From 77b1a6784ffff53b1f943d3c0df8e576739446f1 Mon Sep 17 00:00:00 2001
From: root <root@v2202607378382480008.hotsrv.de>
Date: Wed, 22 Jul 2026 00:02:54 +0200
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E5=A4=96=E9=83=A8=20P?=
 =?UTF-8?q?ostgreSQL=20=E8=BF=81=E7=A7=BB=20Job=20=E4=B8=8D=E5=8F=AF?=
 =?UTF-8?q?=E5=8F=98=E6=BC=82=E7=A7=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/gitops-render.test.ts                 |  5 ++++-
 .../src/gitops-render/runtime-manifests.mjs   | 19 +++++++++++++------
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/scripts/gitops-render.test.ts b/scripts/gitops-render.test.ts
index 57a08c47..0d379f45 100644
--- a/scripts/gitops-render.test.ts
+++ b/scripts/gitops-render.test.ts
@@ -762,7 +762,10 @@ test("v03 render keeps node identity as data instead of generated structure", as
     assert.match(externalPostgresMigrationConfig?.data?.["run.mjs"] ?? "", /uselibpqcompat/u);
     assert.match(externalPostgresMigrationConfig?.data?.["run.mjs"] ?? "", /hwlab-runtime-migration-started/u);
     assert.equal(externalPostgresMigrationConfig?.metadata?.annotations?.["argocd.argoproj.io/sync-wave"], "-2");
-    assert.equal(externalPostgresMigrationJob?.metadata?.annotations?.["argocd.argoproj.io/sync-wave"], "-1");
+    assert.equal(externalPostgresMigrationJob?.metadata?.annotations?.["argocd.argoproj.io/sync-wave"], "1");
+    assert.equal(externalPostgresMigrationJob?.metadata?.annotations?.["hwlab.pikastech.local/migration-contract-version"], "external-postgres-migration-v2");
+    assert.equal(externalPostgresMigrationJob?.metadata?.labels?.["hwlab.pikastech.local/source-commit"], sourceRevision);
+    assert.equal(externalPostgresMigrationJob?.spec?.template?.metadata?.labels?.["hwlab.pikastech.local/source-commit"], undefined);
     assert.equal(
       externalPostgresMigrationJob?.spec?.template?.spec?.containers?.[0]?.image,
       `127.0.0.1:5000/hwlab/hwlab-cloud-api-env@sha256:${"1".repeat(64)}`
diff --git a/scripts/src/gitops-render/runtime-manifests.mjs b/scripts/src/gitops-render/runtime-manifests.mjs
index cb099fb3..77697703 100644
--- a/scripts/src/gitops-render/runtime-manifests.mjs
+++ b/scripts/src/gitops-render/runtime-manifests.mjs
@@ -754,6 +754,7 @@ function externalPostgresManifest({ profile = "v03", config, source, deploy = nu
   const migrationData = Object.fromEntries(migrationSources.map((migration) => [path.basename(migration.path), migration.sql]));
   const migrationSha256 = createHash("sha256").update(migrationSources.map((migration) => migration.sql).join("\n")).digest("hex");
   const migrationRunner = externalPostgresMigrationRunner();
+  const migrationContractVersion = "external-postgres-migration-v2";
   const migrationImage = runtimeImageForService({
     catalog,
     deploy,
@@ -764,18 +765,24 @@ function externalPostgresManifest({ profile = "v03", config, source, deploy = nu
     digestPin: true,
     envReuseServiceIds: envReuseServiceIdsForLane(deploy, profile)
   });
-  const executionSha256 = createHash("sha256").update(`${migrationSha256}\n${migrationImage}\n${migrationRunner}`).digest("hex");
+  const executionSha256 = createHash("sha256").update(`${migrationContractVersion}\n${migrationSha256}\n${migrationImage}\n${migrationRunner}`).digest("hex");
   const migrationName = `${namespace}-external-postgres-migrate-${executionSha256.slice(0, 12)}`;
-  const labels = {
+  const stableLabels = {
     "app.kubernetes.io/name": config.serviceName,
     "app.kubernetes.io/part-of": "hwlab",
     "hwlab.pikastech.local/component": "platform-db-bridge",
     "hwlab.pikastech.local/environment": profile,
     "hwlab.pikastech.local/gitops-target": profile,
-    "hwlab.pikastech.local/profile": profile,
+    "hwlab.pikastech.local/profile": profile
+  };
+  const labels = {
+    ...stableLabels,
     "hwlab.pikastech.local/source-commit": source.full
   };
-  const annotations = { "hwlab.pikastech.local/rendered-by": "scripts/gitops-render.mjs" };
+  const annotations = {
+    "hwlab.pikastech.local/rendered-by": "scripts/gitops-render.mjs",
+    "hwlab.pikastech.local/migration-contract-version": migrationContractVersion
+  };
   return {
     apiVersion: "v1",
     kind: "List",
@@ -807,14 +814,14 @@ function externalPostgresManifest({ profile = "v03", config, source, deploy = nu
           labels,
           annotations: {
             ...annotations,
-            "argocd.argoproj.io/sync-wave": "-1",
+            "argocd.argoproj.io/sync-wave": "1",
             "hwlab.pikastech.local/migration-sha256": migrationSha256
           }
         },
         spec: {
           backoffLimit: 2,
           template: {
-            metadata: { labels: { ...labels, "app.kubernetes.io/name": migrationName } },
+            metadata: { labels: { ...stableLabels, "app.kubernetes.io/name": migrationName } },
             spec: {
               restartPolicy: "Never",
               containers: [{