What is the failOnError attribute in a changeSet and when should you set it to false?

The failOnError attribute on a changeSet controls what Liquibase does when an error occurs during that changeSet's execution. By default, failOnError="true" — any error causes Liquibase to stop, roll back the transaction (if within one), and report a failure. Setting failOnError="false" tells Liquibase to log the error as a warning and continue with the next changeSet.

This sounds useful but it is almost always the wrong choice in production. Silent failures mean your schema is in an unknown state — some changes succeeded, some didn't — while Liquibase reports overall success. This can lead to application startup errors, silent data corruption, or security vulnerabilities (like a permission grant that silently failed).

Legitimate uses for failOnError="false":

• Idempotent data cleanup — A changeSet that deletes orphan rows where the condition might not match in all environments. If zero rows are deleted, that is not an error but some databases return a warning-level error code.
• Database object creation when existence is uncertain — A changeSet that tries to create an index that might already exist in some environments (though preconditions are the cleaner solution here).
• Known cross-database compatibility issues — Running optional changeSets that work on PostgreSQL but produce benign errors on MySQL, where the feature is optional.

<changeSet id="cleanup-orphan-sessions" author="grace" failOnError="false">
    <sql>DELETE FROM session WHERE user_id NOT IN (SELECT id FROM "user")</sql>
</changeSet>

Even in these cases, add a comment explaining why failOnError=false is set. Future developers will thank you.