fix: Restore Heroku deploy button setup

[gut-puncture]

Fixes #404.

This refreshes the Heroku quick-start path so the deploy button no longer depends on the retired mLab add-on and the app can build the TypeScript output that npm start expects.

Changes:

• add required DATABASE_URI prompt to app.json
• remove the retired mongolab add-on and deprecated image key from app.json
• update the repository URL and SERVER_URL example to current HTTPS values
• generate MASTER_KEY instead of shipping a fixed default
• add heroku-postbuild so Heroku builds dist/ before running node dist/index.js
• update the README Heroku instructions to match the current setup flow

Verification:

• Parsed app.json and package.json with Node
• git diff --check

I did not create a live Heroku app from this environment, so this PR focuses on making the manifest and documented flow current and internally consistent.

Summary by CodeRabbit

• Documentation

  • Updated Heroku manual deployment guide to replace deprecated MongoDB add-on instructions with guidance for configuring custom MongoDB databases via connection string environment variables.

• Chores

  • Improved Heroku deployment configuration with mandatory database requirements, secure key generation, and automated build step execution during deployment.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 812fce61-2fbf-42c4-a3bf-7a525631a36d

📥 Commits

Reviewing files that changed from the base of the PR and between 9867131 and f8a8d35.

📒 Files selected for processing (3)

• README.md
• app.json
• package.json

---

📝 Walkthrough

Walkthrough

This PR updates Heroku deployment configuration, build automation, and documentation. The app.json manifest is updated to mark DATABASE_URI as required, add secret generation for MASTER_KEY, and migrate SERVER_URL to https. A heroku-postbuild script is added to package.json, and README instructions are revised to remove the retired mLab MongoDB add-on and explain external database setup.

Changes

Heroku Deployment Configuration Update

Layer / File(s)	Summary
Environment and Metadata Configuration app.json	repository URL is updated; DATABASE_URI is marked as required: true; MASTER_KEY gains generator: "secret"; SERVER_URL is changed to https with revised description.
Build Script for Heroku package.json	heroku-postbuild npm script is added to run npm run build during Heroku post-install phase.
Manual Deployment Documentation README.md	Manual Heroku deployment steps are updated to remove mLab add-on instructions and add guidance for creating an external MongoDB database, configuring DATABASE_URI, and setting SERVER_URL to the Heroku app URL.

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 6 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Engage In Review Feedback	❓ Inconclusive	Cannot verify review engagement without access to GitHub PR interface containing review comments. Repository contains only code and commit history, not PR discussion metadata.	Check the actual GitHub PR page to see if review comments exist and whether the author engaged with feedback or convinced reviewers to retract concerns.

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR title follows the required format prefix 'fix:' and accurately describes the main change: restoring Heroku deploy button setup by removing retired dependencies and updating configuration.
Linked Issues check	✅ Passed	All coding requirements from issue #404 are met: removed retired mLab add-on, updated app.json manifest, added heroku-postbuild script, and updated README documentation for current Heroku deployment flow.
Out of Scope Changes check	✅ Passed	All changes are directly related to fixing Heroku deployment: README updates, app.json configuration fixes, and package.json build script addition are all within scope of issue #404.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Security Check	✅ Passed	No vulnerabilities found. MASTER_KEY uses secure generation, DATABASE_URI is required, deprecated mLab removed, HTTPS enforced, no hardcoded secrets or injection vectors.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 OpenGrep (1.20.0)

OpenGrep fatal error (exit code 2): [00.24][ERROR]: Error: exception Unix_error: No such file or directory stat app.json
Raised by primitive operation at UTmp.replace_named_pipe_by_regular_file_if_needed in file "libs/commons/UTmp.ml", line 145, characters 8-27
Called from Scan_CLI.replace_target_roots_by_regular_files_where_needed.(fun) in file "src/osemgrep/cli_scan/Scan_CLI.ml", lines 1086-1087, characters 19-65
Called from List_.fast_map in file "libs/commons/List_.ml", line 81, characters 17-20
Called from Scan_CLI.replace_ta

🔧 Checkov (3.2.526)

package.json

2026-05-10 23:26:01,807 [MainThread ] [ERROR] Template file not found: package.json
2026-05-10 23:26:01,812 [MainThread ] [ERROR] Template file not found: package.json
2026-05-10 23:26:01,819 [MainThread ] [ERROR] Template file not found: package.json
2026-05-10 23:26:01,887 [MainThread ] [ERROR] Failed to invoke function /usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner. with package.json
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 88, in func_wrapper
result = original_func(item)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner.py", line 74, in
results = parallel_runner.run_function(lambda f: (f, self._parse_file(f)), files_to_load)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/ope

... [truncated 2548 characters] ...

k__)
FileNotFoundError: [Errno 2] No such file or directory: 'package.json'
2026-05-10 23:26:01,937 [MainThread ] [ERROR] Exception traceback:
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/main.py", line 647, in run
self.scan_reports = runner_registry.run(
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/runner_registry.py", line 177, in run
for result in parallel_runner_results:
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 118, in _run_function_multiprocess_fork
raise v.internal_exception.with_traceback(v.internal_exception.traceback)
FileNotFoundError: [Errno 2] No such file or directory: 'package.json'

app.json

2026-05-10 23:26:01,810 [MainThread ] [ERROR] Template file not found: app.json
2026-05-10 23:26:01,823 [MainThread ] [ERROR] Template file not found: app.json
2026-05-10 23:26:01,817 [MainThread ] [ERROR] Template file not found: app.json
2026-05-10 23:26:01,891 [MainThread ] [ERROR] Failed to invoke function /usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner. with app.json
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 88, in func_wrapper
result = original_func(item)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner.py", line 74, in
results = parallel_runner.run_function(lambda f: (f, self._parse_file(f)), files_to_load)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/openapi/runner.py",

... [truncated 2512 characters] ...

01,945 [MainThread ] [WARNI] Secret scanning: could not process file app.json
2026-05-10 23:26:01,954 [MainThread ] [ERROR] Exception traceback:
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/main.py", line 647, in run
self.scan_reports = runner_registry.run(
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/runner_registry.py", line 177, in run
for result in parallel_runner_results:
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 118, in _run_function_multiprocess_fork
raise v.internal_exception.with_traceback(v.internal_exception.traceback)
FileNotFoundError: [Errno 2] No such file or directory: 'app.json'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gut-puncture]

Ready for review. This is scoped to #404 and updates the Heroku deploy-button path that was still using the retired mLab add-on and missing the build step needed for node dist/index.js.