cpflow 6.0.0.rc.0 → 6.0.1

data/lib/command/update_github_actions.rb

@@ -5,33 +5,52 @@ require "yaml"
 require_relative "staging_branch_validation"
 
 module Command
-  class UpdateGithubActions < Base
+  class UpdateGithubActions < Base # rubocop:disable Metrics/ClassLength
     include StagingBranchValidation
 
     NAME = "update-github-actions"
-    OPTIONS = [staging_branch_option].freeze
+    OPTIONS = [staging_branch_option, {
+      name: :workflows,
+      params: {
+        type: :array, banner: "FILE...",
+        desc: "Explicitly add or replace these generated workflow filenames (default: preserve all workflows)"
+      }
+    }].freeze
     DESCRIPTION = "Regenerates GitHub Actions files for the installed cpflow version"
     LONG_DESCRIPTION = <<~DESC.freeze
-      Regenerates the cpflow workflow wrappers, local composite actions, and
-      helper files from the currently installed cpflow gem. Use this after
-      updating the cpflow gem so checked-in workflow wrappers move to the
-      matching upstream release tag, for example `v#{Cpflow::VERSION}`, and the
-      generated action implementations move with them.
-
-      If the existing generated staging workflow uses a custom single staging
-      branch, the command preserves it. Pass `--staging-branch BRANCH` to set or
-      replace the generated staging branch explicitly.
+      Refreshes helper files from the installed gem. Workflows load cpflow's
+      composite actions from the pinned cpflow ref, so the command reports any
+      `.github/actions/cpflow-*` copies left by cpflow 6.0.0 for you to delete
+      once no workflow is pinned to 6.0.0. It never deletes them itself.
+      All top-level workflows are preserved by default, including their refs,
+      triggers, permissions, and deployment ownership. Use --workflows FILE...
+      to explicitly add or replace named generated workflows. Replacement resets
+      each selected workflow to its template and matching v#{Cpflow::VERSION} ref;
+      review and reapply any downstream customizations in the same PR.
+
+      Selecting cpflow-deploy-staging.yml preserves a single existing push branch
+      or the default main/master pair. Missing or ambiguous branches require
+      --staging-branch BRANCH. This option requires selecting the staging workflow.
+
+      A differing existing bin/test-cpflow-github-flow blocks all writes. Move
+      downstream checks to executable bin/test-cpflow-github-flow-custom and
+      remove or rename the old validator before updating. The generated validator
+      invokes that extension after its baseline checks; the extension is never
+      generated or overwritten. See docs/ci-automation.md for migration guidance.
     DESC
     EXAMPLES = <<~EX
       ```sh
-      # After updating the cpflow gem, refresh every generated GitHub Actions file
+      # Refresh helpers while preserving downstream workflows
       cpflow update-github-actions
 
       # When running cpflow through Bundler
       bundle exec cpflow update-github-actions
 
-      # Preserve or set a custom staging branch
-      cpflow update-github-actions --staging-branch develop
+      # Explicitly replace the review-app wrapper
+      cpflow update-github-actions --workflows cpflow-deploy-review-app.yml
+
+      # Explicitly add or replace staging deployment from develop
+      cpflow update-github-actions --workflows cpflow-deploy-staging.yml --staging-branch develop
       ```
     EX
     WITH_INFO_HEADER = false
@@ -44,66 +63,111 @@ module Command
     def call
       GenerateGithubActions.ensure_template_root!
       abort_if_no_generated_files!
-
-      branch = staging_branch || inferred_staging_branch
-      GithubActionsGenerator.start([branch].compact)
+      workflows = selected_workflows
+      branch = selected_staging_branch(workflows)
+      abort_if_custom_validator!
+      GithubActionsGenerator.new([branch].compact, workflows: workflows).invoke_all
+      report_vendored_actions
 
       print_post_update_message
     end
 
     private
 
+    def selected_workflows
+      available = GenerateGithubActions.generated_files.grep(%r{\A\.github/workflows/}).map do |path|
+        File.basename(path)
+      end
+      selected = Array(config.options[:workflows])
+      unknown = selected - available
+      Shell.abort("Unknown --workflows: #{unknown.join(', ')}. Available: #{available.join(', ')}") if unknown.any?
+      selected
+    end
+
+    def selected_staging_branch(workflows)
+      branch = staging_branch
+      return branch || inferred_staging_branch if workflows.include?(STAGING_WORKFLOW_PATH.basename.to_s)
+
+      Shell.abort("--staging-branch requires --workflows cpflow-deploy-staging.yml") if branch
+      nil
+    end
+
+    def abort_if_custom_validator!
+      path = "bin/test-cpflow-github-flow"
+      return unless File.exist?(path)
+      return if File.binread(path) == File.binread(GenerateGithubActions.source_file(path))
+
+      Shell.abort(<<~MESSAGE)
+        #{path} differs from the current generated validator. No files were updated.
+        Move downstream checks to executable bin/test-cpflow-github-flow-custom, then remove or rename
+        #{path} and retry. See docs/ci-automation.md for the legacy validator migration.
+      MESSAGE
+    end
+
     def abort_if_no_generated_files!
       return if GenerateGithubActions.generated_files.any? { |path| File.exist?(path) }
+      return if vendored_action_directories.any?
 
-      Shell.abort(
-        "No generated cpflow GitHub Actions files found in this repository. " \
-        "Run `cpflow generate-github-actions` first to create the wrappers, " \
-        "then use `cpflow update-github-actions` after future gem upgrades."
-      )
+      Shell.abort(<<~MESSAGE)
+        No generated cpflow GitHub Actions files found in this repository.
+        Run `cpflow generate-github-actions` first to create the wrappers,
+        then use `cpflow update-github-actions` after future gem upgrades.
+      MESSAGE
+    end
+
+    # cpflow 6.0.0 copied its composite actions here. Scan the caller's tree rather than this
+    # gem's action names, so a copy is still found after an action is renamed or removed.
+    def vendored_action_directories
+      Dir.glob(".github/actions/cpflow-*").select { |path| File.directory?(path) }.sort
+    end
+
+    # Whether a copy is still needed depends on the cpflow release each wrapper pins, which a
+    # full-SHA pin does not reveal, so deletion stays a reviewed human step.
+    def report_vendored_actions
+      directories = vendored_action_directories
+      return if directories.empty?
+
+      Shell.warn(<<~MESSAGE)
+        cpflow no longer generates or updates these local action copies:
+        #{directories.map { |path| "- #{path}" }.join("\n")}
+        A workflow pinned to cpflow 6.0.0 still runs them. Delete them once every cpflow workflow
+        in this repository is pinned to a later release and none has a
+        `uses: ./.github/actions/cpflow-*` line. See docs/ci-automation.md.
+      MESSAGE
     end
 
     def print_post_update_message
       Shell.info("")
-      Shell.info("Updated cpflow GitHub Actions wrappers for cpflow #{Cpflow::VERSION}.")
+      Shell.info("Updated cpflow GitHub Actions files for cpflow #{Cpflow::VERSION}.")
+      Shell.info("Preserved unselected workflows; review their refs and compatibility before committing.")
       Shell.info("Next: review the diff and run `bin/test-cpflow-github-flow`.")
       Shell.info("If you run cpflow through Bundler, use `bin/test-cpflow-github-flow bundle exec cpflow`.")
     end
 
     def inferred_staging_branch
       branches = existing_staging_branches
-      return if branches.empty? || branches.sort == DEFAULT_STAGING_BRANCHES.sort
-      return branches.first if branches.length == 1
-
-      Shell.warn(
-        "Existing staging workflow has multiple custom push branches: #{branches.join(', ')}. " \
-        "Run with --staging-branch BRANCH if only one branch should auto-deploy staging."
-      )
+      return if branches.sort == DEFAULT_STAGING_BRANCHES.sort
+      return branches.first if branches.length == 1 && valid_staging_branch?(branches.first)
 
-      nil
+      Shell.abort("Cannot infer staging deployment branch. Pass --staging-branch BRANCH to explicitly set it.")
     end
 
     def existing_staging_branches
-      Array(parsed_staging_workflow_on.dig("push", "branches")).map(&:to_s)
+      push = parsed_staging_workflow_on["push"]
+      branches = push.is_a?(Hash) ? push["branches"] : nil
+      branches.is_a?(Array) && branches.all?(String) ? branches : []
     end
 
     def parsed_staging_workflow_on
       return {} unless STAGING_WORKFLOW_PATH.file?
 
       workflow = YAML.load_file(STAGING_WORKFLOW_PATH, aliases: true)
-      return {} unless workflow.is_a?(Hash)
-
-      workflow_on = workflow["on"] || workflow[true]
+      workflow_on = workflow.is_a?(Hash) ? workflow["on"] || workflow[true] : nil
       workflow_on.is_a?(Hash) ? workflow_on : {}
     rescue Psych::SyntaxError => e
-      warn_unparseable_staging_workflow(e)
-      {}
-    end
-
-    def warn_unparseable_staging_workflow(error)
-      Shell.warn(
-        "Could not parse #{STAGING_WORKFLOW_PATH}: #{error.message}. " \
-        "Run with --staging-branch BRANCH if staging should use a custom branch."
+      Shell.abort(
+        "Could not parse #{STAGING_WORKFLOW_PATH}: #{e.message}. " \
+        "Pass --staging-branch BRANCH to explicitly replace its staging deployment branch."
       )
     end
   end

data/lib/core/config.rb

@@ -10,6 +10,7 @@ class Config # rubocop:disable Metrics/ClassLength
   include Helpers
 
   CONFIG_FILE_LOCATION = ".controlplane/controlplane.yml"
+  GENERATED_REVIEW_APP_TAG = "cpflow-generated-review-app"
   REQUIRED_SHARED_SECRET_GRANT_KEYS = %i[name secret_name policy_name].freeze
   SHARED_SECRET_RESOURCE_NAME_KEYS = %i[secret_name policy_name].freeze
   CONTROL_PLANE_RESOURCE_NAME_REGEX = /\A[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\z/
@@ -52,6 +53,8 @@ class Config # rubocop:disable Metrics/ClassLength
   end
 
   def secrets
+    return "#{app}-secrets" if generated_review_secret_keys.any?
+
     current&.dig(:secrets_name) || "#{app_prefix}-secrets"
   end
 
@@ -59,6 +62,54 @@ class Config # rubocop:disable Metrics/ClassLength
     current&.dig(:secrets_policy_name) || "#{secrets}-policy"
   end
 
+  def generated_review_secret_keys
+    @generated_review_secret_keys ||= begin
+      keys = current&.dig(:generated_review_secret_keys)
+      if keys.nil?
+        []
+      else
+        validate_generated_review_secret_scope!
+        validate_generated_review_secret_keys!(keys)
+        keys
+      end
+    end
+  end
+
+  # Cleanup must still find marked per-app resources after the opt-in is removed
+  # from the current configuration.
+  def disposable_review_secret_resource_names
+    return nil unless current&.dig(:match_if_app_name_starts_with) && app.to_s != app_prefix.to_s
+    return nil unless app.match?(CONTROL_PLANE_RESOURCE_NAME_REGEX)
+
+    secret = "#{app}-secrets"
+    policy = "#{secret}-policy"
+    return nil unless policy.length <= 64
+
+    [secret, policy]
+  end
+
+  def validate_generated_review_secret_scope!
+    dynamic_review_app = current[:match_if_app_name_starts_with] && app.to_s != app_prefix.to_s
+    raise "generated_review_secret_keys is only allowed for a dynamically named review app." unless dynamic_review_app
+
+    unless "#{app}-secrets-policy".length <= 64 && app.match?(CONTROL_PLANE_RESOURCE_NAME_REGEX)
+      raise "Review app name is too long or invalid for a per-app secret policy."
+    end
+    return unless current[:secrets_name] || current[:secrets_policy_name]
+
+    raise "generated_review_secret_keys cannot be combined with secrets_name or secrets_policy_name."
+  end
+
+  def validate_generated_review_secret_keys!(keys)
+    valid_size = keys.is_a?(Array) && keys.size.between?(1, 8)
+    valid_names = valid_size && keys.all? { |key| key.is_a?(String) && key.match?(/\A[A-Z][A-Z0-9_]*\z/) }
+    return if valid_names && keys.uniq == keys
+
+    raise "generated_review_secret_keys must contain 1-8 unique uppercase environment names."
+  end
+
+  private :validate_generated_review_secret_scope!, :validate_generated_review_secret_keys!
+
   def shared_secret_grants
     @shared_secret_grants ||= normalize_shared_secret_grants(current&.dig(:shared_secret_grants))
   end
@@ -188,6 +239,28 @@ class Config # rubocop:disable Metrics/ClassLength
     end
   end
 
+  def validate_generated_review_secret_settings!
+    apps.each do |app_name, app_options|
+      keys = app_options[:generated_review_secret_keys]
+      next if keys.nil?
+
+      validate_generated_review_secret_entry_scope!(app_name, app_options)
+      validate_generated_review_secret_keys!(keys)
+    end
+  end
+
+  def validate_generated_review_secret_entry_scope!(app_name, app_options)
+    unless app_options[:match_if_app_name_starts_with]
+      raise "generated_review_secret_keys for '#{app_name}' requires a dynamically matched review app."
+    end
+    return unless app_options[:secrets_name] || app_options[:secrets_policy_name]
+
+    raise "generated_review_secret_keys for '#{app_name}' cannot be combined with " \
+          "secrets_name or secrets_policy_name."
+  end
+
+  private :validate_generated_review_secret_entry_scope!
+
   private
 
   def ensure_current_config!

data/lib/core/controlplane.rb

@@ -434,8 +434,24 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     api.fetch_secret(org: org, secret: secret)
   end
 
-  def reveal_secret(secret)
-    api.reveal_secret(org: org, secret: secret)
+  def reveal_secret(secret, required: false)
+    api.reveal_secret(org: org, secret: secret, required: required)
+  end
+
+  def create_sensitive_secret(secret, data)
+    api.create_sensitive_secret(org: org, secret: secret, app: gvc, data: data)
+  end
+
+  def patch_sensitive_secret_data(secret, data)
+    api.patch_sensitive_secret_data(org: org, secret: secret, data: data)
+  end
+
+  def secret_access_report(secret)
+    api.secret_access_report(org: org, secret: secret)
+  end
+
+  def delete_secret(secret)
+    api.delete_secret(org: org, secret: secret)
   end
 
   # identities
@@ -450,6 +466,10 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     api.fetch_policy(org: org, policy: policy)
   end
 
+  def delete_policy(policy)
+    api.delete_policy(org: org, policy: policy)
+  end
+
   def bind_identity_to_policy(identity_link, policy)
     cmd = [
       "cpln", "policy", "add-binding", policy,

data/lib/core/controlplane_api.rb

@@ -122,14 +122,40 @@ class ControlplaneApi # rubocop:disable Metrics/ClassLength
     api_json("/org/#{org}/secret/#{secret}", method: :get)
   end
 
-  def reveal_secret(org:, secret:)
+  def create_sensitive_secret(org:, secret:, app:, data:)
+    api_json(
+      "/org/#{org}/secret", method: :post,
+                            body: { kind: "secret", name: secret, type: "dictionary", data: data,
+                                    tags: { Config::GENERATED_REVIEW_APP_TAG => app } },
+                            request_policy: ControlplaneApiDirect::SENSITIVE_MUTATION_REQUEST_POLICY
+    )
+  end
+
+  def patch_sensitive_secret_data(org:, secret:, data:)
+    api_json(
+      "/org/#{org}/secret/#{secret}", method: :patch,
+                                      body: { data: data },
+                                      request_policy: ControlplaneApiDirect::SENSITIVE_MUTATION_REQUEST_POLICY
+    )
+  end
+
+  def reveal_secret(org:, secret:, required: false)
+    request_policy = if required
+                       ControlplaneApiDirect::REQUIRED_SENSITIVE_READ_REQUEST_POLICY
+                     else
+                       ControlplaneApiDirect::BEST_EFFORT_SENSITIVE_REQUEST_POLICY
+                     end
     api_json(
       "/org/#{org}/secret/#{secret}/-reveal",
       method: :get,
-      request_policy: ControlplaneApiDirect::BEST_EFFORT_SENSITIVE_REQUEST_POLICY
+      request_policy: request_policy
     )
   end
 
+  def secret_access_report(org:, secret:)
+    api_json("/org/#{org}/secret/#{secret}/-accessreport", method: :get)
+  end
+
   def delete_secret(org:, secret:)
     api_json("/org/#{org}/secret/#{secret}", method: :delete)
   end

data/lib/core/controlplane_api_direct.rb

@@ -75,6 +75,16 @@ class ControlplaneApiDirect # rubocop:disable Metrics/ClassLength
     retry_transient: false,
     timeout: BEST_EFFORT_TIMEOUT_SECONDS
   )
+  REQUIRED_SENSITIVE_READ_REQUEST_POLICY = RequestPolicy.new(
+    sensitive: true,
+    retry_transient: true,
+    timeout: 30
+  )
+  SENSITIVE_MUTATION_REQUEST_POLICY = RequestPolicy.new(
+    sensitive: true,
+    retry_transient: false,
+    timeout: 30
+  )
 
   # Thread-safe API token cache. A single instance is shared process-wide by
   # default (see `default_token_provider`) so each `ControlplaneApiDirect.new`
@@ -328,6 +338,7 @@ class ControlplaneApiDirect # rubocop:disable Metrics/ClassLength
   def handle_response(response, url, request_policy)
     case response
     when Net::HTTPOK then parse_response_body(response, request_policy)
+    when Net::HTTPCreated then parse_created_response_body(response, request_policy)
     when Net::HTTPAccepted then true
     when Net::HTTPNotFound then nil
     when Net::HTTPForbidden then raise(ForbiddenError.new(url: url, response: response))
@@ -343,6 +354,12 @@ class ControlplaneApiDirect # rubocop:disable Metrics/ClassLength
     raise JSON::ParserError, "Control Plane API returned invalid JSON for a sensitive request.", cause: nil
   end
 
+  def parse_created_response_body(response, request_policy)
+    return true if response.body.to_s.empty?
+
+    parse_response_body(response, request_policy)
+  end
+
   def response_error_message(response, request_policy)
     return response.to_s if request_policy.sensitive
 

data/lib/core/disposable_postgres_helpers.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+
+# Ownership is asserted only by opted-in templates creating new resources. Names
+# locate candidates; the marker, shape and exact policy scope authorize cleanup.
+class DisposablePostgresHelpers # rubocop:disable Metrics/ClassLength
+  TAG = "cpflow-disposable-postgres-app"
+
+  def initialize(config, controlplane)
+    @config = config
+    @cp = controlplane
+  end
+
+  def prepare_templates!(templates) # rubocop:disable Metrics/CyclomaticComplexity
+    marked = templates.select { |template| marked?(template) }
+    return if marked.empty?
+
+    unless disposable?
+      marked.each { |template| template["tags"].delete(TAG) }
+      return
+    end
+    candidates = templates.select { |template| resource_types.key?(template.values_at("kind", "name")) }
+    existing = fetch_resources
+    refuse! unless (candidates + existing).all? { |resource| owned?(resource) }
+    ensure_not_shared!(existing)
+  end
+
+  def validate!
+    return [] unless disposable?
+
+    resources = fetch_resources
+    # Legacy templates did not assert ownership. Preserve them without adoption.
+    return [] unless resources.any? { |resource| marked?(resource) }
+
+    refuse! unless resources.all? { |resource| owned?(resource) }
+    ensure_not_shared!(resources)
+    resources
+  end
+
+  def delete(&operation)
+    # Remove access before secrets. Surviving marked secrets can be cleaned up
+    # after a failure even when the policy or GVC no longer exists.
+    validate!.sort_by { |resource| resource["kind"] == "policy" ? 0 : 1 }.each do |resource|
+      current = validate!.find { |item| item["name"] == resource["name"] }
+      next unless current
+
+      kind, name = current.values_at("kind", "name")
+      operation.call(kind, name) { kind == "policy" ? @cp.delete_policy(name) : @cp.delete_secret(name) }
+    end
+  end
+
+  private
+
+  def disposable?
+    !@config.disposable_review_secret_resource_names.nil?
+  end
+
+  def marked?(resource)
+    resource["tags"].is_a?(Hash) && resource["tags"].key?(TAG)
+  end
+
+  def fetch_resources
+    resource_types.filter_map do |(kind, name), _type|
+      resource = fetch(kind, name)
+      resource&.merge("kind" => kind)
+    end
+  end
+
+  def shared?
+    names = resource_types.keys.map(&:last)
+    @config.shared_secret_grants.any? do |grant|
+      [grant[:secret_name], grant[:policy_name]].any? { |name| names.include?(name) }
+    end
+  end
+
+  def ensure_not_shared!(resources)
+    refuse! if shared?
+    resources.select { |resource| resource["kind"] == "secret" }.each do |secret|
+      report = @cp.secret_access_report(secret["name"])
+      refuse! unless exclusive_access_report?(report)
+    end
+  end
+
+  def exclusive_access_report?(report) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+    return false unless report.is_a?(Hash) && report["kind"] == "accessreport"
+
+    permissions = report["permissions"]
+    return false unless permissions.is_a?(Array) && permissions.all?(Hash)
+
+    %w[reveal use].all? do |name|
+      entries = permissions.select { |item| item["name"] == name }
+      entries.one? && entries.first["bindings"].is_a?(Array) &&
+        entries.first["bindings"].all? { |binding| exclusive_access_binding?(binding) }
+    end
+  end
+
+  def exclusive_access_binding?(binding)
+    return false unless binding.is_a?(Hash)
+
+    principal = binding["principalLink"]
+    policy_link = "/org/#{@config.org}/policy/#{@config.app}-pg-access"
+    return true if binding["grantingPolicyLink"] == policy_link && app_principals.include?(principal)
+
+    # Global human/service administration is not an application dependency.
+    # A targeted/query grant, or ANY other GVC identity, still means shared use.
+    admin_path = %r{\A/org/#{Regexp.escape(@config.org)}/(?:group|user|serviceaccount)/[^/]+\z}
+    binding["match"] == "all" && binding["grantedPermissions"] == ["manage"] &&
+      principal.is_a?(String) && principal.match?(admin_path)
+  end
+
+  def app_principals
+    [@config.identity, "#{@config.app}-pg-identity"].flat_map do |identity|
+      path = "gvc/#{@config.app}/identity/#{identity}"
+      ["//#{path}", "/org/#{@config.org}/#{path}"]
+    end
+  end
+
+  def resource_types
+    app = @config.app
+    { ["secret", "#{app}-pg"] => "dictionary", ["secret", "#{app}-pg-script"] => "opaque",
+      ["policy", "#{app}-pg-access"] => nil }
+  end
+
+  def fetch(kind, name)
+    kind == "policy" ? @cp.fetch_policy(name) : @cp.fetch_secret(name)
+  end
+
+  def owned?(resource)
+    key = resource.values_at("kind", "name")
+    tags = resource["tags"]
+    return false unless resource_types.key?(key) && tags.is_a?(Hash) && tags[TAG] == @config.app
+
+    resource["kind"] == "secret" ? resource["type"] == resource_types[key] : policy_owned?(resource)
+  end
+
+  def policy_owned?(policy)
+    return false unless policy["targetKind"] == "secret" &&
+                        %w[target targetQuery gvc].all? { |key| policy[key].nil? }
+
+    targets_owned?(policy["targetLinks"]) && bindings_owned?(policy["bindings"])
+  end
+
+  def targets_owned?(links)
+    names = ["#{@config.app}-pg", "#{@config.app}-pg-script"]
+    links.is_a?(Array) && links.size == 2 && names.all? do |name|
+      links.one? { |link| ["//secret/#{name}", "/org/#{@config.org}/secret/#{name}"].include?(link) }
+    end
+  end
+
+  def bindings_owned?(bindings)
+    return false unless bindings.is_a?(Array)
+
+    bindings.all? { |binding| binding_owned?(binding, app_principals) }
+  end
+
+  def binding_owned?(binding, principals)
+    return false unless binding.is_a?(Hash) && (binding.keys - %w[permissions principalLinks]).empty?
+
+    permissions, links = binding.values_at("permissions", "principalLinks")
+    permissions.is_a?(Array) && (permissions - ["reveal"]).empty? &&
+      links.is_a?(Array) && (links - principals).empty?
+  end
+
+  def refuse!
+    raise "PostgreSQL helper resources have unexpected ownership, grants, target, or access report; " \
+          "leaving them for inspection."
+  end
+end

data/lib/core/doctor_service.rb

@@ -37,6 +37,7 @@ class DoctorService # rubocop:disable Metrics/ClassLength
   def validate_config
     check_for_app_names_contained_in_others
     check_deploy_orders
+    check_generated_review_secret_settings
   end
 
   def validate_templates
@@ -66,6 +67,12 @@ class DoctorService # rubocop:disable Metrics/ClassLength
     raise ValidationError, Shell.color("ERROR: #{e.message}", :red)
   end
 
+  def check_generated_review_secret_settings
+    config.validate_generated_review_secret_settings!
+  rescue RuntimeError => e
+    raise ValidationError, Shell.color("ERROR: #{e.message}", :red)
+  end
+
   def find_app_names_contained_in_others # rubocop:disable Metrics/CyclomaticComplexity, Metrics/MethodLength
     app_names = config.apps.keys.map(&:to_s).sort
     app_prefixes = config.apps

data/lib/core/github_flow_readiness/checks.rb

@@ -105,10 +105,11 @@ module GithubFlowReadiness
     class SqliteProduction < Base
       def call
         return unless service.sqlite_database_in_production?
+        return if service.dynamic_database_url_in_production?
 
         info_result(
           "Production database config uses SQLite. `cpflow generate` will scaffold " \
-          "persistent `db` and `storage` volumes."
+          "persistent SQLite data and Active Storage volumes."
         )
       end
     end

data/lib/core/github_flow_readiness_service.rb

@@ -105,6 +105,10 @@ class GithubFlowReadinessService # rubocop:disable Metrics/ClassLength
     RepoIntrospection.sqlite_database_in_production?(root_path.to_s)
   end
 
+  def dynamic_database_url_in_production?
+    RepoIntrospection.dynamic_database_url_in_production?(root_path.to_s)
+  end
+
   def parsed_package_json
     return @parsed_package_json if instance_variable_defined?(:@parsed_package_json)