upgrade: Catch "upgrade" attempts which would downgrade the database.

Attempting to "upgrade" from `main` to 4.x should abort; Django does
not prevent running old code against the new database (though it
likely errors at runtime), and `./manage.py migrate` from the old
version during the "upgrade" does not downgrade the database, since
the migrations are entirely missing in that directory, so don't get
reversed.

Compare the list of applied migrations to the list of on-disk
migrations, and abort if there are applied migrations which are not
found on disk.

Fixes: #19284.

scripts/lib/check-database-compatibility.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+import logging
+import os
+import sys
+
+ZULIP_PATH = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+sys.path.insert(0, ZULIP_PATH)
+from scripts.lib.setup_path import setup_path
+from scripts.lib.zulip_tools import DEPLOYMENTS_DIR, assert_not_running_as_root, parse_version_from
+from version import ZULIP_VERSION as new_version
+
+assert_not_running_as_root()
+setup_path()
+os.environ["DJANGO_SETTINGS_MODULE"] = "zproject.settings"
+
+import django
+from django.db import connection
+from django.db.migrations.loader import MigrationLoader
+
+django.setup()
+loader = MigrationLoader(connection)
+missing = set(loader.applied_migrations)
+for key, migration in loader.disk_migrations.items():
+    missing.discard(key)
+    missing.difference_update(migration.replaces)
+if not missing:
+    sys.exit(0)
+
+current_version = parse_version_from(os.path.join(DEPLOYMENTS_DIR, "current"))
+logging.error(
+    "This is not an upgrade -- the current deployment (version %s) "
+    "contains database migrations which %s (version %s) does not.",
+    current_version,
+    len(missing),
+    ZULIP_PATH,
+    new_version,
+)
+sys.exit(1)

scripts/lib/upgrade-zulip-stage-2

@@ -81,6 +81,11 @@ parser = argparse.ArgumentParser(parents=[restart_parser])
 parser.add_argument("deploy_path", metavar="deploy_path", help="Path to deployment directory")
 parser.add_argument("--skip-puppet", action="store_true", help="Skip doing puppet/apt upgrades.")
 parser.add_argument("--skip-migrations", action="store_true", help="Skip doing migrations.")
+parser.add_argument(
+    "--skip-downgrade-check",
+    action="store_true",
+    help="Skip the safety check to prevent database downgrades.",
+)
 parser.add_argument(
     "--from-git", action="store_true", help="Upgrading from git, so run update-prod-static."
 )
@@ -209,6 +214,14 @@ subprocess.check_call(
     [os.path.join(deploy_path, "scripts", "lib", "create-production-venv"), deploy_path]
 )
 
+# Check to make sure that this upgrade is not actually a database
+# downgrade.
+if not args.skip_downgrade_check:
+    subprocess.check_call(
+        [os.path.join(deploy_path, "scripts", "lib", "check-database-compatibility.py")],
+        preexec_fn=su_to_zulip,
+    )
+
 # Make sure the right version of node is installed
 subprocess.check_call([os.path.join(deploy_path, "scripts", "lib", "install-node")])
 subprocess.check_call([os.path.join(deploy_path, "scripts", "lib", "install-yarn")])