From e04dc1a304d49ff7a7a3eaa5b5d66e331a3a2436 Mon Sep 17 00:00:00 2001
From: yumoqing <yumoqing@gmail.com>
Date: Thu, 10 Sep 2026 18:36:56 +0800
Subject: [PATCH] =?UTF-8?q?feat(migration):=20m0028=20pipeline=5Ftool=5Fpo?=
 =?UTF-8?q?licies=20=E5=B7=A5=E5=85=B7=E4=BD=9C=E7=94=A8=E5=9F=9F=E7=AD=96?=
 =?UTF-8?q?=E7=95=A5=E8=A1=A8(=E4=BA=94=E7=BA=A7=E4=BD=9C=E7=94=A8?=
 =?UTF-8?q?=E5=9F=9Fallow/deny)=20=E6=B3=A8:=E7=BC=96=E5=8F=B7=E9=81=BF?=
 =?UTF-8?q?=E5=BC=80=E5=B9=B6=E8=A1=8C=E4=BC=9A=E8=AF=9D=E5=B7=B2=E5=8D=A0?=
 =?UTF-8?q?=E7=94=A8=E7=9A=84m0023-m0027?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../m0028_pipeline_tool_policies.json           | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 deploy/migrations/m0028_pipeline_tool_policies.json

diff --git a/deploy/migrations/m0028_pipeline_tool_policies.json b/deploy/migrations/m0028_pipeline_tool_policies.json
new file mode 100644
index 0000000..dd4ccf4
--- /dev/null
+++ b/deploy/migrations/m0028_pipeline_tool_policies.json
@@ -0,0 +1,17 @@
+{
+  "id": "m0028",
+  "title": "pipeline_tool_policies 工具作用域策略表——五级作用域(global/org/pipeline/role/project)的 allow/deny 微调；新表，配套 models/pipeline_tool_policies.json",
+  "backup_tables": [],
+  "up": [
+    {
+      "op": "sql",
+      "sql": "CREATE TABLE IF NOT EXISTS pipeline_tool_policies (id varchar(32) NOT NULL, scope varchar(32) NOT NULL DEFAULT 'org', scope_id varchar(128) NOT NULL DEFAULT '', tool_name varchar(64) NOT NULL, effect varchar(16) NOT NULL DEFAULT 'allow', reason varchar(500) DEFAULT NULL, status varchar(16) NOT NULL DEFAULT 'active', created_by varchar(32) DEFAULT NULL, created_at datetime NOT NULL DEFAULT current_timestamp(), updated_at datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(), PRIMARY KEY (id), UNIQUE KEY uk_scope_tool (scope, scope_id, tool_name), KEY idx_scope (scope, scope_id, status)) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci"
+    }
+  ],
+  "down": [
+    {
+      "op": "sql",
+      "sql": "DROP TABLE IF EXISTS pipeline_tool_policies"
+    }
+  ]
+}