How GitHub converts previously encrypted and unencrypted columns to ActiveRecord encrypted columns

This post details the technical implementation of migrating existing plaintext and previously encrypted database columns to ActiveRecord encrypted columns. It covers the design decisions for a simplified migration pattern, including the use of `ActiveRecord::Encryption`'s previous encryptor strategy to isolate plaintext mode to specific models, and a feature flag mechanism to control encryption rollout. It also addresses a caveat with `changed_in_place?` when migrating from deprecated internal encryption and explains how key rotation is handled by adding new keys and re-encrypting records.