-guard:
+    runs-on: warp-ubuntu-latest-x64-16x
+
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: ⎔ Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.33.2
+
+      - name: ⎔ Setup node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24.18.0
+          cache: "pnpm"
+
+      - name: 📥 Download deps
+        run: pnpm install --frozen-lockfile
+
+      - name: 🛡️ FK cascade index guard
+        run: pnpm --filter webapp run guard:fk-cascade-index -- --check

.github/workflows/pr_checks.yml

@@ -58,6 +58,7 @@ jobs:
               - '.github/workflows/unit-tests-webapp.yml'
               - '.github/workflows/e2e-webapp.yml'
               - '.github/workflows/runops-guard.yml'
+              - '.github/workflows/fk-cascade-guard.yml'
               - '.configs/**'
               - 'package.json'
               - 'pnpm-lock.yaml'
@@ -150,6 +151,11 @@ jobs:
     if: needs.changes.outputs.webapp == 'true'
     uses: ./.github/workflows/runops-guard.yml
 
+  fk-cascade-guard:
+    needs: changes
+    if: needs.changes.outputs.webapp == 'true'
+    uses: ./.github/workflows/fk-cascade-guard.yml
+
   webapp:
     needs: changes
     if: needs.changes.outputs.webapp == 'true'
@@ -206,6 +212,7 @@ jobs:
       - code-quality
       - typecheck
       - runops-guard
+      - fk-cascade-guard
       - webapp
       - e2e-webapp
       - packages

apps/webapp/package.json

@@ -17,6 +17,7 @@
     "start:local": "cross-env node --max-old-space-size=8192 ./build/server.js",
     "typecheck": "cross-env NODE_OPTIONS=\"--max-old-space-size=8192\" tsc --noEmit -p ./tsconfig.check.json",
     "guard:runops-legacy": "cross-env NODE_OPTIONS=\"--max-old-space-size=8192\" tsx ./scripts/runOpsLegacyGuard.ts",
+    "guard:fk-cascade-index": "tsx ./scripts/fkCascadeIndexGuard.ts",
     "db:seed": "tsx seed.ts",
     "db:seed:ai-spans": "tsx seed-ai-spans.mts",
     "db:seed:queue-metrics": "tsx seed-queue-metrics.mts",