Prevent release checks from consuming deployment input

scripts/check-database.sh

@@ -4,7 +4,8 @@ set -euo pipefail
 ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
 env_file=${1:-"$ROOT/.env"}
 
-"$ROOT/scripts/compose.sh" "$env_file" run --rm --no-deps migrate \
+"$ROOT/scripts/compose.sh" "$env_file" \
+  run --rm --no-deps --interactive=false migrate \
   /app/bin/who_need_help eval '
     Application.ensure_all_started(:ecto_sql)
     {:ok, _pid} = WhoNeedHelp.Repo.start_link()

scripts/production-release-drill.sh

@@ -57,11 +57,14 @@ printf 'environment=production\n' >"$backup.metadata"
 chmod 600 "$bundle" "$bundle.sha256" "$backup" "$backup.sha256" "$backup.metadata"
 
 for script in validate-production-env.sh check-environment-readiness.sh \
-  check-database.sh verify-realtime-cluster.sh verify-beam-runtime.sh; do
+  verify-realtime-cluster.sh verify-beam-runtime.sh; do
   install -m 755 /dev/null "$fixture/scripts/$script"
   printf '%s\n' '#!/bin/sh' 'exit 0' >"$fixture/scripts/$script"
 done
 
+install -m 755 "$ROOT/scripts/check-database.sh" \
+  "$fixture/scripts/check-database.sh"
+
 install -m 755 /dev/null "$fixture/scripts/set-deployment-revision.sh"
 cat >"$fixture/scripts/set-deployment-revision.sh" <<'EOF'
 #!/bin/sh
@@ -95,6 +98,15 @@ case "$*" in
     printf 'compose:%s\n' "$*" >>"$MOCK_COMMAND_LOG"
     exit 0
     ;;
+  'run --rm --no-deps --interactive=false migrate /app/bin/who_need_help eval '*)
+    printf 'compose:check-database-noninteractive\n' >>"$MOCK_COMMAND_LOG"
+    exit 0
+    ;;
+  'run --rm --no-deps migrate /app/bin/who_need_help eval '*)
+    cat >/dev/null
+    printf 'compose:check-database-consumed-stdin\n' >>"$MOCK_COMMAND_LOG"
+    exit 0
+    ;;
   'up -d --no-deps --no-build --force-recreate --wait app')
     printf 'compose:%s\n' "$*" >>"$MOCK_COMMAND_LOG"
     if [ "${MOCK_FAIL_APP_UP:-}" = once ] &&
@@ -213,7 +225,7 @@ run_release() {
     "${container_env[@]}" \
     "${container_mounts[@]}" \
     "$BASE_IMAGE" \
-    bash /runner/production-release-remote.sh \
+    bash -c 'bash -s -- "$@" < /runner/production-release-remote.sh' _ \
       apply "$remote_root" whoneedhelp.com \
       "$remote_root/output/releases/incoming/$(basename -- "$bundle")" \
       "$target_commit" \
@@ -230,6 +242,13 @@ grep -F 'compose:build migrate' "$fixture/mock-commands.log" >/dev/null
 grep -F 'compose:stop app' "$fixture/mock-commands.log" >/dev/null
 grep -F 'compose:run --rm --no-deps --interactive=false migrate' \
   "$fixture/mock-commands.log" >/dev/null
+grep -Fx 'compose:check-database-noninteractive' \
+  "$fixture/mock-commands.log" >/dev/null
+if grep -F 'compose:check-database-consumed-stdin' \
+  "$fixture/mock-commands.log" >/dev/null; then
+  echo "Database check consumed the streamed release script." >&2
+  exit 1
+fi
 grep -F 'compose:up -d --no-deps --no-build --force-recreate --wait app' \
   "$fixture/mock-commands.log" >/dev/null
 grep -R -F 'migration_policy=forward_only' \

scripts/production-release-remote.sh

@@ -354,7 +354,7 @@ fi
 migration_started=true
 "$root/scripts/compose.sh" "$env_file" \
   run --rm --no-deps --interactive=false migrate
-"$root/scripts/check-database.sh" "$env_file"
+"$root/scripts/check-database.sh" "$env_file" </dev/null
 "$root/scripts/compose.sh" "$env_file" \
   up -d --no-deps --no-build --force-recreate --wait "${runtime_services[@]}"
 verify_candidate_runtime