ci: require TypeBase for new models (#44087)

Co-authored-by: Codex <codex@openai.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

.github/workflows/main-ci.yml

@@ -64,6 +64,8 @@ jobs:
               - 'scripts/ast_grep_guard.py'
               - 'scripts/check_no_new_getattr.py'
               - 'scripts/check_no_spec_mock.py'
+              - 'scripts/check_no_new_base_model.py'
+              - 'scripts/ast_grep_rules/no_new_base_model.yml'
               - 'scripts/check_no_new_test_doubles.py'
               - 'scripts/check_no_new_controller_sqlalchemy.py'
               - 'scripts/lint_controller_sqlalchemy.py'
@@ -167,6 +169,8 @@ jobs:
               - 'scripts/ast_grep_guard.py'
               - 'scripts/check_no_new_getattr.py'
               - 'scripts/check_no_spec_mock.py'
+              - 'scripts/check_no_new_base_model.py'
+              - 'scripts/ast_grep_rules/no_new_base_model.yml'
               - 'scripts/check_no_new_test_doubles.py'
               - 'scripts/check_no_new_controller_sqlalchemy.py'
               - 'scripts/check_no_new_session_mock.py'

.github/workflows/style.yml

@@ -97,6 +97,12 @@ jobs:
         if: inputs.run-python-style
         run: uv run --project api python scripts/check_no_spec_mock.py
 
+      - name: Run No New Base Model Guard
+        if: inputs.run-python-style
+        env:
+          GUARD_BASE_REV: ${{ github.event_name == 'pull_request' && 'HEAD^1' || inputs.base-rev }}
+        run: uv run --project api python scripts/check_no_new_base_model.py --base-rev "$GUARD_BASE_REV"
+
       - name: Run No New Test Doubles Guard
         if: inputs.run-python-style || inputs.run-dify-agent-style
         # A PR event can retain an older base SHA after its target branch advances.