CAP.PRESCAN.SIDE_EFFECT — Side effect in a migration

• Category: safety
• Level: 0
• Stability: stable
• Suites: lint

This migration would reach outside the database if it ran — a notification, an HTTP request, a queued job, a mail, a cache write. Pretend mode intercepts SQL and nothing else, so the PHP around it runs for real: a lint run that mailed a customer would be the worst thing this tool could do. The migration is reported and never pretend-executed.

This is not a claim that the effect is wrong — sending a notification is a fine thing for application code to do. It is a claim that a lint run must not be the thing that does it. Move the effect into a deploy step or a job the deploy dispatches, or capture the migration in shadow mode against a throwaway database.

Flagged

public function up(): void
{
    Schema::table('users', function (Blueprint $table): void {
        $table->string('plan')->default('free');
    });

    // A lint run would send this for real, to real people.
    Notification::send(User::all(), new PlanChanged);
}

Preferred

public function up(): void
{
    Schema::table('users', function (Blueprint $table): void {
        $table->string('plan')->default('free');
    });
}

// The announcement is a deploy step, not a schema change. It runs when
// the deploy says so, and a lint run cannot trigger it by looking.