cpflow 5.3.0 → 6.0.0

data/lib/core/disposable_postgres_helpers.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+
+# Ownership is asserted only by opted-in templates creating new resources. Names
+# locate candidates; the marker, shape and exact policy scope authorize cleanup.
+class DisposablePostgresHelpers # rubocop:disable Metrics/ClassLength
+  TAG = "cpflow-disposable-postgres-app"
+
+  def initialize(config, controlplane)
+    @config = config
+    @cp = controlplane
+  end
+
+  def prepare_templates!(templates) # rubocop:disable Metrics/CyclomaticComplexity
+    marked = templates.select { |template| marked?(template) }
+    return if marked.empty?
+
+    unless disposable?
+      marked.each { |template| template["tags"].delete(TAG) }
+      return
+    end
+    candidates = templates.select { |template| resource_types.key?(template.values_at("kind", "name")) }
+    existing = fetch_resources
+    refuse! unless (candidates + existing).all? { |resource| owned?(resource) }
+    ensure_not_shared!(existing)
+  end
+
+  def validate!
+    return [] unless disposable?
+
+    resources = fetch_resources
+    # Legacy templates did not assert ownership. Preserve them without adoption.
+    return [] unless resources.any? { |resource| marked?(resource) }
+
+    refuse! unless resources.all? { |resource| owned?(resource) }
+    ensure_not_shared!(resources)
+    resources
+  end
+
+  def delete(&operation)
+    # Remove access before secrets. Surviving marked secrets can be cleaned up
+    # after a failure even when the policy or GVC no longer exists.
+    validate!.sort_by { |resource| resource["kind"] == "policy" ? 0 : 1 }.each do |resource|
+      current = validate!.find { |item| item["name"] == resource["name"] }
+      next unless current
+
+      kind, name = current.values_at("kind", "name")
+      operation.call(kind, name) { kind == "policy" ? @cp.delete_policy(name) : @cp.delete_secret(name) }
+    end
+  end
+
+  private
+
+  def disposable?
+    !@config.disposable_review_secret_resource_names.nil?
+  end
+
+  def marked?(resource)
+    resource["tags"].is_a?(Hash) && resource["tags"].key?(TAG)
+  end
+
+  def fetch_resources
+    resource_types.filter_map do |(kind, name), _type|
+      resource = fetch(kind, name)
+      resource&.merge("kind" => kind)
+    end
+  end
+
+  def shared?
+    names = resource_types.keys.map(&:last)
+    @config.shared_secret_grants.any? do |grant|
+      [grant[:secret_name], grant[:policy_name]].any? { |name| names.include?(name) }
+    end
+  end
+
+  def ensure_not_shared!(resources)
+    refuse! if shared?
+    resources.select { |resource| resource["kind"] == "secret" }.each do |secret|
+      report = @cp.secret_access_report(secret["name"])
+      refuse! unless exclusive_access_report?(report)
+    end
+  end
+
+  def exclusive_access_report?(report) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+    return false unless report.is_a?(Hash) && report["kind"] == "accessreport"
+
+    permissions = report["permissions"]
+    return false unless permissions.is_a?(Array) && permissions.all?(Hash)
+
+    %w[reveal use].all? do |name|
+      entries = permissions.select { |item| item["name"] == name }
+      entries.one? && entries.first["bindings"].is_a?(Array) &&
+        entries.first["bindings"].all? { |binding| exclusive_access_binding?(binding) }
+    end
+  end
+
+  def exclusive_access_binding?(binding)
+    return false unless binding.is_a?(Hash)
+
+    principal = binding["principalLink"]
+    policy_link = "/org/#{@config.org}/policy/#{@config.app}-pg-access"
+    return true if binding["grantingPolicyLink"] == policy_link && app_principals.include?(principal)
+
+    # Global human/service administration is not an application dependency.
+    # A targeted/query grant, or ANY other GVC identity, still means shared use.
+    admin_path = %r{\A/org/#{Regexp.escape(@config.org)}/(?:group|user|serviceaccount)/[^/]+\z}
+    binding["match"] == "all" && binding["grantedPermissions"] == ["manage"] &&
+      principal.is_a?(String) && principal.match?(admin_path)
+  end
+
+  def app_principals
+    [@config.identity, "#{@config.app}-pg-identity"].flat_map do |identity|
+      path = "gvc/#{@config.app}/identity/#{identity}"
+      ["//#{path}", "/org/#{@config.org}/#{path}"]
+    end
+  end
+
+  def resource_types
+    app = @config.app
+    { ["secret", "#{app}-pg"] => "dictionary", ["secret", "#{app}-pg-script"] => "opaque",
+      ["policy", "#{app}-pg-access"] => nil }
+  end
+
+  def fetch(kind, name)
+    kind == "policy" ? @cp.fetch_policy(name) : @cp.fetch_secret(name)
+  end
+
+  def owned?(resource)
+    key = resource.values_at("kind", "name")
+    tags = resource["tags"]
+    return false unless resource_types.key?(key) && tags.is_a?(Hash) && tags[TAG] == @config.app
+
+    resource["kind"] == "secret" ? resource["type"] == resource_types[key] : policy_owned?(resource)
+  end
+
+  def policy_owned?(policy)
+    return false unless policy["targetKind"] == "secret" &&
+                        %w[target targetQuery gvc].all? { |key| policy[key].nil? }
+
+    targets_owned?(policy["targetLinks"]) && bindings_owned?(policy["bindings"])
+  end
+
+  def targets_owned?(links)
+    names = ["#{@config.app}-pg", "#{@config.app}-pg-script"]
+    links.is_a?(Array) && links.size == 2 && names.all? do |name|
+      links.one? { |link| ["//secret/#{name}", "/org/#{@config.org}/secret/#{name}"].include?(link) }
+    end
+  end
+
+  def bindings_owned?(bindings)
+    return false unless bindings.is_a?(Array)
+
+    bindings.all? { |binding| binding_owned?(binding, app_principals) }
+  end
+
+  def binding_owned?(binding, principals)
+    return false unless binding.is_a?(Hash) && (binding.keys - %w[permissions principalLinks]).empty?
+
+    permissions, links = binding.values_at("permissions", "principalLinks")
+    permissions.is_a?(Array) && (permissions - ["reveal"]).empty? &&
+      links.is_a?(Array) && (links - principals).empty?
+  end
+
+  def refuse!
+    raise "PostgreSQL helper resources have unexpected ownership, grants, target, or access report; " \
+          "leaving them for inspection."
+  end
+end

data/lib/core/doctor_service.rb

@@ -37,6 +37,7 @@ class DoctorService # rubocop:disable Metrics/ClassLength
   def validate_config
     check_for_app_names_contained_in_others
     check_deploy_orders
+    check_generated_review_secret_settings
   end
 
   def validate_templates
@@ -66,6 +67,12 @@ class DoctorService # rubocop:disable Metrics/ClassLength
     raise ValidationError, Shell.color("ERROR: #{e.message}", :red)
   end
 
+  def check_generated_review_secret_settings
+    config.validate_generated_review_secret_settings!
+  rescue RuntimeError => e
+    raise ValidationError, Shell.color("ERROR: #{e.message}", :red)
+  end
+
   def find_app_names_contained_in_others # rubocop:disable Metrics/CyclomaticComplexity, Metrics/MethodLength
     app_names = config.apps.keys.map(&:to_s).sort
     app_prefixes = config.apps

data/lib/core/github_flow_readiness/checks.rb

@@ -105,10 +105,11 @@ module GithubFlowReadiness
     class SqliteProduction < Base
       def call
         return unless service.sqlite_database_in_production?
+        return if service.dynamic_database_url_in_production?
 
         info_result(
           "Production database config uses SQLite. `cpflow generate` will scaffold " \
-          "persistent `db` and `storage` volumes."
+          "persistent SQLite data and Active Storage volumes."
         )
       end
     end

data/lib/core/github_flow_readiness_service.rb

@@ -105,6 +105,10 @@ class GithubFlowReadinessService # rubocop:disable Metrics/ClassLength
     RepoIntrospection.sqlite_database_in_production?(root_path.to_s)
   end
 
+  def dynamic_database_url_in_production?
+    RepoIntrospection.dynamic_database_url_in_production?(root_path.to_s)
+  end
+
   def parsed_package_json
     return @parsed_package_json if instance_variable_defined?(:@parsed_package_json)
 

data/lib/core/repo_introspection.rb

@@ -1,8 +1,9 @@
 # frozen_string_literal: true
 
 require "yaml"
+require "uri"
 
-module RepoIntrospection
+module RepoIntrospection # rubocop:disable Metrics/ModuleLength
   DEFAULT_APP_PREFIX = "my-app"
   RUBY_VERSION_DIRECTIVE_PATTERN = /^\s*ruby\s+['"\d]/
   RUBY_VERSION_DIRECTIVE_PREFIX = /^\s*ruby\s+/
@@ -87,6 +88,49 @@ module RepoIntrospection
     sqlite_database_config?(production)
   end
 
+  # Returns literal SQLite database paths from the production configuration.
+  # Dynamic ERB values are intentionally omitted because the generator cannot
+  # safely redirect a path that is only known at runtime.
+  def self.sqlite_database_paths_in_production(root)
+    path = File.join(root, "config/database.yml")
+    return [] unless File.file?(path)
+
+    parsed = safe_load_database_yml(File.read(path))
+    production = parsed.is_a?(Hash) ? parsed["production"] : nil
+    return [] unless production.is_a?(Hash) && sqlite_database_config?(production)
+
+    database_connection_configs(production).filter_map do |config|
+      sqlite_database_path(config)
+    end.uniq
+  end
+
+  def self.unresolved_sqlite_database_paths_in_production?(root)
+    path = File.join(root, "config/database.yml")
+    return false unless File.file?(path)
+
+    parsed = safe_load_database_yml(File.read(path))
+    production = parsed.is_a?(Hash) ? parsed["production"] : nil
+    return false unless production.is_a?(Hash) && sqlite_database_config?(production)
+
+    database_connection_configs(production).any? do |config|
+      sqlite_database_path(config).nil? && !sqlite_in_memory_database_config?(config)
+    end
+  end
+
+  def self.dynamic_database_url_in_production?(root)
+    path = File.join(root, "config/database.yml")
+    return false unless File.file?(path)
+
+    parsed = safe_load_database_yml(File.read(path))
+    production = parsed.is_a?(Hash) ? parsed["production"] : nil
+    return false unless production.is_a?(Hash)
+
+    database_connection_configs(production).any? do |config|
+      url = config["url"]
+      url.is_a?(String) && url.include?("__erb__") && !sqlite_database_url?(url)
+    end
+  end
+
   # Determines whether a database config hash uses SQLite. Handles both
   # the single-database shape (top-level `adapter`/`url`) and Rails 6.1+ multi-database
   # shape where each connection sits one level deeper (`primary:`, `cache:`, etc.).
@@ -106,7 +150,15 @@ module RepoIntrospection
   # rubocop:disable Style/ReturnNilInPredicateMethodDefinition -- ternary nil/true/false is load-bearing for the caller
   def self.direct_sqlite_database_config?(config)
     url = config["url"]
-    return sqlite_database_url?(url) if url.is_a?(String) && !url.strip.empty?
+    if url.is_a?(String) && !url.strip.empty?
+      if url.include?("__erb__")
+        return true if sqlite_database_url?(url)
+
+        return sqlite_adapter_in_hash?(config)
+      end
+
+      return sqlite_database_url?(url)
+    end
 
     return sqlite_adapter_in_hash?(config) if config["adapter"].is_a?(String)
 
@@ -128,6 +180,64 @@ module RepoIntrospection
     config.is_a?(Hash) && (config.key?("adapter") || config.key?("url"))
   end
 
+  def self.database_connection_configs(config)
+    return [config] unless direct_sqlite_database_config?(config).nil?
+
+    config.values.select { |value| database_connection_config?(value) }
+  end
+
+  def self.sqlite_database_path(config)
+    return if sqlite_in_memory_database_config?(config)
+
+    url = config["url"]
+    if url.is_a?(String) && !url.strip.empty?
+      return sqlite_database_path_from_url(url) if sqlite_database_url?(url)
+
+      return
+    end
+
+    database = config["database"]
+    database.strip if literal_database_path?(database)
+  end
+
+  def self.sqlite_database_path_from_url(url)
+    parser = URI::RFC2396_Parser.new
+    uri = parser.parse(url.strip)
+    encoded_path = uri.opaque ? uri.opaque.split("?", 2).first : uri.path
+    encoded_path = sqlite_file_uri_path(encoded_path, parser)
+    parser.unescape(encoded_path) if literal_database_path?(encoded_path)
+  rescue URI::InvalidURIError
+    nil
+  end
+
+  def self.sqlite_file_uri_path(path, parser)
+    return path unless path&.downcase&.start_with?("file:")
+
+    uri = parser.parse(path)
+    uri.opaque || uri.path
+  end
+
+  def self.sqlite_in_memory_database_config?(config)
+    value = config["url"] || config["database"]
+    return false unless value.is_a?(String)
+
+    identifier = value.strip.sub(/\Asqlite3?:/i, "")
+    encoded_path, query = identifier.split("?", 2)
+    path = URI::RFC2396_Parser.new.unescape(encoded_path)
+    path == ":memory:" || path == "file::memory:" || memory_mode_query?(query)
+  end
+
+  def self.memory_mode_query?(query)
+    query.to_s.split("&").any? do |pair|
+      key, value = pair.split("=", 2)
+      key.casecmp?("mode") && value&.casecmp?("memory")
+    end
+  end
+
+  def self.literal_database_path?(value)
+    value.is_a?(String) && !value.strip.empty? && !value.include?("__erb__")
+  end
+
   def self.safe_load_database_yml(raw_contents)
     # ERB conditionals can change YAML structure, so avoid guessing. Output-only
     # ERB is stubbed as a scalar so common Rails defaults like `pool: <%= ... %>`

data/lib/core/shell.rb

@@ -1,17 +1,21 @@
 # frozen_string_literal: true
 
 class Shell
+  class CommandTimeout < RuntimeError; end
+
   class << self
     attr_reader :tmp_stderr, :verbose
   end
 
   def self.use_tmp_stderr
-    @tmp_stderr = Tempfile.create
-
-    yield
+    previous_tmp_stderr = @tmp_stderr
 
-    @tmp_stderr.close
-    @tmp_stderr = nil
+    Tempfile.create do |tmp_stderr|
+      @tmp_stderr = tmp_stderr
+      yield
+    ensure
+      @tmp_stderr = previous_tmp_stderr
+    end
   end
 
   def self.write_to_tmp_stderr(message)
@@ -65,18 +69,39 @@ class Shell
     tmp_stderr && !verbose
   end
 
-  def self.cmd(*cmd_to_run, capture_stderr: false, separate_stderr: false)
-    return cmd_with_separate_stderr(*cmd_to_run) if separate_stderr
+  def self.cmd(*cmd_to_run, capture_stderr: false, separate_stderr: false, timeout_seconds: nil, **spawn_options)
+    return timed_cmd(cmd_to_run, capture_stderr, separate_stderr, timeout_seconds, spawn_options) if timeout_seconds
 
-    output, status = capture_stderr ? Open3.capture2e(*cmd_to_run) : Open3.capture2(*cmd_to_run)
+    return cmd_with_separate_stderr(*cmd_to_run, **spawn_options) if separate_stderr
+
+    output, status = capture_output(cmd_to_run, capture_stderr, spawn_options)
     {
       output: output,
       success: status.success?
     }
   end
 
-  def self.cmd_with_separate_stderr(*cmd_to_run)
-    output, error_output, status = Open3.capture3(*cmd_to_run)
+  def self.capture_output(cmd_to_run, capture_stderr, spawn_options)
+    return Open3.capture2e(*cmd_to_run, **spawn_options) if capture_stderr
+
+    Open3.capture2(*cmd_to_run, **spawn_options)
+  end
+  private_class_method :capture_output
+
+  def self.timed_cmd(cmd_to_run, capture_stderr, separate_stderr, timeout_seconds, spawn_options)
+    raise ArgumentError, "Process options cannot be combined with timeout_seconds." unless spawn_options.empty?
+
+    TimedCommand.capture(
+      *cmd_to_run,
+      capture_stderr: capture_stderr,
+      separate_stderr: separate_stderr,
+      timeout_seconds: timeout_seconds
+    )
+  end
+  private_class_method :timed_cmd
+
+  def self.cmd_with_separate_stderr(*cmd_to_run, **spawn_options)
+    output, error_output, status = Open3.capture3(*cmd_to_run, **spawn_options)
     { output: output, error_output: error_output, success: status.success? }
   end
   private_class_method :cmd_with_separate_stderr

data/lib/core/timed_command.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+class TimedCommand
+  def self.capture(*command, capture_stderr:, separate_stderr:, timeout_seconds:)
+    new(command, capture_stderr, separate_stderr, timeout_seconds).capture
+  end
+
+  def initialize(command, capture_stderr, separate_stderr, timeout_seconds)
+    raise ArgumentError, "timeout_seconds must be positive" unless timeout_seconds.positive?
+
+    @command = command
+    @capture_stderr = capture_stderr
+    @separate_stderr = separate_stderr
+    @timeout_seconds = timeout_seconds
+  end
+
+  def capture
+    @deadline = monotonic_time + @timeout_seconds
+    @command_cleaned_up = false
+    return capture_separate_streams if @separate_stderr
+    return capture_merged_streams if @capture_stderr
+
+    capture_stdout
+  end
+
+  private
+
+  def capture_stdout # rubocop:disable Metrics/MethodLength
+    completed = false
+    Open3.popen2(*@command, pgroup: true) do |stdin, stdout, wait_thread|
+      stdin.close
+      output_reader = Thread.new { stdout.read }
+      wait_for_command(wait_thread, output_reader)
+      completed = true
+      { output: output_reader.value, success: wait_thread.value.success? }
+    ensure
+      cleanup_unfinished_command(wait_thread, output_reader) unless completed || @command_cleaned_up
+      output_reader&.join
+    end
+  end
+
+  def capture_merged_streams # rubocop:disable Metrics/MethodLength
+    completed = false
+    Open3.popen2e(*@command, pgroup: true) do |stdin, output, wait_thread|
+      stdin.close
+      output_reader = Thread.new { output.read }
+      wait_for_command(wait_thread, output_reader)
+      completed = true
+      { output: output_reader.value, success: wait_thread.value.success? }
+    ensure
+      cleanup_unfinished_command(wait_thread, output_reader) unless completed || @command_cleaned_up
+      output_reader&.join
+    end
+  end
+
+  def capture_separate_streams # rubocop:disable Metrics/MethodLength
+    completed = false
+    Open3.popen3(*@command, pgroup: true) do |stdin, stdout, stderr, wait_thread|
+      stdin.close
+      output_reader = Thread.new { stdout.read }
+      error_reader = Thread.new { stderr.read }
+      wait_for_command(wait_thread, output_reader, error_reader)
+      completed = true
+      {
+        output: output_reader.value,
+        error_output: error_reader.value,
+        success: wait_thread.value.success?
+      }
+    ensure
+      cleanup_unfinished_command(wait_thread, output_reader, error_reader) unless completed || @command_cleaned_up
+      output_reader&.join
+      error_reader&.join
+    end
+  end
+
+  def wait_for_command(wait_thread, *output_readers)
+    observed_threads = [wait_thread, *output_readers]
+    return if observed_threads.all? { |thread| thread.join(remaining_timeout) }
+
+    terminate_process_group(wait_thread)
+    output_readers.each(&:kill)
+    output_readers.each(&:join)
+    @command_cleaned_up = true
+    raise Shell::CommandTimeout, "Command exceeded the #{@timeout_seconds}-second timeout"
+  end
+
+  def remaining_timeout
+    [@deadline - monotonic_time, 0].max
+  end
+
+  def monotonic_time
+    Process.clock_gettime(Process::CLOCK_MONOTONIC)
+  end
+
+  def terminate_process_group(wait_thread)
+    Process.kill("TERM", -wait_thread.pid)
+    wait_thread.join(1)
+
+    Process.kill("KILL", -wait_thread.pid)
+    wait_thread.join
+  rescue Errno::ESRCH, Errno::ECHILD
+    nil
+  end
+
+  def cleanup_unfinished_command(wait_thread, *output_readers)
+    return unless wait_thread
+
+    terminate_process_group(wait_thread)
+    output_readers.compact.each(&:kill)
+  end
+end

data/lib/cpflow/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Cpflow
-  VERSION = "5.3.0"
+  VERSION = "6.0.0"
   MIN_CPLN_VERSION = "3.1.0"
 end

data/lib/cpflow.rb

@@ -122,7 +122,7 @@ module Cpflow
     end
 
     def self.subcommand?
-      (subcommand_names & ARGV).any?
+      subcommand_names.intersect?(ARGV)
     end
     private_class_method :subcommand?
 

data/lib/generator_templates/.dockerignore

@@ -0,0 +1,16 @@
+.git
+.github
+.env*
+!.env.example
+.bundle
+.ruby-lsp
+coverage
+log/*
+node_modules
+storage/*
+tmp/*
+vendor/bundle
+config/master.key
+config/credentials/*.key
+db/*.sqlite3
+db/*.sqlite3-*

data/lib/generator_templates/Dockerfile

@@ -38,9 +38,13 @@ RUN printf '%s\n' '#!/bin/sh' 'exec corepack yarn "$@"' > /usr/bin/yarn && \
 # install ruby gems
 COPY Gemfile* ./
 
-RUN bundle config set without 'development test' && \
+RUN apt-get update -qq && \
+    apt-get install --no-install-recommends -y build-essential && \
+    bundle config set without 'development test' && \
     bundle config set with 'production' && \
-    bundle install --jobs=3 --retry=3
+    bundle install --jobs=3 --retry=3 && \
+    apt-get purge -y --auto-remove build-essential && \
+    rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 COPY . ./
 
@@ -75,11 +79,11 @@ RUN if [ -f package.json ]; then \
 
 ENV RAILS_ENV=production
 
-# compiling assets requires any value for ENV of SECRET_KEY_BASE
-ENV SECRET_KEY_BASE=NOT_USED_NON_BLANK
+# Asset compilation requires a non-blank secret, but the placeholder must not
+# remain in the final image environment.
 
 __ASSET_PRECOMPILE_HOOK_RUN__
-RUN rails assets:precompile
+RUN SECRET_KEY_BASE=NOT_USED_NON_BLANK rails assets:precompile
 
 # add entrypoint
 COPY .controlplane/entrypoint.sh ./

data/lib/generator_templates/entrypoint.sh

@@ -2,6 +2,8 @@
 set -e
 # Runs before the main command
 
+__SQLITE_DATABASE_SETUP__
+
 is_rails_server_command() {
   if [ "${1:-}" = "env" ]; then
     shift

data/lib/generator_templates/templates/postgres.yml

@@ -19,6 +19,9 @@ spec:
 ---
 kind: secret
 name: "{{APP_NAME}}-pg"
+# Only newly created dynamically named review-app helpers acquire this marker.
+tags:
+  cpflow-disposable-postgres-app: "{{APP_NAME}}"
 description: ''
 type: dictionary
 data:
@@ -28,6 +31,9 @@ data:
 ---
 kind: secret
 name: "{{APP_NAME}}-pg-script"
+# Only newly created dynamically named review-app helpers acquire this marker.
+tags:
+  cpflow-disposable-postgres-app: "{{APP_NAME}}"
 type: opaque
 data:
   encoding: base64
@@ -98,6 +104,9 @@ description: "{{APP_NAME}}-pg-identity"
 ---
 kind: policy
 name: "{{APP_NAME}}-pg-access"
+# Only newly created dynamically named review-app helpers acquire this marker.
+tags:
+  cpflow-disposable-postgres-app: "{{APP_NAME}}"
 description: "{{APP_NAME}}-pg-access"
 bindings:
   - permissions:

data/lib/generator_templates_sqlite/controlplane.yml

@@ -1,7 +1,8 @@
 # Keys beginning with "cpln_" correspond to your settings in Control Plane.
 #
 # Generated baseline for a Rails app that uses SQLite in production. This setup
-# keeps `/app/db` and `/app/storage` on persistent volumes.
+# keeps SQLite data under `/app/data` and Active Storage under `/app/storage`
+# on persistent volumes without hiding migrations shipped in `/app/db`.
 
 allow_org_override_by_env: true
 allow_app_override_by_env: true

data/lib/generator_templates_sqlite/release_script.sh

@@ -12,7 +12,7 @@ error_exit() {
 
 log "Running release_script.sh per controlplane.yml"
 
-mkdir -p db storage
+mkdir -p data storage
 
 if [ -x ./bin/rails ]; then
   log "Run DB migrations"

data/lib/generator_templates_sqlite/templates/rails.yml

@@ -16,7 +16,8 @@ spec:
           # See https://www.shakacode.com/control-plane-flow/docs/thruster/ for details.
           protocol: http
       volumes:
-        - path: /app/db
+        # Keep migrations and schema from the image visible under /app/db.
+        - path: /app/data
           recoveryPolicy: retain
           uri: cpln://volumeset/app-db
         - path: /app/storage