Check for FOR UPDATE locks

This change extends the cross-database modification check to also
look for SELECT FOR UPDATE queries.

spec/support/database/prevent_cross_database_modification.rb

@@ -74,7 +74,9 @@ module Database
 
       return if cross_database_context[:transaction_depth_by_db].values.all?(&:zero?)
 
-      tables = PgQuery.parse(sql).dml_tables
+      parsed_query = PgQuery.parse(sql)
+      tables = sql.downcase.include?(' for update') ? parsed_query.tables : parsed_query.dml_tables
+
       return if tables.empty?
 
       cross_database_context[:modified_tables_by_db][database].merge(tables)

spec/support_specs/database/prevent_cross_database_modification_spec.rb

@@ -99,6 +99,25 @@ RSpec.describe 'Database::PreventCrossDatabaseModification' do
           end
         end
       end
+
+      context 'when executing a SELECT FOR UPDATE query' do
+        def run_queries
+          project.touch
+          pipeline.lock!
+        end
+
+        context 'outside transaction' do
+          it { expect { run_queries }.not_to raise_error }
+        end
+
+        context 'when data modification happens in a transaction' do
+          it 'raises error' do
+            Project.transaction do
+              expect { run_queries }.to raise_error /Cross-database data modification/
+            end
+          end
+        end
+      end
     end
 
     context 'when CI association is modified through project' do