cpflow 5.2.0 → 6.0.0.rc.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4d334d4f24d777236b1d99232c0aeb14aaac17a3daed74837738773a5aa42b3c
-  data.tar.gz: ca7b66e6bd876a6a3f422a425aa86ce90e74af5f57e23eada8384c3f1e963f75
+  metadata.gz: 73c78e337b3728ba8273db59f8f7d9540e855e986ba7aed509c3091a7cf806dd
+  data.tar.gz: d399af718dd0ab5a103d13b2eb7bc3515d2839077280254c29563fa88f14559d
 SHA512:
-  metadata.gz: e72015fc6143701ee31e311030a71c91957556aba0cc762c01d63834cd71d01ba7bfe4e76e216700a8367e365fbb3da2459c70707e6364e7985326e00e6ccab5
-  data.tar.gz: 4b19772575225b90d96ebe788cc555699210df4aa9ae92677e6fbde395f4bcc92b2ef2206b062049c8192ca91228e45e7c7c9414b1948b896248758eb8c71370
+  metadata.gz: ad64de2a50dac54f6c9ee541ec8a2e80f13a36b81cedc2c58924c881ed80df8ff5f6c231255cae7328fbeeda80992e98fbab613f406f149478e7be2711a5a958
+  data.tar.gz: 927713a8b5e829ec6c89aef86ba9020d686bf6b1647473efbb356f31f9ca590185b8c582c061afd555ad32efa6f6caf38c834fba03cf56a52b2a7970f239f2db

data/.agents/agent-workflow.yml

@@ -1,8 +1,10 @@
 # Non-command agent-workflow configuration for portable shared skills.
+# This file is the canonical source for the non-command policy values below.
+# AGENTS.md directs portable skills here; it does not duplicate or override them.
 # Commands live as scripts in .agents/bin/ (see .agents/bin/README.md).
-# Compatibility summary for older workflow copies; canonical values live in
-# AGENTS.md.
 base_branch: main
+merge_submission:
+  mode: direct
 changelog: "CHANGELOG.md — Keep-a-Changelog; user-visible changes only"
 follow_up_prefix: "Follow-up:"
 review_gate: "AI reviewers are advisory unless they confirm a blocker; merge gate is the full `gh pr checks` list green (not --required) + all threads resolved + mergeable clean"
@@ -11,5 +13,27 @@ coordination_backend: "private shakacode/agent-coordination (claims/heartbeats n
 benchmark_labels: n/a
 merge_ledger: n/a
 ci_parity_environment: "n/a — reproduce CI-only failures from the matching job in .github/workflows/**"
+release_qa_runbook: ".agents/workflows/ai-rollout-e2e-test.md — use after publishing a cpflow gem that changes GitHub Actions, AI rollout prompts, readiness checks, generator output, or React on Rails deployment behavior"
 hosted_ci_trigger: "n/a — CI runs on every PR"
 ci_change_detector: n/a
+
+# Consumed by the portable untrusted-contributor-intake skill. These values must
+# be read from the trusted base ref, never from contributor-controlled PR content.
+untrusted_contributor_intake:
+  trusted_github_host: github.com
+  trusted_github_scheme: https
+  trusted_github_repo: shakacode/control-plane-flow
+repo_prefix: CPF
+
+# External actions already used by this repository and reviewed for the closed
+# allowlist enforced by the GitHub Actions security scanner. Every use still
+# requires an immutable commit SHA and a same-line release-version comment.
+trusted_actions:
+  - actions/checkout
+  - actions/create-github-app-token
+  - actions/github-script
+  - actions/upload-artifact
+  - anthropics/claude-code-action
+  - docker/setup-buildx-action
+  - peter-evans/repository-dispatch
+  - ruby/setup-ruby

data/.agents/bin/README.md

@@ -8,12 +8,24 @@ means that capability is n/a here.
 | Script | Purpose | This repo runs |
 | --- | --- | --- |
 | `setup` | Install dependencies | `bundle install` |
-| `validate` | Pre-push gate (run before pushing) | `bundle exec rake` (rspec + rubocop) |
+| `validate` | Pre-push gate (run before pushing) | ShellCheck, then `bundle exec rake` (rspec + rubocop) |
 | `test` | Run tests | `bundle exec rspec` |
 | `lint` | Lint / format (pass `-A` to fix) | `bundle exec rubocop` |
 | `docs` | Check generated command docs | `bundle exec rake check_command_docs` |
 | `build` | Build / type-check | n/a (gem) |
 
-Canonical non-command policy lives in [`../../AGENTS.md`](../../AGENTS.md).
-[`../agent-workflow.yml`](../agent-workflow.yml) is retained only as a
-compatibility summary for older workflow copies.
+`validate` requires ShellCheck to be installed and available as `shellcheck` on
+`PATH`.
+
+`script/check_shell_scripts` checks every Git-tracked `.sh` and `.bash` file,
+plus the extensionless shell entrypoints declared in its
+`extensionless_shell_files` array. It does not infer script languages from
+shebangs. When adding, renaming, or removing an extensionless shell script,
+update that array and its inventory regression test; use a `.sh` or `.bash`
+suffix for automatic inclusion. Declared paths must remain tracked and readable.
+Unlisted extensionless files and non-shell files are outside this check.
+
+Canonical non-command policy, including the release-QA runbook reference, lives
+in [`../agent-workflow.yml`](../agent-workflow.yml). [`../../AGENTS.md`](../../AGENTS.md)
+is the thin discovery pointer for portable shared skills and does not duplicate
+or override that policy.

data/.agents/bin/docs

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
 # Check generated command docs are current.
 set -euo pipefail
-cd "$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+cd "$(CDPATH='' cd -- "$(dirname -- "$0")/../.." && pwd)"
 exec bundle exec rake check_command_docs

data/.agents/bin/lint

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
 # Lint / format check. Pass -A to autocorrect.
 set -euo pipefail
-cd "$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+cd "$(CDPATH='' cd -- "$(dirname -- "$0")/../.." && pwd)"
 exec bundle exec rubocop "$@"

data/.agents/bin/setup

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
 # Install dependencies.
 set -euo pipefail
-cd "$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+cd "$(CDPATH='' cd -- "$(dirname -- "$0")/../.." && pwd)"
 exec bundle install

data/.agents/bin/test

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
 # Run the test suite. Extra args pass through to rspec.
 set -euo pipefail
-cd "$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+cd "$(CDPATH='' cd -- "$(dirname -- "$0")/../.." && pwd)"
 exec bundle exec rspec "$@"

data/.agents/bin/validate

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Pre-push gate: full local validation (run before pushing).
 set -euo pipefail
-cd "$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+cd "$(CDPATH='' cd -- "$(dirname -- "$0")/../.." && pwd)"
+./script/check_shell_scripts
 exec bundle exec rake

data/.coderabbit.yaml

@@ -0,0 +1,13 @@
+reviews:
+  profile: chill
+  review_status: false
+  review_progress: false
+  commit_status: false
+  in_progress_fortune: false
+  collapse_walkthrough: true
+  auto_review:
+    enabled: false
+    auto_incremental_review: false
+    labels:
+      - coderabbit:first-pass
+      - coderabbit:ready

data/.github/actions/cpflow-delete-control-plane-app/action.yml

@@ -22,8 +22,9 @@ runs:
     - name: Delete application
       shell: bash
       working-directory: ${{ inputs.working_directory }}
-      run: ${{ github.action_path }}/delete-app.sh
+      run: "${ACTION_PATH}/delete-app.sh"
       env:
+        ACTION_PATH: ${{ github.action_path }}
         APP_NAME: ${{ inputs.app_name }}
         CPLN_ORG: ${{ inputs.cpln_org }}
         REVIEW_APP_PREFIX: ${{ inputs.review_app_prefix }}

data/.github/actions/cpflow-setup-environment/action.yml

@@ -19,6 +19,10 @@ inputs:
     description: Directory where ruby/setup-ruby should detect Ruby version files.
     required: false
     default: "."
+  cpflow_source_directory:
+    description: Directory containing the checked-out control-plane-flow source.
+    required: false
+    default: ".cpflow"
   # GitHub parses double-brace expression snippets inside action metadata (including
   # `description:`) while loading the composite action, and the `vars` context is not
   # available in that phase. Keep these descriptions in plain prose - reference repo
@@ -47,8 +51,8 @@ inputs:
 
 runs:
   using: composite
-  # ruby/setup-ruby tracks Ruby/toolcache updates on a major tag. The privileged
-  # reusable workflows pin GitHub-owned actions to immutable SHAs.
+  # Dependabot proposes action updates, but each reviewed dependency remains
+  # pinned to the release commit recorded beside its exact version comment.
   steps:
     - name: Resolve Ruby setup version
       id: ruby-version
@@ -80,9 +84,7 @@ runs:
         echo "ruby_version=${ruby_version}" >> "$GITHUB_OUTPUT"
 
     - name: Set up Ruby
-      # ruby/setup-ruby intentionally tracks the v1 tag so Ruby/toolcache updates
-      # roll out automatically; Dependabot/Renovate can manage this non-GitHub action.
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{ steps.ruby-version.outputs.ruby_version }}
         working-directory: ${{ inputs.working_directory }}
@@ -93,13 +95,13 @@ runs:
         CONTROL_PLANE_FLOW_REF: ${{ inputs.control_plane_flow_ref }}
         CPLN_CLI_VERSION: ${{ inputs.cpln_cli_version }}
         CPFLOW_VERSION: ${{ inputs.cpflow_version }}
-        CPFLOW_SOURCE_DIR: ${{ github.action_path }}/../../..
+        CPFLOW_SOURCE_DIR: ${{ inputs.cpflow_source_directory }}
       run: |
         set -euo pipefail
 
         # Bump this default when a new Control Plane CLI release should roll out by default.
         # Override per-repo by setting the `CPLN_CLI_VERSION` repo variable.
-        default_cpln_cli_version="3.10.2"
+        default_cpln_cli_version="3.11.0"
 
         CPLN_CLI_VERSION="${CPLN_CLI_VERSION:-${default_cpln_cli_version}}"
 

data/.github/actions/cpflow-wait-for-health/action.yml

@@ -1,9 +1,9 @@
 name: Wait for Control Plane workload health
 description: >-
   Polls Control Plane until the latest workload version is ready, then checks
-  the workload endpoint with curl. Exits success when the HTTP response status
-  is in the accepted list. Fails non-zero (and reports `healthy=false`) once
-  retries are exhausted.
+  the standard workload endpoint and ready location endpoints with curl. Exits
+  success when the HTTP response status is in the accepted list. Fails non-zero
+  (and reports `healthy=false`) once retries are exhausted.
 
 inputs:
   workload_name:
@@ -39,6 +39,9 @@ outputs:
   healthy:
     description: '"true" once a healthy response was observed; "false" otherwise.'
     value: ${{ steps.poll.outputs.healthy }}
+  endpoint:
+    description: The workload or location endpoint that returned an accepted status.
+    value: ${{ steps.poll.outputs.endpoint }}
 
 runs:
   using: composite
@@ -59,6 +62,40 @@ runs:
 
         read -r -a accepted_statuses <<< "${CPFLOW_ACCEPTED_STATUSES}"
 
+        check_endpoint() {
+          local endpoint="$1"
+          local endpoint_type="$2"
+          local http_status
+
+          http_status="$(curl -s -o /dev/null -w '%{http_code}' --max-time "${CPFLOW_CURL_MAX_TIME}" "${endpoint}" 2>/dev/null || true)"
+          http_status="${http_status:-000}"
+          echo "${endpoint_type}: ${endpoint}, HTTP status: ${http_status}"
+
+          for accepted in "${accepted_statuses[@]}"; do
+            if [[ "${http_status}" == "${accepted}" ]]; then
+              {
+                echo "healthy=true"
+                echo "endpoint=${endpoint}"
+              } >> "$GITHUB_OUTPUT"
+              return 0
+            fi
+          done
+
+          return 1
+        }
+
+        summarize_cpln_error() {
+          local error_text="$1"
+
+          case "${error_text}" in
+            *401*|*403*|*[Uu]nauthorized*|*[Ff]orbidden*) echo "authorization failure" ;;
+            *404*|*"not found"*|*"Not Found"*) echo "resource not found" ;;
+            *429*|*"rate limit"*|*"Rate Limit"*) echo "rate limited" ;;
+            *"timed out"*|*[Tt]imeout*) echo "request timeout" ;;
+            *) echo "CLI error (details suppressed; ${#error_text} stderr bytes captured)" ;;
+          esac
+        }
+
         for attempt in $(seq 1 "${CPFLOW_MAX_RETRIES}"); do
           echo "Health check attempt ${attempt}/${CPFLOW_MAX_RETRIES}"
 
@@ -72,22 +109,57 @@ runs:
           workload_ready="$(echo "${workload_json}" | jq -r '.status.ready // false')"
           latest_ready="$(echo "${workload_json}" | jq -r '.status.readyLatest // false')"
           readiness_status="$(echo "${workload_json}" | jq -r '.health.readiness // "unknown"')"
-          endpoint="$(echo "${workload_json}" | jq -r '.status.endpoint // empty')"
+          workload_endpoint="$(echo "${workload_json}" | jq -r '.status.endpoint // empty')"
 
           if [[ "${workload_ready}" != "true" || "${latest_ready}" != "true" ]]; then
             echo "Workload status: ready=${workload_ready}, readyLatest=${latest_ready}, readiness=${readiness_status}; waiting for latest deployment."
-          elif [[ -n "${endpoint}" ]]; then
-            http_status="$(curl -s -o /dev/null -w '%{http_code}' --max-time "${CPFLOW_CURL_MAX_TIME}" "${endpoint}" 2>/dev/null || echo 000)"
-            echo "Endpoint: ${endpoint}, HTTP status: ${http_status}"
-
-            for accepted in "${accepted_statuses[@]}"; do
-              if [[ "${http_status}" == "${accepted}" ]]; then
-                echo "healthy=true" >> "$GITHUB_OUTPUT"
-                exit 0
-              fi
-            done
           else
-            echo "Workload '${CPFLOW_WORKLOAD_NAME}' has no endpoint yet; waiting for one to be assigned."
+            if [[ -n "${workload_endpoint}" ]] && check_endpoint "${workload_endpoint}" "Workload endpoint"; then
+              exit 0
+            fi
+
+            location_endpoint_count=0
+            deployments_listed=false
+            deployments_settled=false
+            deployments_stderr="$(mktemp)"
+            if deployments_json="$(cpln workload get-deployments "${CPFLOW_WORKLOAD_NAME}" --gvc "${CPFLOW_APP_NAME}" --org "${CPFLOW_ORG}" -o json 2>"${deployments_stderr}")"; then
+              deployments_listed=true
+              unsettled_location_count="$(
+                printf '%s\n' "${deployments_json}" |
+                  jq '[.items[]? | select(.status.ready != true or (.status.deploying // false) == true)] | length'
+              )"
+
+              if [[ "${unsettled_location_count}" -gt 0 ]]; then
+                echo "Deployment locations are not all ready (${unsettled_location_count} unsettled); waiting before endpoint fallback."
+              else
+                deployments_settled=true
+                while IFS= read -r location_endpoint; do
+                  location_endpoint_count=$((location_endpoint_count + 1))
+                  if [[ -n "${location_endpoint}" &&
+                        "${location_endpoint}" != "${workload_endpoint}" ]] &&
+                    check_endpoint "${location_endpoint}" "Location endpoint"; then
+                    rm -f "${deployments_stderr}"
+                    exit 0
+                  fi
+                done < <(
+                  printf '%s\n' "${deployments_json}" |
+                    jq -r '.items[]? | .status.endpoint // empty' |
+                    awk '!seen[$0]++'
+                )
+              fi
+            else
+              deployments_error="$(<"${deployments_stderr}")"
+              deployments_error_summary="$(summarize_cpln_error "${deployments_error}")"
+              echo "::warning::Could not list location endpoints for workload '${CPFLOW_WORKLOAD_NAME}' (${deployments_error_summary}); retrying."
+            fi
+            rm -f "${deployments_stderr}"
+
+            if [[ -z "${workload_endpoint}" &&
+                  "${deployments_listed}" == "true" &&
+                  "${deployments_settled}" == "true" &&
+                  "${location_endpoint_count}" -eq 0 ]]; then
+              echo "Workload '${CPFLOW_WORKLOAD_NAME}' has no endpoint yet; waiting for one to be assigned."
+            fi
           fi
 
           if [[ "${attempt}" -lt "${CPFLOW_MAX_RETRIES}" ]]; then

data/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: "/.github/actions/cpflow-setup-environment"
+    schedule:
+      interval: weekly

data/.github/pull_request_template.md

@@ -0,0 +1,18 @@
+## Summary
+
+<!-- What changes, and why is it useful? -->
+
+## Related issue
+
+<!-- Use "Closes #123" for an accepted issue, or link the maintainer discussion. -->
+
+## Validation
+
+<!-- List the exact commands or manual checks you ran. -->
+
+## Checklist
+
+- [ ] This PR addresses an accepted issue or maintainer request, or is a small typo fix.
+- [ ] The change is focused and contains no unrelated cleanup or generated churn.
+- [ ] I added or updated tests, documentation, and `CHANGELOG.md` where applicable.
+- [ ] I reviewed and understand all submitted content, including AI-assisted changes.

data/.github/workflows/check_cpln_links.yml

@@ -6,13 +6,18 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check_cpln_links:
     runs-on: ubuntu-latest
     name: Check Links
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Validate outgoing links to Control Plane
         run: |
           TERM=xterm-color ./script/check_cpln_links

data/.github/workflows/claude-code-review.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     types: [opened, synchronize, ready_for_review, reopened]
 
+permissions: {}
+
 jobs:
   claude-review:
     runs-on: ubuntu-latest
@@ -15,13 +17,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@8251c103ac8c1d761882c86aba1412c7f583c844 # v1.0.213
         env:
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
         with:

data/.github/workflows/claude.yml

@@ -10,14 +10,107 @@ on:
   pull_request_review:
     types: [submitted]
 
+permissions: {}
+
 jobs:
-  claude:
+  authorize_claude_actor:
     if: |
       (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
       (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
       (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      authorized: ${{ steps.permission-gate.outputs.authorized }}
+    steps:
+      - name: Verify actor can run Claude
+        id: permission-gate
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const permissionByLogin = new Map();
+
+            function claudeRequester() {
+              if (
+                context.eventName === 'issue_comment' ||
+                context.eventName === 'pull_request_review_comment'
+              ) {
+                return context.payload.comment?.user?.login;
+              }
+
+              if (context.eventName === 'pull_request_review') {
+                return context.payload.review?.user?.login;
+              }
+
+              if (context.eventName === 'issues') {
+                return context.payload.issue?.user?.login;
+              }
+
+              return null;
+            }
+
+            async function hasWriteAccessFor(username) {
+              if (!username) {
+                return false;
+              }
+
+              if (permissionByLogin.has(username)) {
+                return permissionByLogin.get(username);
+              }
+
+              let hasWriteAccess = false;
+              try {
+                const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner,
+                  repo,
+                  username
+                });
+                hasWriteAccess = ['admin', 'write'].includes(permission.permission);
+              } catch (error) {
+                core.warning(
+                  `Unable to verify ${username} write permission for Claude; ` +
+                    `treating the Claude request as untrusted: ${error.message || error}`
+                );
+              }
+
+              permissionByLogin.set(username, hasWriteAccess);
+              return hasWriteAccess;
+            }
+
+            const actor = context.actor;
+            const requester = claudeRequester();
+
+            if (!requester) {
+              core.setOutput('authorized', 'false');
+              core.setFailed('Unable to run Claude because the requester could not be determined.');
+              return;
+            }
+
+            if (!(await hasWriteAccessFor(actor))) {
+              core.setOutput('authorized', 'false');
+              core.setFailed(`Unable to run Claude because ${actor} does not have write/admin repository permission.`);
+              return;
+            }
+
+            if (!(await hasWriteAccessFor(requester))) {
+              core.setOutput('authorized', 'false');
+              core.setFailed(
+                `Unable to run Claude because requester ${requester} does not have write/admin repository permission.`
+              );
+              return;
+            }
+
+            core.setOutput('authorized', 'true');
+            core.info(`Authorized ${actor} and Claude requester ${requester} to run Claude.`);
+
+  claude:
+    needs: authorize_claude_actor
+    if: needs.authorize_claude_actor.outputs.authorized == 'true'
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: read
@@ -28,13 +121,14 @@ jobs:
       statuses: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@8251c103ac8c1d761882c86aba1412c7f583c844 # v1.0.213
         env:
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
         with:
@@ -54,4 +148,3 @@ jobs:
           # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
           # or https://code.claude.com/docs/en/cli-reference for available options
           # claude_args: '--allowed-tools Bash(gh pr:*)'
-

data/.github/workflows/coderabbit-lifecycle-review.yml

@@ -0,0 +1,29 @@
+name: CodeRabbit Lifecycle Review
+
+on:
+  pull_request:
+    types: [opened, ready_for_review]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  request-review:
+    if: github.event.pull_request.head.repo.fork == false
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add CodeRabbit lifecycle label
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          # Both labels must already exist in the repo (addLabels does not create them); created 2026-09-06.
+          script: |
+            const label = context.payload.action === 'opened'
+              ? 'coderabbit:first-pass'
+              : 'coderabbit:ready';
+
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: [label]
+            });

data/.github/workflows/command_docs.yml

@@ -6,15 +6,20 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   rspec:
     runs-on: ubuntu-latest
     name: Command Docs
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: "3.2"
           bundler-cache: true

data/.github/workflows/cpflow-cleanup-stale-review-apps.yml

@@ -23,8 +23,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
+      # No explicit ref: checkout's default resolves to this event's recorded commit
+      # (GITHUB_SHA), which is trusted base-repository code and is exempt from checkout v7's fork-PR guard.
+      - name: Checkout generated cpflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Checkout control-plane-flow actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -32,7 +39,7 @@ jobs:
           persist-credentials: false
 
       - name: Validate required secrets and variables
-        uses: ./.cpflow/.github/actions/cpflow-validate-config
+        uses: ./.github/actions/cpflow-validate-config
         env:
           CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
         with:
@@ -40,21 +47,21 @@ jobs:
             secret:CPLN_TOKEN_STAGING
 
       - name: Checkout caller repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: app
           persist-credentials: false
 
       - name: Resolve review app config
         id: review-config
-        uses: ./.cpflow/.github/actions/cpflow-resolve-review-config
+        uses: ./.github/actions/cpflow-resolve-review-config
         with:
           working_directory: app
           configured_cpln_org_staging: ${{ vars.CPLN_ORG_STAGING }}
           configured_review_app_prefix: ${{ vars.REVIEW_APP_PREFIX }}
 
       - name: Setup environment
-        uses: ./.cpflow/.github/actions/cpflow-setup-environment
+        uses: ./.github/actions/cpflow-setup-environment
         with:
           token: ${{ secrets.CPLN_TOKEN_STAGING }}
           org: ${{ steps.review-config.outputs.cpln_org }}