cpflow 5.3.0 → 6.0.0.rc.0

data/.github/workflows/cpflow-deploy-staging.yml

@@ -60,9 +60,15 @@ jobs:
             echo "is_deployable=false" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Checkout generated cpflow actions
+        if: steps.check-branch.outputs.is_deployable == 'true'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Checkout control-plane-flow actions
         if: steps.check-branch.outputs.is_deployable == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -71,7 +77,7 @@ jobs:
 
       - name: Validate required secrets and variables
         if: steps.check-branch.outputs.is_deployable == 'true'
-        uses: ./.cpflow/.github/actions/cpflow-validate-config
+        uses: ./.github/actions/cpflow-validate-config
         env:
           CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
           CPLN_ORG_STAGING: ${{ vars.CPLN_ORG_STAGING }}
@@ -89,12 +95,12 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Checkout control-plane-flow actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -102,7 +108,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup environment
-        uses: ./.cpflow/.github/actions/cpflow-setup-environment
+        uses: ./.github/actions/cpflow-setup-environment
         with:
           token: ${{ secrets.CPLN_TOKEN_STAGING }}
           org: ${{ vars.CPLN_ORG_STAGING }}
@@ -112,7 +118,7 @@ jobs:
           control_plane_flow_ref: ${{ job.workflow_ref }}
 
       - name: Build Docker image
-        uses: ./.cpflow/.github/actions/cpflow-build-docker-image
+        uses: ./.github/actions/cpflow-build-docker-image
         with:
           app_name: ${{ env.APP_NAME }}
           org: ${{ vars.CPLN_ORG_STAGING }}
@@ -128,12 +134,12 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Checkout control-plane-flow actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -141,7 +147,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup environment
-        uses: ./.cpflow/.github/actions/cpflow-setup-environment
+        uses: ./.github/actions/cpflow-setup-environment
         with:
           token: ${{ secrets.CPLN_TOKEN_STAGING }}
           org: ${{ vars.CPLN_ORG_STAGING }}
@@ -152,7 +158,7 @@ jobs:
 
       - name: Detect release phase support
         id: release-phase
-        uses: ./.cpflow/.github/actions/cpflow-detect-release-phase
+        uses: ./.github/actions/cpflow-detect-release-phase
         with:
           app_name: ${{ env.APP_NAME }}
 

data/.github/workflows/cpflow-help-command.yml

@@ -28,7 +28,7 @@ jobs:
       - name: React to help command
         if: github.event_name == 'issue_comment'
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             try {
@@ -47,14 +47,14 @@ jobs:
             }
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Help only reads `.github/cpflow-help.md`; no git push happens, so drop the
           # GITHUB_TOKEN credential helper to keep the token out of .git/config.
           persist-credentials: false
 
       - name: Post help message
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require("fs");

data/.github/workflows/cpflow-promote-staging-to-production.yml

@@ -65,12 +65,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Checkout control-plane-flow actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -91,7 +91,7 @@ jobs:
           fi
 
       - name: Validate required secrets and variables
-        uses: ./.cpflow/.github/actions/cpflow-validate-config
+        uses: ./.github/actions/cpflow-validate-config
         # Pass secrets via env so the composite action checks indirect shell
         # variables instead of interpolating secret values into a run script.
         env:
@@ -158,7 +158,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Setup production environment
-        uses: ./.cpflow/.github/actions/cpflow-setup-environment
+        uses: ./.github/actions/cpflow-setup-environment
         with:
           token: ${{ secrets.CPLN_TOKEN_PRODUCTION }}
           org: ${{ steps.cpln-orgs.outputs.production }}
@@ -220,7 +220,7 @@ jobs:
 
       - name: Detect release phase support
         id: release-phase
-        uses: ./.cpflow/.github/actions/cpflow-detect-release-phase
+        uses: ./.github/actions/cpflow-detect-release-phase
         with:
           app_name: ${{ vars.PRODUCTION_APP_NAME }}
 
@@ -422,7 +422,7 @@ jobs:
           echo "image=${staging_image}" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Copy image from staging
         id: copy-image
@@ -570,7 +570,7 @@ jobs:
 
       - name: Wait for deployment health
         id: health-check
-        uses: ./.cpflow/.github/actions/cpflow-wait-for-health
+        uses: ./.github/actions/cpflow-wait-for-health
         with:
           workload_name: ${{ steps.workloads.outputs.primary }}
           app_name: ${{ vars.PRODUCTION_APP_NAME }}

data/.github/workflows/cpflow-review-app-help.yml

@@ -13,7 +13,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Post quick reference
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const body = [

data/.github/workflows/rspec-shared.yml

@@ -15,38 +15,27 @@ on:
       spec_paths:
         required: false
         type: string
-      uses_shared_org:
+    secrets:
+      CPLN_TOKEN:
+        description: Control Plane token used by integration specs
         required: false
-        default: false
-        type: boolean
+
+permissions:
+  contents: read
 
 jobs:
   rspec:
     runs-on: ${{ inputs.os_version }}
-    # Scope the live Control Plane org queue per PR (or ref) instead of globally:
-    # each run uses its own random app suffix (SecureRandom.hex(2)) on a fresh
-    # runner, so concurrent PRs don't collide on app names or CLI profiles. PRs
-    # run only the fast (~slow) suite, which doesn't switch the shared domain's
-    # route; domain-mutating specs are :slow and dispatched manually, keyed by
-    # github.ref so same-ref fast dispatches still serialize. Callers that may
-    # touch the shared domain use one ref-independent queue, covering scheduled,
-    # manual slow, and manual specific runs. Fall back to the repository rather
-    # than a unique run ID so missing CPLN_ORG cannot bypass serialization.
-    # cancel-in-progress is false, so queued runs wait rather than cancel.
-    concurrency:
-      group: cpln-shared-org-${{ vars.CPLN_ORG || github.repository }}-${{ inputs.uses_shared_org && 'shared-org' || github.event.pull_request.number || github.ref }}
-      cancel-in-progress: false
     env:
       RAILS_ENV: test
-      # We have to add "_CI" to the end, otherwise it messes with tests where we switch profiles,
-      # as Control Plane will try to use this token's profile instead.
-      CPLN_TOKEN_CI: ${{ secrets.CPLN_TOKEN }}
       CPLN_ORG: ${{ vars.CPLN_ORG }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ inputs.ruby_version }}
           bundler-cache: true
@@ -54,22 +43,41 @@ jobs:
         run: bundle install
       - name: Install Control Plane tools
         run: |
-          sudo npm install -g @controlplane/cli
+          sudo npm install -g @controlplane/cli@3.11.0
           cpln --version
       - name: Setup Control Plane tools
+        env:
+          # Keep the _CI suffix so tests that switch profiles do not use this token's profile.
+          CPLN_TOKEN_CI: ${{ secrets.CPLN_TOKEN }}
         run: |
-          cpln profile create default --token $CPLN_TOKEN_CI --org $CPLN_ORG
+          cpln profile create default --token "$CPLN_TOKEN_CI" --org "$CPLN_ORG"
           cpln image docker-login
       - name: Run tests
-        run: bundle exec rspec --format documentation ${{ inputs.test_tag && format('--tag {0}', inputs.test_tag) }} ${{ inputs.spec_paths }}
+        env:
+          CPLN_TOKEN_CI: ${{ secrets.CPLN_TOKEN }}
+          RSPEC_SPEC_PATHS: ${{ inputs.spec_paths }}
+          RSPEC_TEST_TAG: ${{ inputs.test_tag }}
+        run: |
+          set -euo pipefail
+
+          rspec_args=(--format documentation)
+          if [[ -n "${RSPEC_TEST_TAG}" ]]; then
+            rspec_args+=(--tag "${RSPEC_TEST_TAG}")
+          fi
+          if [[ -n "${RSPEC_SPEC_PATHS}" ]]; then
+            read -r -a requested_paths <<< "${RSPEC_SPEC_PATHS}"
+            rspec_args+=("${requested_paths[@]}")
+          fi
+
+          bundle exec rspec "${rspec_args[@]}"
       - name: Upload spec log
-        uses: actions/upload-artifact@master
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: spec-${{ inputs.test_tag }}-${{ github.run_id }}-${{ inputs.os_version }}-${{ inputs.ruby_version }}.log
           path: spec.log
       - name: Upload coverage results
-        uses: actions/upload-artifact@master
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: coverage-report-${{ inputs.test_tag }}-${{ github.run_id }}-${{ inputs.os_version }}-${{ inputs.ruby_version }}

data/.github/workflows/rspec-specific.yml

@@ -7,13 +7,21 @@ on:
         description: "Test files or directories that should be run"
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   rspec-specific:
     name: RSpec (Specific)
     uses: ./.github/workflows/rspec-shared.yml
+    # Share the no-drop queue with scheduled and manually dispatched Slow runs.
+    concurrency:
+      group: cpln-shared-org-${{ vars.CPLN_ORG || github.repository }}-shared-org
+      cancel-in-progress: false
+      queue: max
     with:
       os_version: ubuntu-latest
       ruby_version: "3.2"
       spec_paths: ${{ inputs.spec_paths }}
-      uses_shared_org: true
-    secrets: inherit
+    secrets:
+      CPLN_TOKEN: ${{ secrets.CPLN_TOKEN }}

data/.github/workflows/rspec.yml

@@ -19,27 +19,94 @@ on:
   schedule:
     - cron: "0 2 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   rspec-fast:
     name: RSpec (Fast)
     uses: ./.github/workflows/rspec-shared.yml
     if: github.event_name != 'schedule'
+    # Fast runs use isolated random app suffixes, so only serialize the same PR
+    # or ref. Keep the default single pending slot so obsolete heads are
+    # replaced instead of accumulating behind the current run.
+    concurrency:
+      group: cpln-shared-org-${{ vars.CPLN_ORG || github.repository }}-${{ github.event.pull_request.number || github.ref }}
+      cancel-in-progress: false
     with:
       os_version: ubuntu-latest
       ruby_version: "3.2"
       test_tag: ~slow
-    secrets: inherit
+    secrets:
+      CPLN_TOKEN: ${{ secrets.CPLN_TOKEN }}
+
+  ruby-compatibility:
+    name: Ruby ${{ matrix.ruby-version }} compatibility
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby-version:
+          - "3.3"
+          - "3.4"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          ruby-version: ${{ matrix.ruby-version }}
+          bundler-cache: true
+      - name: Run credential-free offline suite
+        env:
+          CPLN_ORG: ""
+        run: |
+          bundle exec rspec \
+            spec/cpflow_spec.rb \
+            spec/github_actions_dependency_policy_spec.rb \
+            spec/github_workflows_spec.rb \
+            spec/patches \
+            spec/support_specs \
+            spec/core/controlplane_api_direct_spec.rb \
+            spec/core/controlplane_api_spec.rb \
+            spec/core/doctor_service_spec.rb \
+            spec/core/github_flow_readiness/checks_spec.rb \
+            spec/core/github_flow_readiness_service_spec.rb \
+            spec/core/helpers_spec.rb \
+            spec/core/repo_introspection_spec.rb \
+            spec/core/shell_spec.rb \
+            spec/rakelib/create_release_spec.rb \
+            spec/command/no_command_spec.rb \
+            spec/command/staging_branch_validation_spec.rb \
+            spec/command/test_spec.rb \
+            spec/command/update_github_actions_spec.rb \
+            spec/command/version_spec.rb \
+            spec/command/deploy_image_unit_spec.rb \
+            spec/command/promote_app_from_upstream_unit_spec.rb
+      - name: Analyze code
+        run: bundle exec rubocop
 
   rspec-slow:
     name: RSpec (Slow)
     uses: ./.github/workflows/rspec-shared.yml
     if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
+    # Slow and Specific runs can mutate the shared domain. Retain every waiter
+    # in one repository-wide queue instead of replacing an earlier pending run.
+    concurrency:
+      group: cpln-shared-org-${{ vars.CPLN_ORG || github.repository }}-shared-org
+      cancel-in-progress: false
+      queue: max
     with:
       os_version: ubuntu-latest
       ruby_version: "3.2"
       test_tag: slow
-      uses_shared_org: true
-    secrets: inherit
+    secrets:
+      CPLN_TOKEN: ${{ secrets.CPLN_TOKEN }}
 
   report-scheduled-slow-suite-failure:
     name: Report scheduled slow suite failure
@@ -50,7 +117,7 @@ jobs:
       issues: write
     steps:
       - name: Create or update the scheduled slow suite failure issue
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const title = "Scheduled slow suite failing";

data/.github/workflows/rubocop.yml

@@ -16,15 +16,22 @@ on:
       - 'LICENSE'
       - 'COMM-LICENSE.txt'
 
+permissions:
+  contents: read
+
 jobs:
   rubocop:
     runs-on: ubuntu-latest
     name: Rubocop
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Analyze shell scripts
+        run: script/check_shell_scripts
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: "3.2"
           bundler-cache: true

data/.github/workflows/trigger-docs-site.yml

@@ -18,6 +18,8 @@ on:
     # Non-main manual dispatches are skipped by the job guard below.
     # Only use this for forcing a rebuild from main.
 
+permissions: {}
+
 concurrency:
   # Include the ref so accidental non-main manual runs cannot cancel a main dispatch
   # before the job guard skips them.

data/.rubocop.yml

@@ -3,7 +3,7 @@ plugins:
   - rubocop-rspec
 
 AllCops:
-  TargetRubyVersion: 3.0
+  TargetRubyVersion: 3.2
   NewCops: enable
 
 Metrics/AbcSize:
@@ -12,6 +12,11 @@ Metrics/AbcSize:
 Style/Documentation:
   Enabled: false
 
+# These value objects intentionally reject positional construction. Retaining
+# keyword-only initialization is part of their API contract, not redundant.
+Style/RedundantStructKeywordInit:
+  Enabled: false
+
 Style/StringLiterals:
   EnforcedStyle: double_quotes
 

data/CHANGELOG.md

@@ -12,6 +12,28 @@ In addition to the standard keepachangelog.com categories, this project uses a l
 
 ## [Unreleased]
 
+## [6.0.0.rc.0] - 2026-09-06
+
+### Breaking Changes
+
+- BREAKING CHANGE: Raised the minimum supported Ruby version from 3.0 to 3.2. Users on Ruby 3.0 or 3.1 must upgrade Ruby before installing the next major cpflow release. CI now tests each supported Ruby minor from 3.2 through 3.4. [PR 464](https://github.com/shakacode/control-plane-flow/pull/464) by [Justin Gordon](https://github.com/justin808).
+
+### Changed
+
+- **Bumped the pinned GitHub Actions in the generated production-promotion workflow and this repository's reusable workflows to `actions/checkout` 7.0.1, `actions/github-script` 9.0.0, and `docker/setup-buildx-action` 4.3.0.** Downstream repositories pick up the template change with `cpflow update-github-actions`. [PR 460](https://github.com/shakacode/control-plane-flow/pull/460) by [Justin Gordon](https://github.com/justin808). Fixes [issue 459](https://github.com/shakacode/control-plane-flow/issues/459).
+- **Changed generated GitHub Actions to check in cpflow's composite actions under `.github/actions/cpflow-*` and refresh them with `cpflow update-github-actions`.** Reusable workflows now load those local actions from the caller repository's trusted event revision, while the separately pinned checkout at `.cpflow` supplies the cpflow runtime source. Downstream repositories must commit generated workflows and local actions together when upgrading. [PR 451](https://github.com/shakacode/control-plane-flow/pull/451) by [Justin Gordon](https://github.com/justin808). Part of [issue 375](https://github.com/shakacode/control-plane-flow/issues/375).
+- **Trimmed the RubyGems post-install message to a three-line generated-workflow reminder with a link to the full update and validation instructions.** [PR 447](https://github.com/shakacode/control-plane-flow/pull/447) by [Justin Gordon](https://github.com/justin808). Fixes [issue 377](https://github.com/shakacode/control-plane-flow/issues/377).
+
+### Fixed
+
+- **Kept no-argument releases pinned to the latest changelog version during retries, and blocked implicit prerelease-to-stable promotion.** If an interrupted release already bumped the gem version or created its tag, rerunning `bundle exec rake release` no longer falls through to a stable release that is absent from the changelog. [PR 472](https://github.com/shakacode/control-plane-flow/pull/472) by [Justin Gordon](https://github.com/justin808).
+- **Loaded the caller's generated `.github/actions/cpflow-*` through `actions/checkout`'s trusted default in the reusable review-app deploy, delete, and stale-cleanup workflows.** Dropping the explicit `ref:` still resolves to the revision GitHub already recorded for the triggering event (`GITHUB_SHA`, the base-branch tip under `pull_request_target`), and a default checkout is never inspected by the fork-PR checkout guard added in `actions/checkout` 7.0.0. The previous explicit `github.event.pull_request.base.sha` pin in the delete workflow could trip that guard, and fail teardown, when a fork PR was closed by a manual fast-forward that left the recorded base SHA equal to the PR head. Review-app teardown consequently runs the base-tip copy of the generated actions rather than the pull request's recorded pre-merge base, which matters only if the merge itself changed those actions. Downstream repositories pick up the change when `cpflow update-github-actions` bumps the reusable-workflow ref. [PR 467](https://github.com/shakacode/control-plane-flow/pull/467) by [Justin Gordon](https://github.com/justin808). Fixes [issue 463](https://github.com/shakacode/control-plane-flow/issues/463).
+- **Gave `pull_request_target` an explicit branch in the reusable review-app deploy source validator.** The reusable workflow's event allowlist admits `pull_request_target`, but the deploy source validator handled only `pull_request` and `issue_comment`. It now treats `pull_request_target` exactly like `pull_request`, skipping fork pull requests with the documented deploy-skipped summary, as defence-in-depth for callers that rewire the deploy trigger. The shipped caller templates never send that event, so no existing deployment behavior changes and same-repository pull requests are unaffected. [PR 467](https://github.com/shakacode/control-plane-flow/pull/467) by [Justin Gordon](https://github.com/justin808). Fixes [issue 462](https://github.com/shakacode/control-plane-flow/issues/462).
+- **Prevented shell interpretation of dynamic Control Plane CLI and Docker arguments.** Resource names, image references, container names, locations, and other dynamic values now remain literal argv elements; output suppression and stderr capture use process redirection options without rebuilding a shell command. Fixes [issue 452](https://github.com/shakacode/control-plane-flow/issues/452). [PR 458](https://github.com/shakacode/control-plane-flow/pull/458) by [Justin Gordon](https://github.com/justin808).
+- **Fixed scheduled slow-suite regressions in stale-app workload suspension, invalid upstream-token handling, transient workload image deployment, and delayed one-off job output.** `cleanup-stale-apps --mode=stop` now skips configured workloads absent from a stale app, upstream authorization failures cleanly remove their temporary profile and stderr capture, workload image updates retry for a bounded window before failing, and non-interactive `cpflow run` commands drain logs for a bounded post-terminal window so delayed ingestion does not drop completed job output. Slow-suite command logs and failure artifacts now redact token options and explicitly supplied sensitive values. [PR 413](https://github.com/shakacode/control-plane-flow/pull/413) by [Justin Gordon](https://github.com/justin808). Addresses [issue 409](https://github.com/shakacode/control-plane-flow/issues/409).
+- **Queued every pending shared-org Slow and Specific RSpec run instead of letting GitHub replace an older waiter.** Fast runs keep their per-PR or per-ref queue, while the domain-mutating suites use GitHub's bounded `queue: max` behavior in one repository-wide concurrency group. [PR 457](https://github.com/shakacode/control-plane-flow/pull/457) by [Justin Gordon](https://github.com/justin808). Fixes [issue 403](https://github.com/shakacode/control-plane-flow/issues/403).
+- **Bounded `cpflow run` status reconciliation after a non-interactive command finishes.** When Control Plane keeps reporting a cron job as active or pending after the command completion marker, `cpflow run` now waits up to a configurable 20-minute grace period and then exits nonzero with the job, replica, and last observed status instead of polling forever. Addresses the bounded-reconciliation portion of [HiChee issue 10375](https://github.com/shakacode/hichee/issues/10375). [PR 453](https://github.com/shakacode/control-plane-flow/pull/453) by [Justin Gordon](https://github.com/justin808).
+
 ## [5.3.0] - 2026-09-02
 
 ### Added
@@ -474,7 +496,8 @@ Deprecated `cpl` gem. New gem is `cpflow`.
 
 First release.
 
-[Unreleased]: https://github.com/shakacode/control-plane-flow/compare/v5.3.0...main
+[Unreleased]: https://github.com/shakacode/control-plane-flow/compare/v6.0.0.rc.0...main
+[6.0.0.rc.0]: https://github.com/shakacode/control-plane-flow/compare/v5.3.0...v6.0.0.rc.0
 [5.3.0]: https://github.com/shakacode/control-plane-flow/compare/v5.2.0...v5.3.0
 [5.2.0]: https://github.com/shakacode/control-plane-flow/compare/v5.1.1...v5.2.0
 [5.1.1]: https://github.com/shakacode/control-plane-flow/compare/v5.1.0...v5.1.1

data/CONTRIBUTING.md

@@ -35,6 +35,43 @@ gem install overcommit
 overcommit --install
 ```
 
+## GitHub Actions Dependencies
+
+Every repository-based external `uses:` entry under `.github/workflows/` or `.github/actions/` must use an immutable,
+lowercase 40-character commit SHA followed by the exact release tag in a same-line comment. Do not use moving
+major-version tags or branch names. New action repositories also require explicit review before they are added to
+`trusted_actions` in `.agents/agent-workflow.yml`. Docker actions must use an exact `sha256:` image digest; manually
+review the registry, image, and digest because Docker references are outside the repository allowlist.
+Generated downstream calls to Control Plane Flow's cross-repository reusable workflows are the deliberate exception:
+they use an exact `vX.Y.Z` release tag so the workflow source stays aligned with the released `cpflow` gem.
+
+Dependabot checks GitHub Actions dependencies weekly. For each proposed update, verify that the release tag resolves to
+the proposed commit, review the upstream release and diff, and keep the version comment synchronized with the pin.
+Dependabot-authored runs receive no repository secrets, so `RSpec (Fast)` fails at `Setup Control Plane tools`. The
+credential-free `Ruby 3.3 compatibility` and `Ruby 3.4 compatibility` jobs do run
+`spec/github_actions_dependency_policy_spec.rb`, so a bump that leaves the generated templates or the
+`EXPECTED_CPFLOW_CHECKOUT_ACTION` constant behind still fails there, even on a Dependabot-authored pull request that
+cannot run the credentialed suite. A Dependabot bump is therefore never merged directly: a maintainer opens a pull
+request that supersedes it and lands the same pin. That maintainer pull request must update the pin in all four places,
+or CI fails:
+
+- `.github/workflows/**` and `.github/actions/**` — the workflows that actually run in this repository.
+- `lib/github_flow_templates/.github/workflows/**` — the workflows generated into downstream repositories.
+- `lib/github_flow_templates/bin/test-cpflow-github-flow` — the `EXPECTED_CPFLOW_CHECKOUT_ACTION` constant.
+- `spec/command/generate_github_actions_spec.rb` and `spec/github_workflows_spec.rb` — the assertions that hard-code
+  the expected SHA.
+
+`spec/github_actions_dependency_policy_spec.rb` guards the first three. It fails when a template occurrence's commit
+SHA or version comment drifts from the repository pin for the same action, when a template `uses:` entry is left on a
+mutable ref such as `@v7` or `@main`, or when a template pins an external action that the repository workflows do not
+use. Only script constants such as `EXPECTED_CPFLOW_CHECKOUT_ACTION` and `docker://` image references may omit the
+version comment, because neither is a workflow step with somewhere to hang a same-line release tag. Calls to cpflow's
+own reusable workflows under `.github/workflows/` are the one exception to the commit-pin rule, and only for the
+`@__CPFLOW_GITHUB_ACTIONS_REF__` generator placeholder or an exact release tag. `@main` and `@v5` fail, and so does any
+other `shakacode/control-plane-flow` reference, such as `shakacode/control-plane-flow/some-action@v6.0.0` or the bare
+repository, which must be commit-pinned like any external action. The literal `vX.Y.Z` is accepted only in the verifier
+script's `EXPECTED_PROMOTE_WORKFLOW_REF_FORMAT` constant, never in a workflow step.
+
 ## Docs Site Dispatch
 
 The `trigger-docs-site.yml` workflow notifies `shakacode/controlplaneflow-com` when docs-related files change on `main`.
@@ -113,9 +150,9 @@ cpflow test
 
 ## Developing the GitHub flow generator
 
-`cpflow generate-github-actions` copies templates from `lib/github_flow_templates/` into a target repo's `.github/` directory. To work on this feature:
+`cpflow generate-github-actions` copies workflow templates in `lib/github_flow_templates/` and canonical composite actions in `.github/actions/cpflow-*` into a target repo's `.github/` directory. To work on this feature:
 
-- **Edit the templates in place.** The generator does no string-mangling beyond a small set of substitutions handled in `lib/command/generate_github_actions.rb`; what you put in `lib/github_flow_templates/.github/` is (almost) exactly what ships into a generated repo. Make changes there, not in a generated copy.
+- **Edit each canonical source in place.** The generator does no string-mangling beyond a small set of substitutions handled in `lib/command/generate_github_actions.rb`; what you put in `lib/github_flow_templates/.github/` is (almost) exactly what ships into a generated repo. Edit composite actions in the root `.github/actions/cpflow-*` directories. Make changes in those canonical sources, not in a generated copy.
 - **Surface area to keep consistent.** A change to a PR command (e.g. `+review-app-deploy`) usually touches three places: the trigger workflow (`lib/github_flow_templates/.github/workflows/cpflow-deploy-review-app.yml`), the PR-open quick reference (`cpflow-review-app-help.yml`), and the long-form help (`lib/github_flow_templates/.github/cpflow-help.md`). The AI flow prompt (`lib/command/ai_github_flow_prompt.rb`) also names commands and should be kept in sync.
 - **Run the generator spec on every change:**
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    cpflow (5.3.0)
+    cpflow (6.0.0.rc.0)
       dotenv (~> 3.1)
       jwt (~> 3.1)
       psych (~> 5.2)

data/README.md

@@ -307,6 +307,11 @@ aliases:
     # If not specified, defaults to 21600 (6 hours).
     runner_job_timeout: 1000
 
+    # Sets how long `cpflow run` waits for Control Plane to reconcile a cron job status
+    # after the non-interactive command prints its completion marker.
+    # If not specified, defaults to 1200 (20 minutes).
+    runner_job_status_reconciliation_timeout: 1200
+
     # Apps with a deployed image, or an image-less GVC, created before this amount of days
     # will be listed for deletion when running the command `cpflow cleanup-stale-apps`.
     stale_app_image_deployed_days: 5
@@ -393,7 +398,7 @@ cpflow generate-github-actions
 bin/test-cpflow-github-flow
 ```
 
-`cpflow github-flow-readiness` exits non-zero when it finds blockers such as unpublished exact-pinned packages or a missing production Dockerfile, so use it as the gate before generation. Then review the generated `.controlplane/controlplane.yml` entries, adjust any app-specific workloads, and configure the GitHub repository variables and secrets described in [CI automation](./docs/ci-automation.md), including the optional Docker build settings for private GitHub dependencies and custom SSH known hosts. `cpflow generate-github-actions` also writes `bin/test-cpflow-github-flow` for local validation and `bin/pin-cpflow-github-ref` for temporarily pinning downstream wrappers to an upstream commit SHA during pre-release testing. `cpflow generate` already switches to persistent `db` and `storage` volumes when `config/database.yml` shows SQLite in production and preserves detected frontend precompile hooks, but you should still confirm that the generated Dockerfile picked a Ruby base image compatible with the app's declared Ruby requirement and that the emitted workload set matches the real app. If you want an AI agent to do this end to end, give it the [AI rollout prompt](./docs/ai-github-flow-prompt.md) rather than a vague "set up CI" request.
+`cpflow github-flow-readiness` exits non-zero when it finds blockers such as unpublished exact-pinned packages or a missing production Dockerfile, so use it as the gate before generation. Then review the generated `.controlplane/controlplane.yml` entries, adjust any app-specific workloads, and configure the GitHub repository variables and secrets described in [CI automation](./docs/ci-automation.md), including the optional Docker build settings for private GitHub dependencies and custom SSH known hosts. `cpflow generate-github-actions` checks in the local `.github/actions/cpflow-*` implementations alongside the workflows, and also writes `bin/test-cpflow-github-flow` for local validation and `bin/pin-cpflow-github-ref` for temporarily pinning downstream wrappers to an upstream commit SHA during pre-release testing. `cpflow generate` already switches to persistent `db` and `storage` volumes when `config/database.yml` shows SQLite in production and preserves detected frontend precompile hooks, but you should still confirm that the generated Dockerfile picked a Ruby base image compatible with the app's declared Ruby requirement and that the emitted workload set matches the real app. If you want an AI agent to do this end to end, give it the [AI rollout prompt](./docs/ai-github-flow-prompt.md) rather than a vague "set up CI" request.
 
 For a live example, see the [react-webpack-rails-tutorial](https://github.com/shakacode/react-webpack-rails-tutorial/blob/master/.controlplane/readme.md) repository.
 

data/cpflow.gemspec

@@ -14,23 +14,11 @@ Gem::Specification.new do |spec|
   spec.license     = "MIT"
   spec.post_install_message = <<~MESSAGE
     cpflow #{Cpflow::VERSION} installed.
-
-    If this repository already uses generated cpflow GitHub Actions, update the
-    checked-in wrappers so GitHub loads the matching control-plane-flow release tag:
-
-      cpflow update-github-actions
-      bin/test-cpflow-github-flow
-
-    If you run cpflow through Bundler:
-
-      bundle exec cpflow update-github-actions
-      bin/test-cpflow-github-flow bundle exec cpflow
-
-    New repository? Run `cpflow generate-github-actions` first to create the
-    wrappers (and the `bin/test-cpflow-github-flow` script referenced above).
+    Generated GitHub Actions users: run `cpflow update-github-actions` after upgrading.
+    Docs: https://github.com/shakacode/control-plane-flow/blob/main/docs/ci-automation.md#updating-generated-github-actions-after-gem-updates
   MESSAGE
 
-  spec.required_ruby_version = ">= 3.0.0"
+  spec.required_ruby_version = ">= 3.2"
 
   spec.add_dependency "dotenv",   "~> 3.1"
   spec.add_dependency "jwt",      "~> 3.1"