cpflow 6.0.0.rc.0 → 6.0.0

data/lib/core/config.rb

@@ -10,6 +10,7 @@ class Config # rubocop:disable Metrics/ClassLength
   include Helpers
 
   CONFIG_FILE_LOCATION = ".controlplane/controlplane.yml"
+  GENERATED_REVIEW_APP_TAG = "cpflow-generated-review-app"
   REQUIRED_SHARED_SECRET_GRANT_KEYS = %i[name secret_name policy_name].freeze
   SHARED_SECRET_RESOURCE_NAME_KEYS = %i[secret_name policy_name].freeze
   CONTROL_PLANE_RESOURCE_NAME_REGEX = /\A[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\z/
@@ -52,6 +53,8 @@ class Config # rubocop:disable Metrics/ClassLength
   end
 
   def secrets
+    return "#{app}-secrets" if generated_review_secret_keys.any?
+
     current&.dig(:secrets_name) || "#{app_prefix}-secrets"
   end
 
@@ -59,6 +62,54 @@ class Config # rubocop:disable Metrics/ClassLength
     current&.dig(:secrets_policy_name) || "#{secrets}-policy"
   end
 
+  def generated_review_secret_keys
+    @generated_review_secret_keys ||= begin
+      keys = current&.dig(:generated_review_secret_keys)
+      if keys.nil?
+        []
+      else
+        validate_generated_review_secret_scope!
+        validate_generated_review_secret_keys!(keys)
+        keys
+      end
+    end
+  end
+
+  # Cleanup must still find marked per-app resources after the opt-in is removed
+  # from the current configuration.
+  def disposable_review_secret_resource_names
+    return nil unless current&.dig(:match_if_app_name_starts_with) && app.to_s != app_prefix.to_s
+    return nil unless app.match?(CONTROL_PLANE_RESOURCE_NAME_REGEX)
+
+    secret = "#{app}-secrets"
+    policy = "#{secret}-policy"
+    return nil unless policy.length <= 64
+
+    [secret, policy]
+  end
+
+  def validate_generated_review_secret_scope!
+    dynamic_review_app = current[:match_if_app_name_starts_with] && app.to_s != app_prefix.to_s
+    raise "generated_review_secret_keys is only allowed for a dynamically named review app." unless dynamic_review_app
+
+    unless "#{app}-secrets-policy".length <= 64 && app.match?(CONTROL_PLANE_RESOURCE_NAME_REGEX)
+      raise "Review app name is too long or invalid for a per-app secret policy."
+    end
+    return unless current[:secrets_name] || current[:secrets_policy_name]
+
+    raise "generated_review_secret_keys cannot be combined with secrets_name or secrets_policy_name."
+  end
+
+  def validate_generated_review_secret_keys!(keys)
+    valid_size = keys.is_a?(Array) && keys.size.between?(1, 8)
+    valid_names = valid_size && keys.all? { |key| key.is_a?(String) && key.match?(/\A[A-Z][A-Z0-9_]*\z/) }
+    return if valid_names && keys.uniq == keys
+
+    raise "generated_review_secret_keys must contain 1-8 unique uppercase environment names."
+  end
+
+  private :validate_generated_review_secret_scope!, :validate_generated_review_secret_keys!
+
   def shared_secret_grants
     @shared_secret_grants ||= normalize_shared_secret_grants(current&.dig(:shared_secret_grants))
   end
@@ -188,6 +239,28 @@ class Config # rubocop:disable Metrics/ClassLength
     end
   end
 
+  def validate_generated_review_secret_settings!
+    apps.each do |app_name, app_options|
+      keys = app_options[:generated_review_secret_keys]
+      next if keys.nil?
+
+      validate_generated_review_secret_entry_scope!(app_name, app_options)
+      validate_generated_review_secret_keys!(keys)
+    end
+  end
+
+  def validate_generated_review_secret_entry_scope!(app_name, app_options)
+    unless app_options[:match_if_app_name_starts_with]
+      raise "generated_review_secret_keys for '#{app_name}' requires a dynamically matched review app."
+    end
+    return unless app_options[:secrets_name] || app_options[:secrets_policy_name]
+
+    raise "generated_review_secret_keys for '#{app_name}' cannot be combined with " \
+          "secrets_name or secrets_policy_name."
+  end
+
+  private :validate_generated_review_secret_entry_scope!
+
   private
 
   def ensure_current_config!

data/lib/core/controlplane.rb

@@ -434,8 +434,24 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     api.fetch_secret(org: org, secret: secret)
   end
 
-  def reveal_secret(secret)
-    api.reveal_secret(org: org, secret: secret)
+  def reveal_secret(secret, required: false)
+    api.reveal_secret(org: org, secret: secret, required: required)
+  end
+
+  def create_sensitive_secret(secret, data)
+    api.create_sensitive_secret(org: org, secret: secret, app: gvc, data: data)
+  end
+
+  def patch_sensitive_secret_data(secret, data)
+    api.patch_sensitive_secret_data(org: org, secret: secret, data: data)
+  end
+
+  def secret_access_report(secret)
+    api.secret_access_report(org: org, secret: secret)
+  end
+
+  def delete_secret(secret)
+    api.delete_secret(org: org, secret: secret)
   end
 
   # identities
@@ -450,6 +466,10 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     api.fetch_policy(org: org, policy: policy)
   end
 
+  def delete_policy(policy)
+    api.delete_policy(org: org, policy: policy)
+  end
+
   def bind_identity_to_policy(identity_link, policy)
     cmd = [
       "cpln", "policy", "add-binding", policy,

data/lib/core/controlplane_api.rb

@@ -122,14 +122,40 @@ class ControlplaneApi # rubocop:disable Metrics/ClassLength
     api_json("/org/#{org}/secret/#{secret}", method: :get)
   end
 
-  def reveal_secret(org:, secret:)
+  def create_sensitive_secret(org:, secret:, app:, data:)
+    api_json(
+      "/org/#{org}/secret", method: :post,
+                            body: { kind: "secret", name: secret, type: "dictionary", data: data,
+                                    tags: { Config::GENERATED_REVIEW_APP_TAG => app } },
+                            request_policy: ControlplaneApiDirect::SENSITIVE_MUTATION_REQUEST_POLICY
+    )
+  end
+
+  def patch_sensitive_secret_data(org:, secret:, data:)
+    api_json(
+      "/org/#{org}/secret/#{secret}", method: :patch,
+                                      body: { data: data },
+                                      request_policy: ControlplaneApiDirect::SENSITIVE_MUTATION_REQUEST_POLICY
+    )
+  end
+
+  def reveal_secret(org:, secret:, required: false)
+    request_policy = if required
+                       ControlplaneApiDirect::REQUIRED_SENSITIVE_READ_REQUEST_POLICY
+                     else
+                       ControlplaneApiDirect::BEST_EFFORT_SENSITIVE_REQUEST_POLICY
+                     end
     api_json(
       "/org/#{org}/secret/#{secret}/-reveal",
       method: :get,
-      request_policy: ControlplaneApiDirect::BEST_EFFORT_SENSITIVE_REQUEST_POLICY
+      request_policy: request_policy
     )
   end
 
+  def secret_access_report(org:, secret:)
+    api_json("/org/#{org}/secret/#{secret}/-accessreport", method: :get)
+  end
+
   def delete_secret(org:, secret:)
     api_json("/org/#{org}/secret/#{secret}", method: :delete)
   end

data/lib/core/controlplane_api_direct.rb

@@ -75,6 +75,16 @@ class ControlplaneApiDirect # rubocop:disable Metrics/ClassLength
     retry_transient: false,
     timeout: BEST_EFFORT_TIMEOUT_SECONDS
   )
+  REQUIRED_SENSITIVE_READ_REQUEST_POLICY = RequestPolicy.new(
+    sensitive: true,
+    retry_transient: true,
+    timeout: 30
+  )
+  SENSITIVE_MUTATION_REQUEST_POLICY = RequestPolicy.new(
+    sensitive: true,
+    retry_transient: false,
+    timeout: 30
+  )
 
   # Thread-safe API token cache. A single instance is shared process-wide by
   # default (see `default_token_provider`) so each `ControlplaneApiDirect.new`
@@ -328,6 +338,7 @@ class ControlplaneApiDirect # rubocop:disable Metrics/ClassLength
   def handle_response(response, url, request_policy)
     case response
     when Net::HTTPOK then parse_response_body(response, request_policy)
+    when Net::HTTPCreated then parse_created_response_body(response, request_policy)
     when Net::HTTPAccepted then true
     when Net::HTTPNotFound then nil
     when Net::HTTPForbidden then raise(ForbiddenError.new(url: url, response: response))
@@ -343,6 +354,12 @@ class ControlplaneApiDirect # rubocop:disable Metrics/ClassLength
     raise JSON::ParserError, "Control Plane API returned invalid JSON for a sensitive request.", cause: nil
   end
 
+  def parse_created_response_body(response, request_policy)
+    return true if response.body.to_s.empty?
+
+    parse_response_body(response, request_policy)
+  end
+
   def response_error_message(response, request_policy)
     return response.to_s if request_policy.sensitive
 

data/lib/core/disposable_postgres_helpers.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+
+# Ownership is asserted only by opted-in templates creating new resources. Names
+# locate candidates; the marker, shape and exact policy scope authorize cleanup.
+class DisposablePostgresHelpers # rubocop:disable Metrics/ClassLength
+  TAG = "cpflow-disposable-postgres-app"
+
+  def initialize(config, controlplane)
+    @config = config
+    @cp = controlplane
+  end
+
+  def prepare_templates!(templates) # rubocop:disable Metrics/CyclomaticComplexity
+    marked = templates.select { |template| marked?(template) }
+    return if marked.empty?
+
+    unless disposable?
+      marked.each { |template| template["tags"].delete(TAG) }
+      return
+    end
+    candidates = templates.select { |template| resource_types.key?(template.values_at("kind", "name")) }
+    existing = fetch_resources
+    refuse! unless (candidates + existing).all? { |resource| owned?(resource) }
+    ensure_not_shared!(existing)
+  end
+
+  def validate!
+    return [] unless disposable?
+
+    resources = fetch_resources
+    # Legacy templates did not assert ownership. Preserve them without adoption.
+    return [] unless resources.any? { |resource| marked?(resource) }
+
+    refuse! unless resources.all? { |resource| owned?(resource) }
+    ensure_not_shared!(resources)
+    resources
+  end
+
+  def delete(&operation)
+    # Remove access before secrets. Surviving marked secrets can be cleaned up
+    # after a failure even when the policy or GVC no longer exists.
+    validate!.sort_by { |resource| resource["kind"] == "policy" ? 0 : 1 }.each do |resource|
+      current = validate!.find { |item| item["name"] == resource["name"] }
+      next unless current
+
+      kind, name = current.values_at("kind", "name")
+      operation.call(kind, name) { kind == "policy" ? @cp.delete_policy(name) : @cp.delete_secret(name) }
+    end
+  end
+
+  private
+
+  def disposable?
+    !@config.disposable_review_secret_resource_names.nil?
+  end
+
+  def marked?(resource)
+    resource["tags"].is_a?(Hash) && resource["tags"].key?(TAG)
+  end
+
+  def fetch_resources
+    resource_types.filter_map do |(kind, name), _type|
+      resource = fetch(kind, name)
+      resource&.merge("kind" => kind)
+    end
+  end
+
+  def shared?
+    names = resource_types.keys.map(&:last)
+    @config.shared_secret_grants.any? do |grant|
+      [grant[:secret_name], grant[:policy_name]].any? { |name| names.include?(name) }
+    end
+  end
+
+  def ensure_not_shared!(resources)
+    refuse! if shared?
+    resources.select { |resource| resource["kind"] == "secret" }.each do |secret|
+      report = @cp.secret_access_report(secret["name"])
+      refuse! unless exclusive_access_report?(report)
+    end
+  end
+
+  def exclusive_access_report?(report) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+    return false unless report.is_a?(Hash) && report["kind"] == "accessreport"
+
+    permissions = report["permissions"]
+    return false unless permissions.is_a?(Array) && permissions.all?(Hash)
+
+    %w[reveal use].all? do |name|
+      entries = permissions.select { |item| item["name"] == name }
+      entries.one? && entries.first["bindings"].is_a?(Array) &&
+        entries.first["bindings"].all? { |binding| exclusive_access_binding?(binding) }
+    end
+  end
+
+  def exclusive_access_binding?(binding)
+    return false unless binding.is_a?(Hash)
+
+    principal = binding["principalLink"]
+    policy_link = "/org/#{@config.org}/policy/#{@config.app}-pg-access"
+    return true if binding["grantingPolicyLink"] == policy_link && app_principals.include?(principal)
+
+    # Global human/service administration is not an application dependency.
+    # A targeted/query grant, or ANY other GVC identity, still means shared use.
+    admin_path = %r{\A/org/#{Regexp.escape(@config.org)}/(?:group|user|serviceaccount)/[^/]+\z}
+    binding["match"] == "all" && binding["grantedPermissions"] == ["manage"] &&
+      principal.is_a?(String) && principal.match?(admin_path)
+  end
+
+  def app_principals
+    [@config.identity, "#{@config.app}-pg-identity"].flat_map do |identity|
+      path = "gvc/#{@config.app}/identity/#{identity}"
+      ["//#{path}", "/org/#{@config.org}/#{path}"]
+    end
+  end
+
+  def resource_types
+    app = @config.app
+    { ["secret", "#{app}-pg"] => "dictionary", ["secret", "#{app}-pg-script"] => "opaque",
+      ["policy", "#{app}-pg-access"] => nil }
+  end
+
+  def fetch(kind, name)
+    kind == "policy" ? @cp.fetch_policy(name) : @cp.fetch_secret(name)
+  end
+
+  def owned?(resource)
+    key = resource.values_at("kind", "name")
+    tags = resource["tags"]
+    return false unless resource_types.key?(key) && tags.is_a?(Hash) && tags[TAG] == @config.app
+
+    resource["kind"] == "secret" ? resource["type"] == resource_types[key] : policy_owned?(resource)
+  end
+
+  def policy_owned?(policy)
+    return false unless policy["targetKind"] == "secret" &&
+                        %w[target targetQuery gvc].all? { |key| policy[key].nil? }
+
+    targets_owned?(policy["targetLinks"]) && bindings_owned?(policy["bindings"])
+  end
+
+  def targets_owned?(links)
+    names = ["#{@config.app}-pg", "#{@config.app}-pg-script"]
+    links.is_a?(Array) && links.size == 2 && names.all? do |name|
+      links.one? { |link| ["//secret/#{name}", "/org/#{@config.org}/secret/#{name}"].include?(link) }
+    end
+  end
+
+  def bindings_owned?(bindings)
+    return false unless bindings.is_a?(Array)
+
+    bindings.all? { |binding| binding_owned?(binding, app_principals) }
+  end
+
+  def binding_owned?(binding, principals)
+    return false unless binding.is_a?(Hash) && (binding.keys - %w[permissions principalLinks]).empty?
+
+    permissions, links = binding.values_at("permissions", "principalLinks")
+    permissions.is_a?(Array) && (permissions - ["reveal"]).empty? &&
+      links.is_a?(Array) && (links - principals).empty?
+  end
+
+  def refuse!
+    raise "PostgreSQL helper resources have unexpected ownership, grants, target, or access report; " \
+          "leaving them for inspection."
+  end
+end

data/lib/core/doctor_service.rb

@@ -37,6 +37,7 @@ class DoctorService # rubocop:disable Metrics/ClassLength
   def validate_config
     check_for_app_names_contained_in_others
     check_deploy_orders
+    check_generated_review_secret_settings
   end
 
   def validate_templates
@@ -66,6 +67,12 @@ class DoctorService # rubocop:disable Metrics/ClassLength
     raise ValidationError, Shell.color("ERROR: #{e.message}", :red)
   end
 
+  def check_generated_review_secret_settings
+    config.validate_generated_review_secret_settings!
+  rescue RuntimeError => e
+    raise ValidationError, Shell.color("ERROR: #{e.message}", :red)
+  end
+
   def find_app_names_contained_in_others # rubocop:disable Metrics/CyclomaticComplexity, Metrics/MethodLength
     app_names = config.apps.keys.map(&:to_s).sort
     app_prefixes = config.apps

data/lib/core/github_flow_readiness/checks.rb

@@ -105,10 +105,11 @@ module GithubFlowReadiness
     class SqliteProduction < Base
       def call
         return unless service.sqlite_database_in_production?
+        return if service.dynamic_database_url_in_production?
 
         info_result(
           "Production database config uses SQLite. `cpflow generate` will scaffold " \
-          "persistent `db` and `storage` volumes."
+          "persistent SQLite data and Active Storage volumes."
         )
       end
     end

data/lib/core/github_flow_readiness_service.rb

@@ -105,6 +105,10 @@ class GithubFlowReadinessService # rubocop:disable Metrics/ClassLength
     RepoIntrospection.sqlite_database_in_production?(root_path.to_s)
   end
 
+  def dynamic_database_url_in_production?
+    RepoIntrospection.dynamic_database_url_in_production?(root_path.to_s)
+  end
+
   def parsed_package_json
     return @parsed_package_json if instance_variable_defined?(:@parsed_package_json)
 

data/lib/core/repo_introspection.rb

@@ -1,8 +1,9 @@
 # frozen_string_literal: true
 
 require "yaml"
+require "uri"
 
-module RepoIntrospection
+module RepoIntrospection # rubocop:disable Metrics/ModuleLength
   DEFAULT_APP_PREFIX = "my-app"
   RUBY_VERSION_DIRECTIVE_PATTERN = /^\s*ruby\s+['"\d]/
   RUBY_VERSION_DIRECTIVE_PREFIX = /^\s*ruby\s+/
@@ -87,6 +88,49 @@ module RepoIntrospection
     sqlite_database_config?(production)
   end
 
+  # Returns literal SQLite database paths from the production configuration.
+  # Dynamic ERB values are intentionally omitted because the generator cannot
+  # safely redirect a path that is only known at runtime.
+  def self.sqlite_database_paths_in_production(root)
+    path = File.join(root, "config/database.yml")
+    return [] unless File.file?(path)
+
+    parsed = safe_load_database_yml(File.read(path))
+    production = parsed.is_a?(Hash) ? parsed["production"] : nil
+    return [] unless production.is_a?(Hash) && sqlite_database_config?(production)
+
+    database_connection_configs(production).filter_map do |config|
+      sqlite_database_path(config)
+    end.uniq
+  end
+
+  def self.unresolved_sqlite_database_paths_in_production?(root)
+    path = File.join(root, "config/database.yml")
+    return false unless File.file?(path)
+
+    parsed = safe_load_database_yml(File.read(path))
+    production = parsed.is_a?(Hash) ? parsed["production"] : nil
+    return false unless production.is_a?(Hash) && sqlite_database_config?(production)
+
+    database_connection_configs(production).any? do |config|
+      sqlite_database_path(config).nil? && !sqlite_in_memory_database_config?(config)
+    end
+  end
+
+  def self.dynamic_database_url_in_production?(root)
+    path = File.join(root, "config/database.yml")
+    return false unless File.file?(path)
+
+    parsed = safe_load_database_yml(File.read(path))
+    production = parsed.is_a?(Hash) ? parsed["production"] : nil
+    return false unless production.is_a?(Hash)
+
+    database_connection_configs(production).any? do |config|
+      url = config["url"]
+      url.is_a?(String) && url.include?("__erb__") && !sqlite_database_url?(url)
+    end
+  end
+
   # Determines whether a database config hash uses SQLite. Handles both
   # the single-database shape (top-level `adapter`/`url`) and Rails 6.1+ multi-database
   # shape where each connection sits one level deeper (`primary:`, `cache:`, etc.).
@@ -106,7 +150,15 @@ module RepoIntrospection
   # rubocop:disable Style/ReturnNilInPredicateMethodDefinition -- ternary nil/true/false is load-bearing for the caller
   def self.direct_sqlite_database_config?(config)
     url = config["url"]
-    return sqlite_database_url?(url) if url.is_a?(String) && !url.strip.empty?
+    if url.is_a?(String) && !url.strip.empty?
+      if url.include?("__erb__")
+        return true if sqlite_database_url?(url)
+
+        return sqlite_adapter_in_hash?(config)
+      end
+
+      return sqlite_database_url?(url)
+    end
 
     return sqlite_adapter_in_hash?(config) if config["adapter"].is_a?(String)
 
@@ -128,6 +180,64 @@ module RepoIntrospection
     config.is_a?(Hash) && (config.key?("adapter") || config.key?("url"))
   end
 
+  def self.database_connection_configs(config)
+    return [config] unless direct_sqlite_database_config?(config).nil?
+
+    config.values.select { |value| database_connection_config?(value) }
+  end
+
+  def self.sqlite_database_path(config)
+    return if sqlite_in_memory_database_config?(config)
+
+    url = config["url"]
+    if url.is_a?(String) && !url.strip.empty?
+      return sqlite_database_path_from_url(url) if sqlite_database_url?(url)
+
+      return
+    end
+
+    database = config["database"]
+    database.strip if literal_database_path?(database)
+  end
+
+  def self.sqlite_database_path_from_url(url)
+    parser = URI::RFC2396_Parser.new
+    uri = parser.parse(url.strip)
+    encoded_path = uri.opaque ? uri.opaque.split("?", 2).first : uri.path
+    encoded_path = sqlite_file_uri_path(encoded_path, parser)
+    parser.unescape(encoded_path) if literal_database_path?(encoded_path)
+  rescue URI::InvalidURIError
+    nil
+  end
+
+  def self.sqlite_file_uri_path(path, parser)
+    return path unless path&.downcase&.start_with?("file:")
+
+    uri = parser.parse(path)
+    uri.opaque || uri.path
+  end
+
+  def self.sqlite_in_memory_database_config?(config)
+    value = config["url"] || config["database"]
+    return false unless value.is_a?(String)
+
+    identifier = value.strip.sub(/\Asqlite3?:/i, "")
+    encoded_path, query = identifier.split("?", 2)
+    path = URI::RFC2396_Parser.new.unescape(encoded_path)
+    path == ":memory:" || path == "file::memory:" || memory_mode_query?(query)
+  end
+
+  def self.memory_mode_query?(query)
+    query.to_s.split("&").any? do |pair|
+      key, value = pair.split("=", 2)
+      key.casecmp?("mode") && value&.casecmp?("memory")
+    end
+  end
+
+  def self.literal_database_path?(value)
+    value.is_a?(String) && !value.strip.empty? && !value.include?("__erb__")
+  end
+
   def self.safe_load_database_yml(raw_contents)
     # ERB conditionals can change YAML structure, so avoid guessing. Output-only
     # ERB is stubbed as a scalar so common Rails defaults like `pool: <%= ... %>`

data/lib/cpflow/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Cpflow
-  VERSION = "6.0.0.rc.0"
+  VERSION = "6.0.0"
   MIN_CPLN_VERSION = "3.1.0"
 end

data/lib/generator_templates/.dockerignore

@@ -0,0 +1,16 @@
+.git
+.github
+.env*
+!.env.example
+.bundle
+.ruby-lsp
+coverage
+log/*
+node_modules
+storage/*
+tmp/*
+vendor/bundle
+config/master.key
+config/credentials/*.key
+db/*.sqlite3
+db/*.sqlite3-*

data/lib/generator_templates/Dockerfile

@@ -38,9 +38,13 @@ RUN printf '%s\n' '#!/bin/sh' 'exec corepack yarn "$@"' > /usr/bin/yarn && \
 # install ruby gems
 COPY Gemfile* ./
 
-RUN bundle config set without 'development test' && \
+RUN apt-get update -qq && \
+    apt-get install --no-install-recommends -y build-essential && \
+    bundle config set without 'development test' && \
     bundle config set with 'production' && \
-    bundle install --jobs=3 --retry=3
+    bundle install --jobs=3 --retry=3 && \
+    apt-get purge -y --auto-remove build-essential && \
+    rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 COPY . ./
 
@@ -75,11 +79,11 @@ RUN if [ -f package.json ]; then \
 
 ENV RAILS_ENV=production
 
-# compiling assets requires any value for ENV of SECRET_KEY_BASE
-ENV SECRET_KEY_BASE=NOT_USED_NON_BLANK
+# Asset compilation requires a non-blank secret, but the placeholder must not
+# remain in the final image environment.
 
 __ASSET_PRECOMPILE_HOOK_RUN__
-RUN rails assets:precompile
+RUN SECRET_KEY_BASE=NOT_USED_NON_BLANK rails assets:precompile
 
 # add entrypoint
 COPY .controlplane/entrypoint.sh ./

data/lib/generator_templates/entrypoint.sh

@@ -2,6 +2,8 @@
 set -e
 # Runs before the main command
 
+__SQLITE_DATABASE_SETUP__
+
 is_rails_server_command() {
   if [ "${1:-}" = "env" ]; then
     shift

data/lib/generator_templates/templates/postgres.yml

@@ -19,6 +19,9 @@ spec:
 ---
 kind: secret
 name: "{{APP_NAME}}-pg"
+# Only newly created dynamically named review-app helpers acquire this marker.
+tags:
+  cpflow-disposable-postgres-app: "{{APP_NAME}}"
 description: ''
 type: dictionary
 data:
@@ -28,6 +31,9 @@ data:
 ---
 kind: secret
 name: "{{APP_NAME}}-pg-script"
+# Only newly created dynamically named review-app helpers acquire this marker.
+tags:
+  cpflow-disposable-postgres-app: "{{APP_NAME}}"
 type: opaque
 data:
   encoding: base64
@@ -98,6 +104,9 @@ description: "{{APP_NAME}}-pg-identity"
 ---
 kind: policy
 name: "{{APP_NAME}}-pg-access"
+# Only newly created dynamically named review-app helpers acquire this marker.
+tags:
+  cpflow-disposable-postgres-app: "{{APP_NAME}}"
 description: "{{APP_NAME}}-pg-access"
 bindings:
   - permissions:

data/lib/generator_templates_sqlite/controlplane.yml

@@ -1,7 +1,8 @@
 # Keys beginning with "cpln_" correspond to your settings in Control Plane.
 #
 # Generated baseline for a Rails app that uses SQLite in production. This setup
-# keeps `/app/db` and `/app/storage` on persistent volumes.
+# keeps SQLite data under `/app/data` and Active Storage under `/app/storage`
+# on persistent volumes without hiding migrations shipped in `/app/db`.
 
 allow_org_override_by_env: true
 allow_app_override_by_env: true