cpflow 5.3.0 → 6.0.0.rc.0

data/lib/core/controlplane.rb

@@ -24,18 +24,18 @@ class Controlplane # rubocop:disable Metrics/ClassLength
   end
 
   def profile_exists?(profile)
-    cmd = "cpln profile get #{profile} -o yaml"
+    cmd = ["cpln", "profile", "get", profile, "-o", "yaml"]
     perform_yaml!(cmd).length.positive?
   end
 
   def profile_create(profile, token)
-    sensitive_data_pattern = /(?<=--token )(\S+)/
-    cmd = "cpln profile create #{profile} --token #{token}"
+    sensitive_data_pattern = /(?<=--token ).+\z/m
+    cmd = ["cpln", "profile", "create", profile, "--token", token]
     perform!(cmd, sensitive_data_pattern: sensitive_data_pattern)
   end
 
   def profile_delete(profile)
-    cmd = "cpln profile delete #{profile}"
+    cmd = ["cpln", "profile", "delete", profile]
     perform!(cmd)
   end
 
@@ -102,7 +102,7 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     build_args.each { |build_arg| cmd.push("--build-arg", build_arg) }
     cmd << docker_context
 
-    perform!(Shellwords.join(cmd))
+    perform!(cmd)
   end
 
   def fetch_image_details(image)
@@ -114,22 +114,22 @@ class Controlplane # rubocop:disable Metrics/ClassLength
   end
 
   def image_login(org_name = config.org)
-    cmd = "cpln image docker-login --org #{org_name}"
+    cmd = ["cpln", "image", "docker-login", "--org", org_name]
     perform!(cmd, output_mode: :none)
   end
 
   def image_pull(image)
-    cmd = "docker pull #{image}"
+    cmd = ["docker", "pull", image]
     perform!(cmd, output_mode: :none)
   end
 
   def image_tag(old_tag, new_tag)
-    cmd = "docker tag #{old_tag} #{new_tag}"
+    cmd = ["docker", "tag", old_tag, new_tag]
     perform!(cmd)
   end
 
   def image_push(image)
-    cmd = "docker push #{image}"
+    cmd = ["docker", "push", image]
     perform!(cmd)
   end
 
@@ -144,7 +144,7 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     # otherwise we query for a gvc with the exact name.
     op = config.should_app_start_with?(app_name) ? "~" : "="
 
-    cmd = "cpln gvc query --org #{org} -o yaml --prop name#{op}#{app_name}"
+    cmd = ["cpln", "gvc", "query", "--org", org, "-o", "yaml", "--prop", "name#{op}#{app_name}"]
     perform_yaml!(cmd)
   end
 
@@ -173,8 +173,8 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     api.workload_list_by_org(org: a_org)
   end
 
-  def fetch_workload(workload)
-    api.workload_get(workload: workload, gvc: gvc, org: org)
+  def fetch_workload(workload, a_gvc = gvc)
+    api.workload_get(workload: workload, gvc: a_gvc, org: org)
   end
 
   def fetch_workload_with_status(workload)
@@ -199,12 +199,12 @@ class Controlplane # rubocop:disable Metrics/ClassLength
   end
   private :workload_status_result
 
-  def fetch_workload!(workload)
-    workload_data = fetch_workload(workload)
+  def fetch_workload!(workload, a_gvc = gvc)
+    workload_data = fetch_workload(workload, a_gvc)
     return workload_data if workload_data
 
     raise "Can't find workload '#{workload}', " \
-          "please create it with 'cpflow apply-template #{workload} -a #{config.app}'."
+          "please create it with 'cpflow apply-template #{workload} -a #{a_gvc}'."
   end
 
   def query_workloads(workload, a_gvc = gvc, a_org = org, partial_workload_match: false, partial_gvc_match: nil)
@@ -216,12 +216,18 @@ class Controlplane # rubocop:disable Metrics/ClassLength
   end
 
   def fetch_workload_replicas(workload, location:)
-    cmd = "cpln workload replica get #{workload} #{gvc_org} --location #{location} -o yaml 2> /dev/null"
-    perform_yaml(cmd)
+    cmd = [
+      "cpln", "workload", "replica", "get", workload,
+      *gvc_org_args, "--location", location, "-o", "yaml"
+    ]
+    perform_yaml(cmd, err: File::NULL)
   end
 
   def stop_workload_replica(workload, replica, location:)
-    cmd = "cpln workload replica stop #{workload} #{gvc_org} --replica-name #{replica} --location #{location}"
+    cmd = [
+      "cpln", "workload", "replica", "stop", workload,
+      *gvc_org_args, "--replica-name", replica, "--location", location
+    ]
     perform(cmd, output_mode: :none)
   end
 
@@ -252,9 +258,13 @@ class Controlplane # rubocop:disable Metrics/ClassLength
   end
 
   def workload_set_image_ref(workload, container:, image:)
-    cmd = "cpln workload update #{workload} #{gvc_org}"
-    cmd += " --set spec.containers.#{container}.image=/org/#{config.org}/image/#{image}"
-    perform!(cmd)
+    cmd = [
+      "cpln", "workload", "update", workload,
+      "--gvc", gvc, "--org", org,
+      "--set", "spec.containers.#{container}.image=/org/#{config.org}/image/#{image}"
+    ]
+    Shell.debug("CMD", Shellwords.join(cmd))
+    perform_with_output(cmd)
   end
 
   def set_workload_env_var(workload, container:, name:, value:)
@@ -272,11 +282,16 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     api.update_workload(org: org, gvc: gvc, workload: workload, data: data)
   end
 
-  def set_workload_suspend(workload, value)
-    data = fetch_workload!(workload)
+  def set_workload_suspend(workload, value, a_gvc = gvc, missing_ok: false)
+    data = missing_ok ? fetch_workload(workload, a_gvc) : fetch_workload!(workload, a_gvc)
+    return true if missing_ok && data.nil?
+
     data["spec"]["defaultOptions"]["suspend"] = value
 
-    api.update_workload(org: org, gvc: gvc, workload: workload, data: data)
+    result = api.update_workload(org: org, gvc: a_gvc, workload: workload, data: data)
+    return true if missing_ok && result.nil?
+
+    result
   end
 
   def workload_suspended?(workload)
@@ -285,7 +300,7 @@ class Controlplane # rubocop:disable Metrics/ClassLength
   end
 
   def workload_force_redeployment(workload)
-    cmd = "cpln workload force-redeployment #{workload} #{gvc_org}"
+    cmd = ["cpln", "workload", "force-redeployment", workload, *gvc_org_args]
     perform!(cmd)
   end
 
@@ -294,9 +309,9 @@ class Controlplane # rubocop:disable Metrics/ClassLength
   end
 
   def workload_connect(workload, location:, container: nil, shell: nil)
-    cmd = "cpln workload connect #{workload} #{gvc_org} --location #{location}"
-    cmd += " --container #{container}" if container
-    cmd += " --shell #{shell}" if shell
+    cmd = ["cpln", "workload", "connect", workload, *gvc_org_args, "--location", location]
+    cmd.push("--container", container) if container
+    cmd.push("--shell", shell) if shell
     perform!(cmd, output_mode: :all)
   end
 
@@ -317,14 +332,20 @@ class Controlplane # rubocop:disable Metrics/ClassLength
       f.write(job_start_yaml)
       f.rewind
 
-      cmd = "cpln workload cron start #{workload} #{gvc_org} --file #{f.path} --location #{location} -o yaml"
+      cmd = [
+        "cpln", "workload", "cron", "start", workload,
+        *gvc_org_args, "--file", f.path, "--location", location, "-o", "yaml"
+      ]
       perform_yaml(cmd)
     end
   end
 
-  def fetch_cron_workload(workload, location:)
-    cmd = "cpln workload cron get #{workload} #{gvc_org} --location #{location} -o yaml"
-    perform_yaml(cmd)
+  def fetch_cron_workload(workload, location:, timeout_seconds: nil)
+    cmd = [
+      "cpln", "workload", "cron", "get", workload,
+      *gvc_org_args, "--location", location, "-o", "yaml"
+    ]
+    perform_yaml(cmd, timeout_seconds: timeout_seconds)
   end
 
   def cron_workload_deployed_version(workload)
@@ -396,7 +417,10 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     query_parts.push("replica=\"#{replica}\"") if replica
     query = "{#{query_parts.join(',')}}"
 
-    cmd = "cpln logs '#{query}' --org #{org} -t -o raw --limit #{limit} --since #{since}"
+    cmd = [
+      "cpln", "logs", query, "--org", org, "-t", "-o", "raw",
+      "--limit", limit.to_s, "--since", since.to_s
+    ]
     perform!(cmd, output_mode: :all)
   end
 
@@ -433,7 +457,7 @@ class Controlplane # rubocop:disable Metrics/ClassLength
       "--identity", identity_link,
       "--permission", "reveal"
     ]
-    perform!(Shellwords.join(cmd))
+    perform!(cmd)
   end
 
   def unbind_identity_from_policy(identity_link, policy, permission: "reveal")
@@ -443,33 +467,25 @@ class Controlplane # rubocop:disable Metrics/ClassLength
       "--identity", identity_link,
       "--permission", permission
     ]
-    perform!(Shellwords.join(cmd))
+    perform!(cmd)
   end
 
   # apply
-  def apply_template(data, wait: false) # rubocop:disable Metrics/MethodLength, Metrics/PerceivedComplexity
+  def apply_template(data, wait: false) # rubocop:disable Metrics/MethodLength
     Tempfile.create do |f|
       f.write(data)
       f.rewind
-      cmd = "cpln apply #{gvc_org} --file #{f.path}"
-      cmd += " --ready" if wait && ENV.fetch("DISABLE_APPLY_READY", nil).nil?
-      if Shell.tmp_stderr
-        cmd += " 2> #{Shell.tmp_stderr.path}" if Shell.should_hide_output?
+      cmd = ["cpln", "apply", *gvc_org_args, "--file", f.path]
+      cmd << "--ready" if wait && ENV.fetch("DISABLE_APPLY_READY", nil).nil?
+      spawn_options = {}
+      spawn_options[:err] = Shell.tmp_stderr if Shell.should_hide_output?
 
-        Shell.debug("CMD", cmd)
+      Shell.debug("CMD", Shellwords.join(cmd))
 
-        result = Shell.cmd(cmd)
-        parse_apply_result(result[:output]) if result[:success]
-      else
-        Shell.debug("CMD", cmd)
+      result = Shell.cmd(*cmd, **spawn_options)
+      return parse_apply_result(result[:output]) if result[:success]
 
-        result = Shell.cmd(cmd)
-        if result[:success]
-          parse_apply_result(result[:output])
-        else
-          Shell.abort("Command exited with non-zero status.")
-        end
-      end
+      Shell.abort("Command exited with non-zero status.") unless Shell.tmp_stderr
     end
   end
 
@@ -535,23 +551,15 @@ class Controlplane # rubocop:disable Metrics/ClassLength
           "or ensure that the name is correct."
   end
 
-  # `output_mode` can be :all, :errors_only or :none.
-  # If not provided, it will be determined based on the `HIDE_COMMAND_OUTPUT` env var
-  # or the return value of `Shell.should_hide_output?`.
-  def build_command(cmd, output_mode: nil) # rubocop:disable Metrics/MethodLength
+  # `output_mode` can be :all, :errors_only or :none. Redirection is expressed as
+  # Process.spawn options so argv commands never need to pass through a shell.
+  def command_spawn_options(output_mode = nil)
     output_mode ||= determine_command_output_mode
-    raise "Array commands require output mode 'all'." if cmd.is_a?(Array) && %i[errors_only none].include?(output_mode)
-
-    case output_mode
-    when :all
-      cmd
-    when :errors_only
-      "#{cmd} > /dev/null"
-    when :none
-      "#{cmd} > /dev/null 2>&1"
-    else
-      raise "Invalid command output mode '#{output_mode}'."
-    end
+    return {} if output_mode == :all
+    return { out: File::NULL } if output_mode == :errors_only
+    return { out: File::NULL, err: File::NULL } if output_mode == :none
+
+    raise "Invalid command output mode '#{output_mode}'."
   end
 
   def determine_command_output_mode
@@ -565,19 +573,22 @@ class Controlplane # rubocop:disable Metrics/ClassLength
   end
 
   def perform(cmd, output_mode: nil, sensitive_data_pattern: nil)
-    cmd = build_command(cmd, output_mode: output_mode)
+    validate_argv!(cmd)
+    spawn_options = command_spawn_options(output_mode)
 
-    debug_cmd = cmd.is_a?(Array) ? Shellwords.join(cmd) : cmd
+    debug_cmd = Shellwords.join(cmd)
     Shell.debug("CMD", debug_cmd, sensitive_data_pattern: sensitive_data_pattern)
 
-    kernel_system_with_pid_handling(cmd)
+    kernel_system_with_pid_handling(cmd, **spawn_options)
   end
 
   # NOTE: full analogue of Kernel.system which returns pids and saves it to child_pids for proper killing.
   # Returns true on zero exit, false on non-zero exit, nil when the process was signal-killed.
   # SystemCallError (e.g. cpln binary missing) propagates — startup checks ensure this is unreachable in practice.
-  def kernel_system_with_pid_handling(cmd)
-    pid = cmd.is_a?(Array) ? Process.spawn(*cmd) : Process.spawn(cmd)
+  def kernel_system_with_pid_handling(cmd, **spawn_options)
+    validate_argv!(cmd)
+
+    pid = Process.spawn(*cmd, **spawn_options)
     $child_pids << pid # rubocop:disable Style/GlobalVars
 
     _, status = Process.wait2(pid)
@@ -586,15 +597,65 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     status.exited? ? status.success? : nil
   end
 
+  def perform_with_output(cmd)
+    readers, writers = 2.times.map { IO.pipe }.transpose
+    pid = spawn_captured_process(cmd, writers)
+    captured_output = drain_captured_output(readers, determine_command_output_mode)
+    _, status = Process.wait2(pid)
+    reaped = true
+    { output: captured_output, success: status.exited? && status.success? }
+  ensure
+    [*readers, *writers].compact.each { |pipe| pipe.close unless pipe.closed? }
+    $child_pids.delete(pid) if reaped # rubocop:disable Style/GlobalVars
+  end
+
+  def spawn_captured_process(cmd, writers)
+    validate_argv!(cmd)
+    pid = Process.spawn(*cmd, out: writers.fetch(0), err: writers.fetch(1))
+    $child_pids << pid # rubocop:disable Style/GlobalVars
+    writers.each(&:close)
+    pid
+  end
+
+  def drain_captured_output(readers, output_mode)
+    stream_roles = { readers.fetch(0) => :stdout, readers.fetch(1) => :stderr }
+    pending_readers = readers.dup
+    captured_output = +""
+
+    until pending_readers.empty?
+      IO.select(pending_readers).first.each do |reader|
+        drain_ready_output(reader, stream_roles.fetch(reader), pending_readers, captured_output, output_mode)
+      end
+    end
+
+    captured_output
+  end
+
+  def drain_ready_output(reader, stream_role, pending_readers, captured_output, output_mode)
+    chunk = reader.read_nonblock(4096)
+    captured_output << chunk
+    return if output_mode == :none || (stream_role == :stdout && output_mode != :all)
+
+    stream = stream_role == :stdout ? $stdout : $stderr
+    stream.write(chunk)
+    stream.flush
+  rescue IO::WaitReadable
+    nil
+  rescue EOFError
+    pending_readers.delete(reader)
+  end
+  private :spawn_captured_process, :drain_captured_output, :drain_ready_output
+
   def perform!(cmd, output_mode: nil, sensitive_data_pattern: nil)
     success = perform(cmd, output_mode: output_mode, sensitive_data_pattern: sensitive_data_pattern)
     success || Shell.abort("Command exited with non-zero status.")
   end
 
-  def perform_yaml(cmd)
-    Shell.debug("CMD", cmd)
+  def perform_yaml(cmd, timeout_seconds: nil, **spawn_options)
+    validate_argv!(cmd)
+    Shell.debug("CMD", Shellwords.join(cmd))
 
-    result = Shell.cmd(cmd)
+    result = Shell.cmd(*cmd, timeout_seconds: timeout_seconds, **spawn_options)
     YAML.safe_load(result[:output], permitted_classes: [Time]) if result[:success]
   end
 
@@ -602,7 +663,13 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     perform_yaml(cmd) || Shell.abort("Command exited with non-zero status.")
   end
 
-  def gvc_org
-    "--gvc #{gvc} --org #{org}"
+  def gvc_org_args
+    ["--gvc", gvc, "--org", org]
+  end
+
+  def validate_argv!(cmd)
+    return if cmd.is_a?(Array) && cmd.length >= 2
+
+    raise ArgumentError, "Commands must be argv arrays with at least two elements."
   end
 end

data/lib/core/shell.rb

@@ -1,17 +1,21 @@
 # frozen_string_literal: true
 
 class Shell
+  class CommandTimeout < RuntimeError; end
+
   class << self
     attr_reader :tmp_stderr, :verbose
   end
 
   def self.use_tmp_stderr
-    @tmp_stderr = Tempfile.create
-
-    yield
+    previous_tmp_stderr = @tmp_stderr
 
-    @tmp_stderr.close
-    @tmp_stderr = nil
+    Tempfile.create do |tmp_stderr|
+      @tmp_stderr = tmp_stderr
+      yield
+    ensure
+      @tmp_stderr = previous_tmp_stderr
+    end
   end
 
   def self.write_to_tmp_stderr(message)
@@ -65,18 +69,39 @@ class Shell
     tmp_stderr && !verbose
   end
 
-  def self.cmd(*cmd_to_run, capture_stderr: false, separate_stderr: false)
-    return cmd_with_separate_stderr(*cmd_to_run) if separate_stderr
+  def self.cmd(*cmd_to_run, capture_stderr: false, separate_stderr: false, timeout_seconds: nil, **spawn_options)
+    return timed_cmd(cmd_to_run, capture_stderr, separate_stderr, timeout_seconds, spawn_options) if timeout_seconds
 
-    output, status = capture_stderr ? Open3.capture2e(*cmd_to_run) : Open3.capture2(*cmd_to_run)
+    return cmd_with_separate_stderr(*cmd_to_run, **spawn_options) if separate_stderr
+
+    output, status = capture_output(cmd_to_run, capture_stderr, spawn_options)
     {
       output: output,
       success: status.success?
     }
   end
 
-  def self.cmd_with_separate_stderr(*cmd_to_run)
-    output, error_output, status = Open3.capture3(*cmd_to_run)
+  def self.capture_output(cmd_to_run, capture_stderr, spawn_options)
+    return Open3.capture2e(*cmd_to_run, **spawn_options) if capture_stderr
+
+    Open3.capture2(*cmd_to_run, **spawn_options)
+  end
+  private_class_method :capture_output
+
+  def self.timed_cmd(cmd_to_run, capture_stderr, separate_stderr, timeout_seconds, spawn_options)
+    raise ArgumentError, "Process options cannot be combined with timeout_seconds." unless spawn_options.empty?
+
+    TimedCommand.capture(
+      *cmd_to_run,
+      capture_stderr: capture_stderr,
+      separate_stderr: separate_stderr,
+      timeout_seconds: timeout_seconds
+    )
+  end
+  private_class_method :timed_cmd
+
+  def self.cmd_with_separate_stderr(*cmd_to_run, **spawn_options)
+    output, error_output, status = Open3.capture3(*cmd_to_run, **spawn_options)
     { output: output, error_output: error_output, success: status.success? }
   end
   private_class_method :cmd_with_separate_stderr

data/lib/core/timed_command.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+class TimedCommand
+  def self.capture(*command, capture_stderr:, separate_stderr:, timeout_seconds:)
+    new(command, capture_stderr, separate_stderr, timeout_seconds).capture
+  end
+
+  def initialize(command, capture_stderr, separate_stderr, timeout_seconds)
+    raise ArgumentError, "timeout_seconds must be positive" unless timeout_seconds.positive?
+
+    @command = command
+    @capture_stderr = capture_stderr
+    @separate_stderr = separate_stderr
+    @timeout_seconds = timeout_seconds
+  end
+
+  def capture
+    @deadline = monotonic_time + @timeout_seconds
+    @command_cleaned_up = false
+    return capture_separate_streams if @separate_stderr
+    return capture_merged_streams if @capture_stderr
+
+    capture_stdout
+  end
+
+  private
+
+  def capture_stdout # rubocop:disable Metrics/MethodLength
+    completed = false
+    Open3.popen2(*@command, pgroup: true) do |stdin, stdout, wait_thread|
+      stdin.close
+      output_reader = Thread.new { stdout.read }
+      wait_for_command(wait_thread, output_reader)
+      completed = true
+      { output: output_reader.value, success: wait_thread.value.success? }
+    ensure
+      cleanup_unfinished_command(wait_thread, output_reader) unless completed || @command_cleaned_up
+      output_reader&.join
+    end
+  end
+
+  def capture_merged_streams # rubocop:disable Metrics/MethodLength
+    completed = false
+    Open3.popen2e(*@command, pgroup: true) do |stdin, output, wait_thread|
+      stdin.close
+      output_reader = Thread.new { output.read }
+      wait_for_command(wait_thread, output_reader)
+      completed = true
+      { output: output_reader.value, success: wait_thread.value.success? }
+    ensure
+      cleanup_unfinished_command(wait_thread, output_reader) unless completed || @command_cleaned_up
+      output_reader&.join
+    end
+  end
+
+  def capture_separate_streams # rubocop:disable Metrics/MethodLength
+    completed = false
+    Open3.popen3(*@command, pgroup: true) do |stdin, stdout, stderr, wait_thread|
+      stdin.close
+      output_reader = Thread.new { stdout.read }
+      error_reader = Thread.new { stderr.read }
+      wait_for_command(wait_thread, output_reader, error_reader)
+      completed = true
+      {
+        output: output_reader.value,
+        error_output: error_reader.value,
+        success: wait_thread.value.success?
+      }
+    ensure
+      cleanup_unfinished_command(wait_thread, output_reader, error_reader) unless completed || @command_cleaned_up
+      output_reader&.join
+      error_reader&.join
+    end
+  end
+
+  def wait_for_command(wait_thread, *output_readers)
+    observed_threads = [wait_thread, *output_readers]
+    return if observed_threads.all? { |thread| thread.join(remaining_timeout) }
+
+    terminate_process_group(wait_thread)
+    output_readers.each(&:kill)
+    output_readers.each(&:join)
+    @command_cleaned_up = true
+    raise Shell::CommandTimeout, "Command exceeded the #{@timeout_seconds}-second timeout"
+  end
+
+  def remaining_timeout
+    [@deadline - monotonic_time, 0].max
+  end
+
+  def monotonic_time
+    Process.clock_gettime(Process::CLOCK_MONOTONIC)
+  end
+
+  def terminate_process_group(wait_thread)
+    Process.kill("TERM", -wait_thread.pid)
+    wait_thread.join(1)
+
+    Process.kill("KILL", -wait_thread.pid)
+    wait_thread.join
+  rescue Errno::ESRCH, Errno::ECHILD
+    nil
+  end
+
+  def cleanup_unfinished_command(wait_thread, *output_readers)
+    return unless wait_thread
+
+    terminate_process_group(wait_thread)
+    output_readers.compact.each(&:kill)
+  end
+end

data/lib/cpflow/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Cpflow
-  VERSION = "5.3.0"
+  VERSION = "6.0.0.rc.0"
   MIN_CPLN_VERSION = "3.1.0"
 end

data/lib/cpflow.rb

@@ -122,7 +122,7 @@ module Cpflow
     end
 
     def self.subcommand?
-      (subcommand_names & ARGV).any?
+      subcommand_names.intersect?(ARGV)
     end
     private_class_method :subcommand?
 

data/lib/github_flow_templates/.github/workflows/cpflow-promote-staging-to-production.yml

@@ -61,12 +61,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Checkout control-plane-flow actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: shakacode/control-plane-flow
           ref: __CPFLOW_GITHUB_ACTIONS_REF__
@@ -90,7 +90,7 @@ jobs:
           fi
 
       - name: Validate required secrets and variables
-        uses: ./.cpflow/.github/actions/cpflow-validate-config
+        uses: ./.github/actions/cpflow-validate-config
         # Pass secrets via env so the composite action checks indirect shell
         # variables instead of interpolating secret values into a run script.
         env:
@@ -171,7 +171,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Setup production environment
-        uses: ./.cpflow/.github/actions/cpflow-setup-environment
+        uses: ./.github/actions/cpflow-setup-environment
         with:
           token: ${{ secrets.CPLN_TOKEN_PRODUCTION }}
           org: ${{ steps.cpln-orgs.outputs.production }}
@@ -237,7 +237,7 @@ jobs:
 
       - name: Detect release phase support
         id: release-phase
-        uses: ./.cpflow/.github/actions/cpflow-detect-release-phase
+        uses: ./.github/actions/cpflow-detect-release-phase
         with:
           app_name: ${{ vars.PRODUCTION_APP_NAME }}
 
@@ -441,7 +441,7 @@ jobs:
           echo "image=${staging_image}" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Copy image from staging
         id: copy-image
@@ -589,7 +589,7 @@ jobs:
 
       - name: Wait for deployment health
         id: health-check
-        uses: ./.cpflow/.github/actions/cpflow-wait-for-health
+        uses: ./.github/actions/cpflow-wait-for-health
         with:
           workload_name: ${{ steps.workloads.outputs.primary }}
           app_name: ${{ vars.PRODUCTION_APP_NAME }}