Catch risky SQL migrations in pull requests before they lock production

Most migration incidents aren't exotic: a DROP COLUMN that an old app instance still reads, an ALTER...