Bump shakacode/control-plane-flow/.github/workflows/cpflow-review-app-help.yml from 5.2.0 to 5.3.0

[dependabot]

Bumps shakacode/control-plane-flow/.github/workflows/cpflow-review-app-help.yml from 5.2.0 to 5.3.0.

Release notes

Sourced from shakacode/control-plane-flow/.github/workflows/cpflow-review-app-help.yml's releases.

v5.3.0

Added

• Added an early diagnostic warning when a shared_secret_grants target still uses the generated Postgres password placeholder. setup-app and deploy-image now identify the affected grant and secret before release or deployment work without printing secret values. PR 441 by Justin Gordon. Fixes issue 421.
• Added CPFLOW_GVC_ID and CPFLOW_GVC_CREATED to the environment of one-off jobs started by cpflow run, exposing the app's immutable GVC identity so that a release script can tell which GVC incarnation it is running in. PR 433 by Justin Gordon. Fixes issue 432. Unlike the mutable CPLN_GVC_ALIAS, these values identify the GVC incarnation itself, so they change only when a GVC is deleted and recreated under the same name. CPFLOW_GVC_CREATED is an ISO 8601 UTC timestamp with millisecond precision and a Z suffix. Both variables are always set and are empty when the GVC cannot be read, so a consumer can fail closed; they are never omitted, because the runner inherits the original workload's environment and an omitted variable could otherwise expose a stale inherited value.
• Added bounded retry with exponential backoff to direct Control Plane API requests. PR 416 by Justin Gordon. Fixes issue 383. With the default request policy, GET requests retry transient network errors and retryable HTTP responses for up to three attempts; another attempt is approved only when the retry decision occurs before a 120-second deadline. Delta-seconds Retry-After values are honored up to a 10-second cap; HTTP-date values fall back to jittered backoff. Under that policy, explicit HTTP 429 responses are retried for every method. Best-effort sensitive requests disable all transient retries. Mutating requests are not retried after ambiguous transport failures once they may have reached the server. Net::HTTP's hidden resend of PUT and DELETE requests is disabled. A failed cpln profile token lookup now raises an actionable error instead of continuing with unusable output.

Changed

• Simplified generated review-app help comments to a three-command quick reference, moved setup behind expandable details, and clarified GitHub Actions secret and variable terminology. PR 410 by Justin Gordon.
• Updated reusable GitHub Actions setup to install Control Plane CLI 3.11.0 by default. PR 423 by Justin Gordon.

Fixed

• Fixed cpflow run runner observation so a missing replica no longer relies on the generic 1,001-poll retry loop or exits without the cron status. PR 435 by Justin Gordon. Replica observation now uses a monotonic deadline capped by the smaller of runner_job_timeout and 1,000 seconds, stops polling when that deadline is reached, fails immediately on terminal non-success, and preserves replica-found and success-before-replica behavior.
• Fixed review-app deploy and delete authorization failing while recording accepted intent comments. PR 449 by Justin Gordon. The authorization job now has the PR write permission GitHub requires to post bot-owned comments on pull requests. Follow-up to issue 442.
• Made successful review-app checks report when they skipped the Docker image build. PR 444 by Justin Gordon. Fixes issue 412. The reusable workflow now writes a prominent no-build summary and exposes image_built=false, while generated guidance explains that repositories needing Dockerfile validation should use a separate required build gate.
• Fixed cpflow run argument corruption and shell interpolation when command arguments contain spaces, quotes, dollar signs, backticks, or semicolons. PR 443 by Justin Gordon. Fixes issue 381. Separately supplied arguments are shell-escaped at the remote runner boundary, while one quoted command string remains an explicit opt-in to shell syntax; the local cpln workload exec invocation now uses process argv instead of a shell-built command string.
• Fixed generated review-app deploy and delete commands so only the newest accepted operation can mutate an app, even when GitHub replaces a pending concurrency run or authorization finishes out of order. PR 440 by Justin Gordon. Fixes issue 427. GitHub now verifies manual actors have current write, maintain, or admin repository permission both before and after queueing, rejects closed-PR deploys before recording, records accepted triggers as durable bot-owned intents, authenticates each intent against its originating Actions run and successful recording step, binds internal redispatches to the workflow-run ID returned by GitHub and its exact successful dispatch step, and fails closed on lookup or ledger inconsistencies. Edits or deletion of the original command, mixed-case command admission, manual dispatch, and GitHub's single replaceable pending concurrency slot can no longer make an older deploy override a newer delete (or the reverse). After upgrading, run cpflow update-github-actions so the generated deploy and delete caller workflows adopt the new run-name and reconcile_intent_run_id contract; a caller that only bumps the uses: ref is rejected during provenance reconciliation.
• Fixed direct Control Plane API retries so HTTP 429 responses retry every request method and honor Retry-After, while 5xx retries remain limited to idempotent methods. PR 439 by Justin Gordon. Fixes issue 417.
• Fixed the spec suite leaking dummy-test-* GVCs that exhausted the CI org's GVC quota and blocked later runs. PR 434 by Justin Gordon. Fixes issue 399. Apps are now registered for after(:suite) cleanup by the command runner before an app-creating command runs, so a command that fails after creating the GVC, or an example that fails before its own teardown, no longer leaves the app behind. A before(:suite) sweep additionally reclaims apps leaked by runs that were killed before cleanup could run. The sweep is confined to the suite's own org and to the anchored dummy-test-* fixture naming boundary, never touches an app younger than 12 hours or one belonging to the current run, keeps anything it cannot positively identify as stale, and reports rather than raises on failure. This change is limited to the spec suite; no gem behavior changes.
• Fixed review-app deletion leaving successful GitHub deployments active after the Control Plane app was removed. PR 430 by Justin Gordon.
• Fixed template refreshes for existing apps whose workload-list response omits readiness status by consulting each workload's detailed state before selecting a safe fallback image. PR 429 by Justin Gordon.
• Fixed reusable deployment health checks on BYOK locations by falling back from a disabled standard workload endpoint only after every location is settled, while preserving configured app_domain review-app links and using the verified location endpoint as the final URL fallback. PR 426 by Justin Gordon.
• Fixed template refresh recovery for unhealthy or partially deployed review apps by preserving each workload's configured app image independently, while limiting missing-image fallbacks to one unambiguous image from ready workloads. PR 425 by Justin Gordon.
• Fixed reusable review-app deployments so existing apps receive changes from configured setup_app_templates before the new image is deployed, without deleting the GVC, rerunning post-creation hooks, replacing deployed images before rollout gates pass, or modifying existing secret resources. PR 424 by Justin Gordon.
• Fixed cpflow deploy-image crashing when an internal-only workload has no public endpoint. Deployments now consult the existing deployment fallback and report when no public endpoint is available. PR 423 by Justin Gordon.
• Fixed generated review-app status links so reusable deployments prefer the deployed app domain instead of the raw Control Plane workload endpoint. PR 395 by Justin Gordon.

Changelog

Sourced from shakacode/control-plane-flow/.github/workflows/cpflow-review-app-help.yml's changelog.

Changelog

All notable changes to this project's source code will be documented in this file. Items under Unreleased are upcoming features that will be out in the next version.

Contributors

Please follow the recommendations outlined at keepachangelog.com. Please use the existing headings and styling as a guide, and add a link for the version diff at the bottom of the file. Also, please update the Unreleased link to compare it to the latest release version.

In addition to the standard keepachangelog.com categories, this project uses a local ### Breaking Changes heading at the top of each version section to surface backwards-incompatible changes. The release tooling treats that heading as a signal to require a major version bump (see expected_bump_type_from_changelog_section in rakelib/create_release.rake).

Versions

[Unreleased]

[6.0.0] - 2026-09-08

Breaking Changes

• BREAKING CHANGE: Raised the minimum supported Ruby version from 3.0 to 3.2. Users on Ruby 3.0 or 3.1 must upgrade Ruby before installing the next major cpflow release. CI now tests each supported Ruby minor from 3.2 through 3.4. PR 464 by Justin Gordon.

Changed

• Bumped the pinned GitHub Actions in the generated production-promotion workflow and this repository's reusable workflows to actions/checkout 7.0.1, actions/github-script 9.0.0, and docker/setup-buildx-action 4.3.0. Downstream repositories pick up the template change with cpflow update-github-actions. PR 460 by Justin Gordon. Fixes issue 459.
• Changed generated GitHub Actions to check in cpflow's composite actions under .github/actions/cpflow-* and refresh them with cpflow update-github-actions. Reusable workflows now load those local actions from the caller repository's trusted event revision, while the separately pinned checkout at .cpflow supplies the cpflow runtime source. Downstream repositories must commit generated workflows and local actions together when upgrading. PR 451 by Justin Gordon. Part of issue 375.
• Made update-github-actions preserve downstream workflows by default and require explicit --workflows selection to add or replace them. Ambiguous staging configuration and differing legacy validators fail before writes. Downstream checks can use the preserved bin/test-cpflow-github-flow-custom extension. SHA pins require a reviewed --version label, and the migration guide documents generated action allowlists. PR 476 by Justin Gordon. Fixes issue 473.
• Trimmed the RubyGems post-install message to a three-line generated-workflow reminder with a link to the full update and validation instructions. PR 447 by Justin Gordon. Fixes issue 377.

Fixed

• Fixed the generated bin/pin-cpflow-github-ref helper so -h and --help print usage and exit successfully before inspecting repository state. PR 474 by Justin Gordon. Fixes issue 473.
• Kept no-argument releases pinned to the latest changelog version during retries, and blocked implicit prerelease-to-stable promotion. If an interrupted release already bumped the gem version or created its tag, rerunning bundle exec rake release no longer falls through to a stable release that is absent from the changelog. PR 472 by Justin Gordon.
• Loaded the caller's generated .github/actions/cpflow-* through actions/checkout's trusted default in the reusable review-app deploy, delete, and stale-cleanup workflows. Dropping the explicit ref: still resolves to the revision GitHub already recorded for the triggering event (GITHUB_SHA, the base-branch tip under pull_request_target), and a default checkout is never inspected by the fork-PR checkout guard added in actions/checkout 7.0.0. The previous explicit github.event.pull_request.base.sha pin in the delete workflow could trip that guard, and fail teardown, when a fork PR was closed by a manual fast-forward that left the recorded base SHA equal to the PR head. Review-app teardown consequently runs the base-tip copy of the generated actions rather than the pull request's recorded pre-merge base, which matters only if the merge itself changed those actions. Downstream repositories pick up the change when cpflow update-github-actions bumps the reusable-workflow ref. PR 467 by Justin Gordon. Fixes issue 463.
• Gave pull_request_target an explicit branch in the reusable review-app deploy source validator. The reusable workflow's event allowlist admits pull_request_target, but the deploy source validator handled only pull_request and issue_comment. It now treats pull_request_target exactly like pull_request, skipping fork pull requests with the documented deploy-skipped summary, as defence-in-depth for callers that rewire the deploy trigger. The shipped caller templates never send that event, so no existing deployment behavior changes and same-repository pull requests are unaffected. PR 467 by Justin Gordon. Fixes issue 462.
• Prevented shell interpretation of dynamic Control Plane CLI and Docker arguments. Resource names, image references, container names, locations, and other dynamic values now remain literal argv elements; output suppression and stderr capture use process redirection options without rebuilding a shell command. Fixes issue 452. PR 458 by Justin Gordon.
• Fixed scheduled slow-suite regressions in stale-app workload suspension, invalid upstream-token handling, transient workload image deployment, and delayed one-off job output. cleanup-stale-apps --mode=stop now skips configured workloads absent from a stale app, upstream authorization failures cleanly remove their temporary profile and stderr capture, workload image updates retry for a bounded window before failing, and non-interactive cpflow run commands drain logs for a bounded post-terminal window so delayed ingestion does not drop completed job output. Slow-suite command logs and failure artifacts now redact token options and explicitly supplied sensitive values. PR 413 by Justin Gordon. Addresses issue 409.
• Queued every pending shared-org Slow and Specific RSpec run instead of letting GitHub replace an older waiter. Fast runs keep their per-PR or per-ref queue, while the domain-mutating suites use GitHub's bounded queue: max behavior in one repository-wide concurrency group. PR 457 by Justin Gordon. Fixes issue 403.
• Bounded cpflow run status reconciliation after a non-interactive command finishes. When Control Plane keeps reporting a cron job as active or pending after the command completion marker, cpflow run now waits up to a configurable 20-minute grace period and then exits nonzero with the job, replica, and last observed status instead of polling forever. Addresses the bounded-reconciliation portion of HiChee issue 10375. PR 453 by Justin Gordon.

Security

• Hardened generated Docker builds that use SSH private dependencies. Private keys now enter ssh-agent through standard input instead of being persisted between composite-action steps, invocation-local cleanup runs even when execution stops before the build, and pre-existing known_hosts state is preserved across success and failure. PR 477 and PR 478 by Justin Gordon. Fixes issue 473.

[5.3.0] - 2026-09-02

Added

• Added an early diagnostic warning when a shared_secret_grants target still uses the generated Postgres password placeholder. setup-app and deploy-image now identify the affected grant and secret before release or deployment work without printing secret values. PR 441 by Justin Gordon. Fixes issue 421.
• Added CPFLOW_GVC_ID and CPFLOW_GVC_CREATED to the environment of one-off jobs started by cpflow run, exposing the app's immutable GVC identity so that a release script can tell which GVC incarnation it is running in. PR 433 by Justin Gordon. Fixes issue 432. Unlike the mutable CPLN_GVC_ALIAS, these values identify the GVC incarnation itself, so they change only when a GVC is deleted and recreated under the same name. CPFLOW_GVC_CREATED is an ISO 8601 UTC timestamp with millisecond precision and a Z suffix. Both variables are always set and are empty when the GVC cannot be read, so a consumer can fail closed; they are never omitted, because the runner inherits the original workload's environment and an omitted variable could otherwise expose a stale inherited value.
• Added bounded retry with exponential backoff to direct Control Plane API requests. PR 416 by Justin Gordon. Fixes issue 383. With the default request policy, GET requests retry transient network errors and retryable HTTP responses for up to three attempts; another attempt is approved only when the retry decision occurs before a 120-second deadline. Delta-seconds Retry-After values are honored up to a 10-second cap; HTTP-date values fall back to jittered backoff. Under that policy, explicit HTTP 429 responses are retried for every method. Best-effort sensitive requests disable all transient retries. Mutating requests are not retried after ambiguous transport failures once they may have reached the server. Net::HTTP's hidden resend of PUT and DELETE requests is disabled. A failed cpln profile token lookup now raises an actionable error instead of continuing with unusable output.

... (truncated)

Commits

• b1e5ff4 Bump version to 5.3.0
• d616ff8 Update changelog for 5.3.0 (#450)
• bc75f8b Warn about shared Postgres password placeholders (#441)
• 6be5dcc Bound runner replica observation by a monotonic deadline (#435)
• 4b41e9c Fix review app intent comment permissions (#449)
• 082a395 Report skipped review-app image builds (#444)
• 4d3f6b5 Harden cpflow run argument quoting (#443)
• 470ec75 Require write permission for review-app commands (#440)
• 09e586d Polish direct API retry boundaries (#439)
• f1407a0 Document PR #350 review-app security guidance (#438)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 96636e7d-b8ae-47fd-a201-6aef20b5bda9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🚀 Quick Review App Commands

Welcome! Here are the commands you can use in this PR:
They require the repository to have cpflow review apps configured, including the CPLN_TOKEN_STAGING secret.

+review-app-deploy

Deploy your PR branch for testing.

+review-app-delete

Remove the review app when done.

+review-app-help

Show detailed instructions, environment setup, and configuration options.

Comment +review-app-help for full setup details.

[github-actions]

No description provided.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c78661ffa6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Update the pinned-workflow contract with the new ref

This bump makes the test suite fail because spec/cpflow_review_app_contract_spec.rb:134-140 still includes review-app-help in the v5.2.0 cohort and requires its uses value to end in 1d1ec7f.... Update that contract to recognize this workflow's v5.3.0 SHA (or keep the old pin) so CI does not reject every run containing this commit.

Useful? React with 👍 / 👎.