cpflow 5.2.0 → 6.0.0.rc.0

data/lib/github_flow_templates/.github/workflows/cpflow-deploy-review-app.yml

@@ -13,15 +13,24 @@ on:
         description: Pull request number to deploy
         required: true
         type: number
+      reconcile_intent_run_id:
+        description: Authenticated internal handoff; manual values are rejected
+        required: false
+        type: string
 
 permissions:
+  actions: write
   contents: read
   deployments: write
   issues: write
   pull-requests: write
 
 jobs:
+  # The reusable job exposes `image_built`; downstream jobs can read
+  # `needs.deploy.outputs.image_built`. A value of `false` means this check did not validate the Docker image.
   deploy:
+    # author_association is a cheap caller-side cost filter. The reusable workflow
+    # still checks the commenter's current repository permission before privileged work.
     if: |
       (github.event_name == 'pull_request' &&
        github.event.pull_request.head.repo.full_name == github.repository) ||

data/lib/github_flow_templates/.github/workflows/cpflow-promote-staging-to-production.yml

@@ -61,12 +61,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Checkout control-plane-flow actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: shakacode/control-plane-flow
           ref: __CPFLOW_GITHUB_ACTIONS_REF__
@@ -90,7 +90,7 @@ jobs:
           fi
 
       - name: Validate required secrets and variables
-        uses: ./.cpflow/.github/actions/cpflow-validate-config
+        uses: ./.github/actions/cpflow-validate-config
         # Pass secrets via env so the composite action checks indirect shell
         # variables instead of interpolating secret values into a run script.
         env:
@@ -171,7 +171,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Setup production environment
-        uses: ./.cpflow/.github/actions/cpflow-setup-environment
+        uses: ./.github/actions/cpflow-setup-environment
         with:
           token: ${{ secrets.CPLN_TOKEN_PRODUCTION }}
           org: ${{ steps.cpln-orgs.outputs.production }}
@@ -237,7 +237,7 @@ jobs:
 
       - name: Detect release phase support
         id: release-phase
-        uses: ./.cpflow/.github/actions/cpflow-detect-release-phase
+        uses: ./.github/actions/cpflow-detect-release-phase
         with:
           app_name: ${{ vars.PRODUCTION_APP_NAME }}
 
@@ -441,7 +441,7 @@ jobs:
           echo "image=${staging_image}" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Copy image from staging
         id: copy-image
@@ -589,7 +589,7 @@ jobs:
 
       - name: Wait for deployment health
         id: health-check
-        uses: ./.cpflow/.github/actions/cpflow-wait-for-health
+        uses: ./.github/actions/cpflow-wait-for-health
         with:
           workload_name: ${{ steps.workloads.outputs.primary }}
           app_name: ${{ vars.PRODUCTION_APP_NAME }}

data/lib/github_flow_templates/bin/test-cpflow-github-flow

@@ -16,10 +16,70 @@ echo "==> parse generated GitHub Actions YAML"
 ruby <<'RUBY'
 require "yaml"
 
-Dir[".github/actions/**/action.yml", ".github/workflows/*.yml"].sort.each do |path|
-  YAML.load_file(path, aliases: true)
+documents = Dir[
+  ".github/actions/**/action.yml",
+  ".github/actions/**/action.yaml",
+  ".github/workflows/*.yml",
+  ".github/workflows/*.yaml"
+].sort.to_h do |path|
+  [path, YAML.load_file(path, aliases: true)]
+end
+
+documents.each_key do |path|
   puts "parsed #{path}"
 end
+
+generated_local_action_pattern = %r{\A\./(?<directory>\.github/actions/cpflow-[a-z0-9]+(?:-[a-z0-9]+)*)\z}
+local_action_references = []
+invalid_local_action_references = []
+visited_container_ids = {}
+walk = lambda do |node, source_path|
+  if node.is_a?(Hash) || node.is_a?(Array)
+    next if visited_container_ids.key?(node.object_id)
+
+    visited_container_ids[node.object_id] = true
+  end
+
+  case node
+  when Hash
+    uses = node["uses"]
+    if uses.is_a?(String) && uses.start_with?("./.github/actions/cpflow-")
+      match = uses.match(generated_local_action_pattern)
+      if match
+        local_action_references << [source_path, match[:directory]]
+      else
+        invalid_local_action_references <<
+          "#{source_path} has invalid generated local action reference #{uses}"
+      end
+    end
+    node.each_value { |value| walk.call(value, source_path) }
+  when Array
+    node.each { |value| walk.call(value, source_path) }
+  end
+end
+documents.each { |path, document| walk.call(document, path) }
+
+abort invalid_local_action_references.uniq.join("\n") unless invalid_local_action_references.empty?
+
+missing_actions = local_action_references.uniq.filter_map do |source_path, action_directory|
+  directory_is_local = begin
+    File.lstat(action_directory).directory?
+  rescue Errno::ENOENT
+    false
+  end
+  descriptor_is_local = %w[action.yml action.yaml].any? do |filename|
+    begin
+      File.lstat(File.join(action_directory, filename)).file?
+    rescue Errno::ENOENT
+      false
+    end
+  end
+
+  "#{source_path} references missing local action #{action_directory}" unless directory_is_local && descriptor_is_local
+end
+
+abort missing_actions.join("\n") unless missing_actions.empty?
+puts "all referenced local actions have checked-in descriptors"
 RUBY
 
 echo "==> check composite action input descriptions"
@@ -45,7 +105,7 @@ require "yaml"
 CONTROL_PLANE_FLOW_WORKFLOW = %r{\Ashakacode/control-plane-flow/\.github/workflows/[^@\s]+@([^\s]+)\z}
 PROMOTE_WORKFLOW = %r{\Ashakacode/control-plane-flow/\.github/workflows/cpflow-promote-staging-to-production\.yml@([^\s]+)\z}
 EXPECTED_PROMOTE_WORKFLOW_REF_FORMAT = "shakacode/control-plane-flow/.github/workflows/cpflow-promote-staging-to-production.yml@vX.Y.Z"
-EXPECTED_CPFLOW_CHECKOUT_ACTION = "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"
+EXPECTED_CPFLOW_CHECKOUT_ACTION = "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"
 EXPECTED_CPFLOW_CHECKOUT_REPOSITORY = "shakacode/control-plane-flow"
 
 refs = Hash.new { |hash, key| hash[key] = [] }

data/lib/patches/hash.rb

@@ -27,8 +27,8 @@ class Hash
   private
 
   # Copied from Rails
-  def deep_transform_keys(&block)
-    deep_transform_keys_in_object(self, &block)
+  def deep_transform_keys(&)
+    deep_transform_keys_in_object(self, &)
   end
 
   # Copied from Rails

data/rakelib/create_release.rake

@@ -22,8 +22,9 @@ desc("Releases the cpflow Ruby gem.
     3. Enter the RubyGems OTP when prompted.
 
   With no version argument, the task reads the latest versioned CHANGELOG.md
-  header and uses it when it is newer than the current gem version. Otherwise,
-  it falls back to a patch bump.
+  header and uses it when it is newer than or equal to the current gem version.
+  It falls back to a patch bump only when the current version is stable and the
+  changelog does not name the current or a newer version.
 
   1st argument: Version (optional). Supported values:
                 patch, minor, major, 4.2.0, or 4.2.0.rc.1
@@ -205,10 +206,15 @@ module Release
 
       version = parse_gem_version_components(current_gem_version)
 
+      if version[:prerelease_type] && version_input.to_s.strip.casecmp?("patch")
+        abort <<~ERROR
+          Automatic patch bumps are not allowed from prerelease version #{current_gem_version}.
+          Pass an explicit version instead so a retry cannot accidentally promote a prerelease to stable.
+        ERROR
+      end
+
       case version_input.to_s.strip.downcase
       when "patch"
-        return "#{version[:major]}.#{version[:minor]}.#{version[:patch]}" if version[:prerelease_type]
-
         "#{version[:major]}.#{version[:minor]}.#{version[:patch] + 1}"
       when "minor"
         "#{version[:major]}.#{version[:minor] + 1}.0"
@@ -269,10 +275,8 @@ module Release
         return changelog_version
       end
 
-      if changelog_version &&
-         Gem::Version.new(changelog_version) == Gem::Version.new(current_version) &&
-         !version_tagged?(gem_root, changelog_version)
-        puts "Found untagged CHANGELOG.md version: #{changelog_version} (current: #{current_version})"
+      if changelog_version && Gem::Version.new(changelog_version) == Gem::Version.new(current_version)
+        puts "Found current CHANGELOG.md version: #{changelog_version}"
         return changelog_version
       end
 
@@ -308,10 +312,6 @@ module Release
       tags_output.lines.map(&:strip).filter_map { |tag| parse_release_tag_to_gem_version(tag) }.uniq
     end
 
-    def version_tagged?(gem_root, version)
-      tagged_release_gem_versions(gem_root, fetch_tags: true).include?(version)
-    end
-
     def version_bump_type(previous_stable_gem_version:, target_gem_version:)
       previous = parse_gem_version_components(previous_stable_gem_version)
       target = parse_gem_version_components(target_gem_version)
@@ -479,8 +479,8 @@ module Release
       match[:repo]
     end
 
-    def capture_gh_output(*args)
-      Open3.capture2e("gh", *args)
+    def capture_gh_output(*)
+      Open3.capture2e("gh", *)
     rescue Errno::ENOENT
       abort "GitHub CLI (`gh`) is not installed. Install it from https://cli.github.com/ and retry."
     end

data/script/check_shell_scripts

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
+cd "$repo_root"
+
+if ! command -v shellcheck >/dev/null 2>&1; then
+  echo "ShellCheck is required; install it and ensure shellcheck is on PATH." >&2
+  exit 127
+fi
+
+# Add, rename, or remove extensionless shell entrypoints here. See .agents/bin/README.md.
+extensionless_shell_files=(
+  .agents/bin/docs
+  .agents/bin/lint
+  .agents/bin/setup
+  .agents/bin/test
+  .agents/bin/validate
+  lib/github_flow_templates/bin/test-cpflow-github-flow
+  script/check_command_docs
+  script/check_cpln_links
+  script/check_shell_scripts
+  script/precommit/check_command_docs
+  script/precommit/check_cpln_links
+  script/precommit/check_trailing_newlines
+  script/precommit/get_changed_files
+  script/precommit/ruby_autofix
+  script/precommit/ruby_lint
+  spec/dummy/bin/dev
+)
+
+# A file preserves NUL-separated names while letting us check Git's exit status.
+inventory_file=$(mktemp)
+trap 'rm -f -- "$inventory_file"' EXIT
+if ! git ls-files -z -- '*.sh' '*.bash' "${extensionless_shell_files[@]}" >"$inventory_file"; then
+  echo "Unable to read tracked shell inventory." >&2
+  exit 1
+fi
+
+shell_files=()
+while IFS= read -r -d '' file; do
+  if [ ! -r "$file" ]; then
+    echo "Tracked shell script is not readable: $file" >&2
+    exit 1
+  fi
+  shell_files+=("$file")
+done < "$inventory_file"
+
+if [ "${#shell_files[@]}" -eq 0 ]; then
+  echo "No tracked shell scripts found." >&2
+  exit 1
+fi
+
+for file in "${extensionless_shell_files[@]}"; do
+  if [ ! -f "$file" ] || [ ! -r "$file" ]; then
+    echo "Declared shell entrypoint is not a readable file: $file" >&2
+    exit 1
+  fi
+done
+
+if ! git ls-files --error-unmatch -- "${extensionless_shell_files[@]}" >/dev/null; then
+  echo "Declared extensionless shell scripts must be tracked; update the inventory for renamed or removed files." >&2
+  exit 1
+fi
+
+shellcheck -- "${shell_files[@]}"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cpflow
 version: !ruby/object:Gem::Version
-  version: 5.2.0
+  version: 6.0.0.rc.0
 platform: ruby
 authors:
 - Justin Gordon
@@ -87,6 +87,7 @@ files:
 - ".agents/workflows/ai-rollout-e2e-test.md"
 - ".claude/commands/address-review.md"
 - ".claude/commands/update-changelog.md"
+- ".coderabbit.yaml"
 - ".github/actions/cpflow-build-docker-image/action.yml"
 - ".github/actions/cpflow-delete-control-plane-app/action.yml"
 - ".github/actions/cpflow-delete-control-plane-app/delete-app.sh"
@@ -95,9 +96,12 @@ files:
 - ".github/actions/cpflow-setup-environment/action.yml"
 - ".github/actions/cpflow-validate-config/action.yml"
 - ".github/actions/cpflow-wait-for-health/action.yml"
+- ".github/dependabot.yml"
+- ".github/pull_request_template.md"
 - ".github/workflows/check_cpln_links.yml"
 - ".github/workflows/claude-code-review.yml"
 - ".github/workflows/claude.yml"
+- ".github/workflows/coderabbit-lifecycle-review.yml"
 - ".github/workflows/command_docs.yml"
 - ".github/workflows/cpflow-cleanup-stale-review-apps.yml"
 - ".github/workflows/cpflow-delete-review-app.yml"
@@ -246,6 +250,7 @@ files:
 - lib/core/terraform_config/workload/main.tf
 - lib/core/terraform_config/workload/required_providers.tf
 - lib/core/terraform_config/workload/variables.tf
+- lib/core/timed_command.rb
 - lib/cpflow.rb
 - lib/cpflow/version.rb
 - lib/deprecated_commands.json
@@ -280,6 +285,7 @@ files:
 - script/add_command
 - script/check_command_docs
 - script/check_cpln_links
+- script/check_shell_scripts
 - script/precommit/check_command_docs
 - script/precommit/check_cpln_links
 - script/precommit/check_trailing_newlines
@@ -303,21 +309,9 @@ licenses:
 metadata:
   rubygems_mfa_required: 'true'
 post_install_message: |
-  cpflow 5.2.0 installed.
-
-  If this repository already uses generated cpflow GitHub Actions, update the
-  checked-in wrappers so GitHub loads the matching control-plane-flow release tag:
-
-    cpflow update-github-actions
-    bin/test-cpflow-github-flow
-
-  If you run cpflow through Bundler:
-
-    bundle exec cpflow update-github-actions
-    bin/test-cpflow-github-flow bundle exec cpflow
-
-  New repository? Run `cpflow generate-github-actions` first to create the
-  wrappers (and the `bin/test-cpflow-github-flow` script referenced above).
+  cpflow 6.0.0.rc.0 installed.
+  Generated GitHub Actions users: run `cpflow update-github-actions` after upgrading.
+  Docs: https://github.com/shakacode/control-plane-flow/blob/main/docs/ci-automation.md#updating-generated-github-actions-after-gem-updates
 rdoc_options: []
 require_paths:
 - lib
@@ -325,14 +319,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.0.0
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.8
+rubygems_version: 4.0.18
 specification_version: 4
 summary: Control Plane Flow
 test_files: []