From ff7831eacad07f7cdcc500e5c1d0a2777789ecf6 Mon Sep 17 00:00:00 2001 From: Justin Gordon Date: Wed, 2 Sep 2026 12:01:10 -1000 Subject: [PATCH 1/2] Upgrade Control Plane Flow wrappers to v5.3.0 Regenerate the cpflow GitHub Actions wrappers for cpflow 5.3.0 so the deploy and delete callers carry the reconcile_intent_run_id input and actions: write permission the v5.3.0 reusable workflows require. Co-Authored-By: Claude Fable 5.1 --- .github/cpflow-help.md | 8 ++++---- .../workflows/cpflow-cleanup-stale-review-apps.yml | 2 +- .github/workflows/cpflow-delete-review-app.yml | 12 +++++++++++- .github/workflows/cpflow-deploy-review-app.yml | 11 ++++++++++- .github/workflows/cpflow-deploy-staging.yml | 2 +- .github/workflows/cpflow-help-command.yml | 2 +- .../cpflow-promote-staging-to-production.yml | 4 ++-- .github/workflows/cpflow-review-app-help.yml | 2 +- Gemfile | 2 +- Gemfile.lock | 4 ++-- 10 files changed, 34 insertions(+), 15 deletions(-) diff --git a/.github/cpflow-help.md b/.github/cpflow-help.md index a66b58ef..f9b734df 100644 --- a/.github/cpflow-help.md +++ b/.github/cpflow-help.md @@ -2,7 +2,7 @@ These commands are generated by [cpflow](https://github.com/shakacode/control-plane-flow). For full setup, version-pinning, and troubleshooting details, see the upstream -[CI automation guide](https://github.com/shakacode/control-plane-flow/blob/v5.2.0/docs/ci-automation.md). +[CI automation guide](https://github.com/shakacode/control-plane-flow/blob/v5.3.0/docs/ci-automation.md). ## Pull Request Commands @@ -130,7 +130,7 @@ production org, using production-only secrets and values. ## Version Locking Generated wrappers pin Control Plane Flow with a release tag, for example -`v5.2.0`. Reusable review-app, staging, cleanup, and +`v5.3.0`. Reusable review-app, staging, cleanup, and helper workflows pin the tag in their `uses:` ref. Production promotion pins the same tag in the `Checkout control-plane-flow actions` step so the caller-owned job can keep `environment: production` and receive production @@ -138,8 +138,8 @@ environment secrets directly. Leave `CPFLOW_VERSION` unset so the workflow builds cpflow from the same checked-out upstream source. If you set `CPFLOW_VERSION`, it must match the -release tag your wrappers are pinned to: a `CPFLOW_VERSION=5.2.x` runtime -override goes with a wrapper pinned to `uses: ...@v5.2.x` (substitute the +release tag your wrappers are pinned to: a `CPFLOW_VERSION=5.3.x` runtime +override goes with a wrapper pinned to `uses: ...@v5.3.x` (substitute the release you pinned above). After updating the `cpflow` gem in this repo, update the generated wrappers in diff --git a/.github/workflows/cpflow-cleanup-stale-review-apps.yml b/.github/workflows/cpflow-cleanup-stale-review-apps.yml index f4d9504a..17ffef56 100644 --- a/.github/workflows/cpflow-cleanup-stale-review-apps.yml +++ b/.github/workflows/cpflow-cleanup-stale-review-apps.yml @@ -12,6 +12,6 @@ jobs: cleanup: # Cleanup targets the current inferred review-app prefix. If you changed # naming conventions, manually delete review apps under the old prefix. - uses: shakacode/control-plane-flow/.github/workflows/cpflow-cleanup-stale-review-apps.yml@v5.2.0 + uses: shakacode/control-plane-flow/.github/workflows/cpflow-cleanup-stale-review-apps.yml@v5.3.0 secrets: CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }} diff --git a/.github/workflows/cpflow-delete-review-app.yml b/.github/workflows/cpflow-delete-review-app.yml index 53f87243..b9742175 100644 --- a/.github/workflows/cpflow-delete-review-app.yml +++ b/.github/workflows/cpflow-delete-review-app.yml @@ -1,5 +1,7 @@ name: Delete Review App +run-name: "Delete Review App - PR #${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }}" + on: pull_request_target: types: [closed] @@ -11,9 +13,15 @@ on: description: Pull request number targeted for deletion required: true type: number + reconcile_intent_run_id: + description: Authenticated internal handoff; manual values are rejected + required: false + type: string permissions: + actions: write contents: read + deployments: write issues: write pull-requests: write @@ -22,6 +30,8 @@ jobs: # pull_request_target is intentional: fork PR-close events need access to # staging secrets to delete review apps and update PR comments. The upstream # reusable workflow checks out trusted base-branch action code, not fork code. + # author_association is a cheap caller-side cost filter. The reusable workflow + # still checks the commenter's current repository permission before privileged work. if: | (github.event_name == 'issue_comment' && github.event.issue.pull_request && @@ -31,6 +41,6 @@ jobs: github.event_name == 'workflow_dispatch' # This `if:` mirrors the upstream job guard to avoid a billable workflow_call # when the event does not match. Keep both conditions in sync. - uses: shakacode/control-plane-flow/.github/workflows/cpflow-delete-review-app.yml@v5.2.0 + uses: shakacode/control-plane-flow/.github/workflows/cpflow-delete-review-app.yml@v5.3.0 secrets: CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }} diff --git a/.github/workflows/cpflow-deploy-review-app.yml b/.github/workflows/cpflow-deploy-review-app.yml index 056ed624..e9d07ea0 100644 --- a/.github/workflows/cpflow-deploy-review-app.yml +++ b/.github/workflows/cpflow-deploy-review-app.yml @@ -13,15 +13,24 @@ on: description: Pull request number to deploy required: true type: number + reconcile_intent_run_id: + description: Authenticated internal handoff; manual values are rejected + required: false + type: string permissions: + actions: write contents: read deployments: write issues: write pull-requests: write jobs: + # The reusable job exposes `image_built`; downstream jobs can read + # `needs.deploy.outputs.image_built`. A value of `false` means this check did not validate the Docker image. deploy: + # author_association is a cheap caller-side cost filter. The reusable workflow + # still checks the commenter's current repository permission before privileged work. if: | (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || @@ -30,7 +39,7 @@ jobs: github.event.issue.pull_request && contains(fromJson('["+review-app-deploy","+review-app-deploy\n","+review-app-deploy\r\n"]'), github.event.comment.body) && contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) - uses: shakacode/control-plane-flow/.github/workflows/cpflow-deploy-review-app.yml@v5.2.0 + uses: shakacode/control-plane-flow/.github/workflows/cpflow-deploy-review-app.yml@v5.3.0 secrets: CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }} DOCKER_BUILD_SSH_KEY: ${{ secrets.DOCKER_BUILD_SSH_KEY }} diff --git a/.github/workflows/cpflow-deploy-staging.yml b/.github/workflows/cpflow-deploy-staging.yml index 13e2c644..7875e214 100644 --- a/.github/workflows/cpflow-deploy-staging.yml +++ b/.github/workflows/cpflow-deploy-staging.yml @@ -16,7 +16,7 @@ permissions: jobs: deploy-staging: - uses: shakacode/control-plane-flow/.github/workflows/cpflow-deploy-staging.yml@v5.2.0 + uses: shakacode/control-plane-flow/.github/workflows/cpflow-deploy-staging.yml@v5.3.0 with: staging_app_branch_default: "master" secrets: diff --git a/.github/workflows/cpflow-help-command.yml b/.github/workflows/cpflow-help-command.yml index a1004606..29556e65 100644 --- a/.github/workflows/cpflow-help-command.yml +++ b/.github/workflows/cpflow-help-command.yml @@ -23,4 +23,4 @@ jobs: contains(fromJson('["+review-app-help","+review-app-help\n","+review-app-help\r\n"]'), github.event.comment.body) && contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || github.event_name == 'workflow_dispatch' - uses: shakacode/control-plane-flow/.github/workflows/cpflow-help-command.yml@v5.2.0 + uses: shakacode/control-plane-flow/.github/workflows/cpflow-help-command.yml@v5.3.0 diff --git a/.github/workflows/cpflow-promote-staging-to-production.yml b/.github/workflows/cpflow-promote-staging-to-production.yml index 1929f0a1..5ef27063 100644 --- a/.github/workflows/cpflow-promote-staging-to-production.yml +++ b/.github/workflows/cpflow-promote-staging-to-production.yml @@ -69,7 +69,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd with: repository: shakacode/control-plane-flow - ref: v5.2.0 + ref: v5.3.0 path: .cpflow persist-credentials: false @@ -179,7 +179,7 @@ jobs: cpln_cli_version: ${{ vars.CPLN_CLI_VERSION }} cpflow_version: ${{ vars.CPFLOW_VERSION }} # The setup action validates CPFLOW_VERSION against this full workflow ref. - control_plane_flow_ref: shakacode/control-plane-flow/.github/workflows/cpflow-promote-staging-to-production.yml@v5.2.0 + control_plane_flow_ref: shakacode/control-plane-flow/.github/workflows/cpflow-promote-staging-to-production.yml@v5.3.0 # Runs after Setup production environment so the pinned Ruby (>= 3.1) is on PATH. # YAML.load_file(..., aliases: true) is not supported on Ruby 3.0 (system Ruby on ubuntu-22.04). diff --git a/.github/workflows/cpflow-review-app-help.yml b/.github/workflows/cpflow-review-app-help.yml index c844dad4..977d03c7 100644 --- a/.github/workflows/cpflow-review-app-help.yml +++ b/.github/workflows/cpflow-review-app-help.yml @@ -18,4 +18,4 @@ jobs: # to PR-open help. Remove it, or uncomment and adapt this guard, if forks or # clones should stay quiet until Control Plane is configured: # if: vars.REVIEW_APP_PREFIX != '' || vars.CPLN_ORG_STAGING != '' - uses: shakacode/control-plane-flow/.github/workflows/cpflow-review-app-help.yml@v5.2.0 + uses: shakacode/control-plane-flow/.github/workflows/cpflow-review-app-help.yml@v5.3.0 diff --git a/Gemfile b/Gemfile index 48166fea..664c097f 100644 --- a/Gemfile +++ b/Gemfile @@ -5,7 +5,7 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" } ruby "3.4.6" -gem "cpflow", "5.2.0", require: false +gem "cpflow", "5.3.0", require: false gem "react_on_rails_pro", "17.0.0" gem "shakapacker", "10.2.0" diff --git a/Gemfile.lock b/Gemfile.lock index 8e3d128c..ddb15b9f 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -143,7 +143,7 @@ GEM term-ansicolor (~> 1.6) thor (>= 0.20.3, < 2.0) tins (~> 1.16) - cpflow (5.2.0) + cpflow (5.3.0) dotenv (~> 3.1) jwt (~> 3.1) psych (~> 5.2) @@ -530,7 +530,7 @@ DEPENDENCIES capybara-screenshot coffee-rails coveralls_reborn (~> 0.25.0) - cpflow (= 5.2.0) + cpflow (= 5.3.0) database_cleaner debug (>= 1.0.0) factory_bot_rails From 53b8d5992b90ef351f701bd6443fc361c2c28153 Mon Sep 17 00:00:00 2001 From: Justin Gordon Date: Wed, 2 Sep 2026 15:58:33 -1000 Subject: [PATCH 2/2] docs: align cpflow upgrade instructions with 5.3.0 --- .controlplane/docs/testing-cpflow-github-actions.md | 7 ++++--- .controlplane/readme.md | 6 +++--- .controlplane/shakacode-team.md | 4 ++-- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.controlplane/docs/testing-cpflow-github-actions.md b/.controlplane/docs/testing-cpflow-github-actions.md index c39a7244..0e3d915d 100644 --- a/.controlplane/docs/testing-cpflow-github-actions.md +++ b/.controlplane/docs/testing-cpflow-github-actions.md @@ -1,7 +1,7 @@ # Testing cpflow GitHub Actions Changes Generic reusable-workflow behavior belongs upstream in the -[`control-plane-flow` CI automation guide](https://github.com/shakacode/control-plane-flow/blob/v5.2.0/docs/ci-automation.md). +[`control-plane-flow` CI automation guide](https://github.com/shakacode/control-plane-flow/blob/v5.3.0/docs/ci-automation.md). Use this repo note only as the canary checklist for `react-webpack-rails-tutorial`. @@ -30,8 +30,9 @@ bin/conductor-exec bin/test-cpflow-github-flow ruby /path/to/control-plane-flow/ ``` Leave `CPFLOW_VERSION` unset while testing a commit SHA. After the upstream PR -ships in a release tag, repin wrappers to that tag. Use `v5.2.0` for the -promotion-hardening and release-runner timeout fixes; use immutable commit SHAs +ships in a release tag, repin wrappers to that tag. Use `v5.3.0` for the +current review-app flow, including the earlier promotion-hardening and +release-runner timeout fixes; use immutable commit SHAs only for future unreleased upstream PR tests. ## Review App Canary diff --git a/.controlplane/readme.md b/.controlplane/readme.md index 9586eec9..b569acbb 100644 --- a/.controlplane/readme.md +++ b/.controlplane/readme.md @@ -23,7 +23,7 @@ You can see the definition of Postgres and Redis in the `.controlplane/templates This repo uses the generated `cpflow-*` GitHub Actions wrappers. Keep the generic behavior documented upstream in the -[`control-plane-flow` CI automation guide](https://github.com/shakacode/control-plane-flow/blob/v5.2.0/docs/ci-automation.md); +[`control-plane-flow` CI automation guide](https://github.com/shakacode/control-plane-flow/blob/v5.3.0/docs/ci-automation.md); this section only lists the values that are specific to this app. ### Review Apps and Staging @@ -629,13 +629,13 @@ React on Rails docs reference: ### Updating Generated cpflow Workflows Keep the reusable-workflow mechanics in the upstream -[`control-plane-flow` CI automation guide](https://github.com/shakacode/control-plane-flow/blob/v5.2.0/docs/ci-automation.md). +[`control-plane-flow` CI automation guide](https://github.com/shakacode/control-plane-flow/blob/v5.3.0/docs/ci-automation.md). For this repo, the update loop is: 1. Update the bundled `cpflow` gem to the desired release. 2. Refresh generated wrappers from that release with `--staging-branch master`. 3. Keep generated refs on the same release tag as the bundled `cpflow` gem. - This branch pins refs to `v5.2.0`, which includes upstream promotion + This branch pins refs to `v5.3.0`, which includes upstream promotion hardening and the release-runner timeout fix. Use a full commit SHA only for short-lived upstream testing and leave `CPFLOW_VERSION` unset in that case. 4. Keep app names and GitHub settings aligned with `.controlplane/controlplane.yml`. diff --git a/.controlplane/shakacode-team.md b/.controlplane/shakacode-team.md index c29eb96e..86ccb409 100644 --- a/.controlplane/shakacode-team.md +++ b/.controlplane/shakacode-team.md @@ -126,9 +126,9 @@ cpflow apply-template app postgres redis daily-task node-renderer rails \ ``` Advanced optional settings are documented upstream in the -[`control-plane-flow` CI automation guide](https://github.com/shakacode/control-plane-flow/blob/v5.2.0/docs/ci-automation.md). +[`control-plane-flow` CI automation guide](https://github.com/shakacode/control-plane-flow/blob/v5.3.0/docs/ci-automation.md). -Current workflow wrappers pin `control-plane-flow` release tag `v5.2.0`, which +Current workflow wrappers pin `control-plane-flow` release tag `v5.3.0`, which includes promotion hardening and the release-runner timeout fix. Keep release tags as the steady-state configuration; use a full commit SHA only for short-lived upstream testing and leave `CPFLOW_VERSION` unset in that case.