🧑‍💻 [#3283] Add upgrade check script

Prevent upgrades going through if known constraint violations exist
in the database.

Dockerfile

@@ -92,6 +92,7 @@ RUN mkdir /app/bin /app/log /app/media /app/private_media /app/certifi_ca_bundle
 COPY \
     ./bin/check_celery_worker_liveness.py \
     ./bin/report_component_problems.py \
+    ./bin/check_temporary_uploads.py \
     ./bin/
 
 # prevent writing to the container layer, which would degrade performance.

bin/check_temporary_uploads.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python
+import sys
+from pathlib import Path
+
+import django
+
+SRC_DIR = Path(__file__).parent.parent / "src"
+sys.path.insert(0, str(SRC_DIR.resolve()))
+
+
+def check_for_null_submissions_in_temporary_uploads():
+    from openforms.submissions.models import TemporaryFileUpload
+
+    problematic_uploads = TemporaryFileUpload.objects.filter(submission__isnull=True)
+    if problematic_uploads.exists():
+        print("There are still legacy temporary uploads. You must clear those first.")
+        return False
+
+    return True
+
+
+def main(skip_setup=False) -> bool:
+    from openforms.setup import setup_env
+
+    if not skip_setup:
+        setup_env()
+        django.setup()
+
+    return check_for_null_submissions_in_temporary_uploads()
+
+
+if __name__ == "__main__":
+    main()

src/openforms/upgrades/upgrade_paths.py

@@ -76,6 +76,12 @@ def run_checks(self) -> bool:
 # If your current version falls outside of a supported range, you need to do another
 # upgrade path (first) or there is no upgrade path at all.
 UPGRADE_PATHS = {
+    "3.0": UpgradeConstraint(
+        valid_ranges={
+            VersionRange(minimum="2.8.0"),
+        },
+        scripts=["check_temporary_uploads"],
+    ),
     "2.8": UpgradeConstraint(
         valid_ranges={
             VersionRange(minimum="2.7.4"),