critical
hosted, paid — --remote
DROP OWNED BY erasing everything a role owns
Critical — this fails outright or takes production down.
What it catches
DROP OWNED BY removes every object the role owns in the current database and revokes its grants — the blast radius is whatever that role ever created, which nobody can enumerate from the migration text.
Fires on
DROP OWNED BY deploy_user;Do this instead
REASSIGN OWNED BY transfers every object to a surviving role first; after that, DROP OWNED BY only revokes grants and the role can be dropped safely. Never run DROP OWNED while the role still owns objects you have not enumerated.
-- Transfer ownership instead of dropping the objects:
REASSIGN OWNED BY deploy_user TO app_owner;
-- now only grants remain attached to the role:
-- DROP OWNED BY deploy_user; -- revokes grants only
-- DROP ROLE deploy_user;Catch this before it ships
This rule runs in the hosted service on Startup and above — add --remote with a team token, or use the GitHub Action: npx bolvrk check migration.sql