cpflow 5.3.0 → 6.0.0

data/.github/actions/cpflow-setup-environment/action.yml

@@ -19,6 +19,10 @@ inputs:
     description: Directory where ruby/setup-ruby should detect Ruby version files.
     required: false
     default: "."
+  cpflow_source_directory:
+    description: Directory containing the checked-out control-plane-flow source.
+    required: false
+    default: ".cpflow"
   # GitHub parses double-brace expression snippets inside action metadata (including
   # `description:`) while loading the composite action, and the `vars` context is not
   # available in that phase. Keep these descriptions in plain prose - reference repo
@@ -47,8 +51,8 @@ inputs:
 
 runs:
   using: composite
-  # ruby/setup-ruby tracks Ruby/toolcache updates on a major tag. The privileged
-  # reusable workflows pin GitHub-owned actions to immutable SHAs.
+  # Dependabot proposes action updates, but each reviewed dependency remains
+  # pinned to the release commit recorded beside its exact version comment.
   steps:
     - name: Resolve Ruby setup version
       id: ruby-version
@@ -80,9 +84,7 @@ runs:
         echo "ruby_version=${ruby_version}" >> "$GITHUB_OUTPUT"
 
     - name: Set up Ruby
-      # ruby/setup-ruby intentionally tracks the v1 tag so Ruby/toolcache updates
-      # roll out automatically; Dependabot/Renovate can manage this non-GitHub action.
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{ steps.ruby-version.outputs.ruby_version }}
         working-directory: ${{ inputs.working_directory }}
@@ -93,7 +95,7 @@ runs:
         CONTROL_PLANE_FLOW_REF: ${{ inputs.control_plane_flow_ref }}
         CPLN_CLI_VERSION: ${{ inputs.cpln_cli_version }}
         CPFLOW_VERSION: ${{ inputs.cpflow_version }}
-        CPFLOW_SOURCE_DIR: ${{ github.action_path }}/../../..
+        CPFLOW_SOURCE_DIR: ${{ inputs.cpflow_source_directory }}
       run: |
         set -euo pipefail
 

data/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: "/.github/actions/cpflow-setup-environment"
+    schedule:
+      interval: weekly

data/.github/workflows/check_cpln_links.yml

@@ -6,13 +6,18 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check_cpln_links:
     runs-on: ubuntu-latest
     name: Check Links
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Validate outgoing links to Control Plane
         run: |
           TERM=xterm-color ./script/check_cpln_links

data/.github/workflows/claude-code-review.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     types: [opened, synchronize, ready_for_review, reopened]
 
+permissions: {}
+
 jobs:
   claude-review:
     runs-on: ubuntu-latest
@@ -15,13 +17,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@8251c103ac8c1d761882c86aba1412c7f583c844 # v1.0.213
         env:
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
         with:

data/.github/workflows/claude.yml

@@ -10,6 +10,8 @@ on:
   pull_request_review:
     types: [submitted]
 
+permissions: {}
+
 jobs:
   authorize_claude_actor:
     if: |
@@ -25,7 +27,7 @@ jobs:
     steps:
       - name: Verify actor can run Claude
         id: permission-gate
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const owner = context.repo.owner;
@@ -119,13 +121,14 @@ jobs:
       statuses: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@8251c103ac8c1d761882c86aba1412c7f583c844 # v1.0.213
         env:
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
         with:
@@ -145,4 +148,3 @@ jobs:
           # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
           # or https://code.claude.com/docs/en/cli-reference for available options
           # claude_args: '--allowed-tools Bash(gh pr:*)'
-

data/.github/workflows/coderabbit-lifecycle-review.yml

@@ -0,0 +1,29 @@
+name: CodeRabbit Lifecycle Review
+
+on:
+  pull_request:
+    types: [opened, ready_for_review]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  request-review:
+    if: github.event.pull_request.head.repo.fork == false
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add CodeRabbit lifecycle label
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          # Both labels must already exist in the repo (addLabels does not create them); created 2026-09-06.
+          script: |
+            const label = context.payload.action === 'opened'
+              ? 'coderabbit:first-pass'
+              : 'coderabbit:ready';
+
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: [label]
+            });

data/.github/workflows/command_docs.yml

@@ -6,15 +6,20 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   rspec:
     runs-on: ubuntu-latest
     name: Command Docs
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: "3.2"
           bundler-cache: true

data/.github/workflows/cpflow-cleanup-stale-review-apps.yml

@@ -23,8 +23,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
+      # No explicit ref: checkout's default resolves to this event's recorded commit
+      # (GITHUB_SHA), which is trusted base-repository code and is exempt from checkout v7's fork-PR guard.
+      - name: Checkout generated cpflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Checkout control-plane-flow actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -32,7 +39,7 @@ jobs:
           persist-credentials: false
 
       - name: Validate required secrets and variables
-        uses: ./.cpflow/.github/actions/cpflow-validate-config
+        uses: ./.github/actions/cpflow-validate-config
         env:
           CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
         with:
@@ -40,21 +47,21 @@ jobs:
             secret:CPLN_TOKEN_STAGING
 
       - name: Checkout caller repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: app
           persist-credentials: false
 
       - name: Resolve review app config
         id: review-config
-        uses: ./.cpflow/.github/actions/cpflow-resolve-review-config
+        uses: ./.github/actions/cpflow-resolve-review-config
         with:
           working_directory: app
           configured_cpln_org_staging: ${{ vars.CPLN_ORG_STAGING }}
           configured_review_app_prefix: ${{ vars.REVIEW_APP_PREFIX }}
 
       - name: Setup environment
-        uses: ./.cpflow/.github/actions/cpflow-setup-environment
+        uses: ./.github/actions/cpflow-setup-environment
         with:
           token: ${{ secrets.CPLN_TOKEN_STAGING }}
           org: ${{ steps.review-config.outputs.cpln_org }}

data/.github/workflows/cpflow-delete-review-app.yml

@@ -545,7 +545,7 @@ jobs:
       - name: React to delete command
         if: github.event_name == 'issue_comment'
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             try {
@@ -563,8 +563,15 @@ jobs:
               }
             }
 
+      # No explicit ref: checkout's default resolves to this event's recorded commit
+      # (GITHUB_SHA; the base-branch tip under pull_request_target) and is exempt from checkout v7's fork-PR guard.
+      - name: Checkout generated cpflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Checkout control-plane-flow actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -573,7 +580,7 @@ jobs:
 
       - name: Validate required secrets and variables
         id: config
-        uses: ./.cpflow/.github/actions/cpflow-validate-config
+        uses: ./.github/actions/cpflow-validate-config
         env:
           CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
         with:
@@ -583,7 +590,7 @@ jobs:
 
       - name: Checkout repository
         if: steps.config.outputs.ready == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: app
           persist-credentials: false
@@ -591,7 +598,7 @@ jobs:
       - name: Resolve review app config
         if: steps.config.outputs.ready == 'true'
         id: review-config
-        uses: ./.cpflow/.github/actions/cpflow-resolve-review-config
+        uses: ./.github/actions/cpflow-resolve-review-config
         with:
           working_directory: app
           configured_cpln_org_staging: ${{ vars.CPLN_ORG_STAGING }}
@@ -600,7 +607,7 @@ jobs:
 
       - name: Setup environment
         if: steps.config.outputs.ready == 'true'
-        uses: ./.cpflow/.github/actions/cpflow-setup-environment
+        uses: ./.github/actions/cpflow-setup-environment
         with:
           token: ${{ secrets.CPLN_TOKEN_STAGING }}
           org: ${{ steps.review-config.outputs.cpln_org }}
@@ -611,7 +618,7 @@ jobs:
 
       - name: Set workflow links
         if: steps.config.outputs.ready == 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const workflowUrl = `${process.env.GITHUB_SERVER_URL}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
@@ -624,7 +631,7 @@ jobs:
       - name: Create initial PR comment
         if: steps.config.outputs.ready == 'true'
         id: create-comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const body = [
@@ -644,7 +651,7 @@ jobs:
       - name: Delete review app
         id: delete-app
         if: steps.config.outputs.ready == 'true'
-        uses: ./.cpflow/.github/actions/cpflow-delete-control-plane-app
+        uses: ./.github/actions/cpflow-delete-control-plane-app
         with:
           app_name: ${{ steps.review-config.outputs.app_name }}
           cpln_org: ${{ steps.review-config.outputs.cpln_org }}
@@ -655,7 +662,7 @@ jobs:
         id: deactivate-deployments
         if: steps.config.outputs.ready == 'true' && steps.delete-app.outcome == 'success'
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           APP_NAME: ${{ steps.review-config.outputs.app_name }}
         with:
@@ -710,7 +717,7 @@ jobs:
       # config validation created the initial PR comment and workflow link env vars it updates.
       - name: Finalize delete status
         if: always() && steps.config.outputs.ready == 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           APP_NAME: ${{ steps.review-config.outputs.app_name }}
           COMMENT_ID: ${{ steps.create-comment.outputs.comment-id }}

data/.github/workflows/cpflow-deploy-review-app.yml

@@ -4,6 +4,12 @@ run-name: "Deploy Review App - PR #${{ github.event.pull_request.number || githu
 
 on:
   workflow_call:
+    inputs:
+      docker_build_extra_args:
+        description: Optional newline-delimited extra docker build tokens, appended to the repository variable.
+        required: false
+        type: string
+        default: ""
     outputs:
       image_built:
         description: Whether this run successfully built the application image.
@@ -12,6 +18,9 @@ on:
       CPLN_TOKEN_STAGING:
         description: Control Plane token for the staging org that owns review apps.
         required: true
+      REVIEW_APP_DOCKER_BUILD_SECRETS:
+        description: Optional newline-delimited id=value secrets passed to review-app builds through BuildKit secret mounts.
+        required: false
       DOCKER_BUILD_SSH_KEY:
         description: Optional SSH key used by Docker builds that fetch private dependencies.
         required: false
@@ -590,7 +599,7 @@ jobs:
       - name: React to deploy command
         if: github.event_name == 'issue_comment'
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             try {
@@ -608,8 +617,15 @@ jobs:
               }
             }
 
+      # No explicit ref: checkout's default resolves to this event's recorded commit
+      # (GITHUB_SHA), which is trusted base-repository code and is exempt from checkout v7's fork-PR guard.
+      - name: Checkout generated cpflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Checkout control-plane-flow actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -618,7 +634,7 @@ jobs:
 
       - name: Validate required secrets and variables
         id: config
-        uses: ./.cpflow/.github/actions/cpflow-validate-config
+        uses: ./.github/actions/cpflow-validate-config
         env:
           CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
         with:
@@ -691,7 +707,9 @@ jobs:
             exit 0
           fi
 
-          if [[ "${EVENT_NAME}" == "pull_request" ]]; then
+          # pull_request_target is in this workflow's event allowlist, so it needs the same
+          # fork skip as pull_request instead of falling through to the workflow_dispatch error.
+          if [[ "${EVENT_NAME}" == "pull_request" || "${EVENT_NAME}" == "pull_request_target" ]]; then
             echo "allowed=false" >> "$GITHUB_OUTPUT"
             {
               echo "Review app deploys are skipped for fork pull requests."
@@ -714,7 +732,7 @@ jobs:
 
       - name: Checkout PR commit
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.PR_SHA }}
           path: app
@@ -730,7 +748,7 @@ jobs:
       - name: Resolve review app config
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true'
         id: review-config
-        uses: ./.cpflow/.github/actions/cpflow-resolve-review-config
+        uses: ./.github/actions/cpflow-resolve-review-config
         with:
           working_directory: app
           configured_cpln_org_staging: ${{ vars.CPLN_ORG_STAGING }}
@@ -739,7 +757,7 @@ jobs:
 
       - name: Setup environment
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true'
-        uses: ./.cpflow/.github/actions/cpflow-setup-environment
+        uses: ./.github/actions/cpflow-setup-environment
         with:
           token: ${{ secrets.CPLN_TOKEN_STAGING }}
           org: ${{ steps.review-config.outputs.cpln_org }}
@@ -751,7 +769,7 @@ jobs:
       - name: Detect release phase support
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true'
         id: release-phase
-        uses: ./.cpflow/.github/actions/cpflow-detect-release-phase
+        uses: ./.github/actions/cpflow-detect-release-phase
         with:
           app_name: ${{ steps.review-config.outputs.app_name }}
           working_directory: app
@@ -826,7 +844,7 @@ jobs:
       - name: Create initial PR comment
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true' && (steps.check-app.outputs.exists == 'true' || steps.setup-review-app.outcome == 'success')
         id: create-comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const body = [
@@ -845,7 +863,7 @@ jobs:
 
       - name: Set deployment links
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true' && (steps.check-app.outputs.exists == 'true' || steps.setup-review-app.outcome == 'success')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const workflowUrl = `${process.env.GITHUB_SERVER_URL}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
@@ -858,7 +876,7 @@ jobs:
       - name: Initialize GitHub deployment
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true' && (steps.check-app.outputs.exists == 'true' || steps.setup-review-app.outcome == 'success')
         id: init-deployment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const deployment = await github.rest.repos.createDeployment({
@@ -885,7 +903,7 @@ jobs:
 
       - name: Update PR comment with build status
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true' && (steps.check-app.outputs.exists == 'true' || steps.setup-review-app.outcome == 'success')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           COMMENT_ID: ${{ steps.create-comment.outputs.comment-id }}
         with:
@@ -913,20 +931,23 @@ jobs:
       - name: Build Docker image
         id: build-image
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true' && (steps.check-app.outputs.exists == 'true' || steps.setup-review-app.outcome == 'success')
-        uses: ./.cpflow/.github/actions/cpflow-build-docker-image
+        uses: ./.github/actions/cpflow-build-docker-image
         with:
           app_name: ${{ steps.review-config.outputs.app_name }}
           org: ${{ steps.review-config.outputs.cpln_org }}
           commit: ${{ env.PR_SHA }}
           pr_number: ${{ env.PR_NUMBER }}
-          docker_build_extra_args: ${{ vars.DOCKER_BUILD_EXTRA_ARGS }}
+          docker_build_extra_args: |
+            ${{ vars.DOCKER_BUILD_EXTRA_ARGS }}
+            ${{ inputs.docker_build_extra_args }}
+          docker_build_secrets: ${{ secrets.REVIEW_APP_DOCKER_BUILD_SECRETS }}
           docker_build_ssh_key: ${{ secrets.DOCKER_BUILD_SSH_KEY }}
           docker_build_ssh_known_hosts: ${{ vars.DOCKER_BUILD_SSH_KNOWN_HOSTS }}
           working_directory: app
 
       - name: Update PR comment with deploy status
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true' && (steps.check-app.outputs.exists == 'true' || steps.setup-review-app.outcome == 'success')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           COMMENT_ID: ${{ steps.create-comment.outputs.comment-id }}
           DEPLOYING_ICON_URL: ${{ vars.REVIEW_APP_DEPLOYING_ICON_URL }}
@@ -998,7 +1019,7 @@ jobs:
       - name: Wait for deployment health
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true' && (steps.check-app.outputs.exists == 'true' || steps.setup-review-app.outcome == 'success')
         id: health-check
-        uses: ./.cpflow/.github/actions/cpflow-wait-for-health
+        uses: ./.github/actions/cpflow-wait-for-health
         with:
           workload_name: ${{ env.PRIMARY_WORKLOAD || 'rails' }}
           app_name: ${{ steps.review-config.outputs.app_name }}
@@ -1087,7 +1108,7 @@ jobs:
 
       - name: Finalize deployment status
         if: always() && steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true' && (steps.check-app.outputs.exists == 'true' || steps.setup-review-app.outcome == 'success')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           COMMENT_ID: ${{ steps.create-comment.outputs.comment-id }}
           DEPLOYMENT_ID: ${{ steps.init-deployment.outputs.result }}

data/.github/workflows/cpflow-deploy-staging.yml

@@ -5,6 +5,11 @@ run-name: Deploy Control Plane staging app
 on:
   workflow_call:
     inputs:
+      docker_build_extra_args:
+        description: Optional newline-delimited extra docker build tokens, appended to the repository variable.
+        required: false
+        type: string
+        default: ""
       staging_app_branch_default:
         description: Fallback branch name baked into the generated caller workflow.
         required: false
@@ -14,6 +19,9 @@ on:
       CPLN_TOKEN_STAGING:
         description: Control Plane token for the staging org.
         required: true
+      DOCKER_BUILD_SECRETS:
+        description: Optional newline-delimited id=value secrets passed through BuildKit secret mounts.
+        required: false
       DOCKER_BUILD_SSH_KEY:
         description: Optional SSH key used by Docker builds that fetch private dependencies.
         required: false
@@ -60,9 +68,15 @@ jobs:
             echo "is_deployable=false" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Checkout generated cpflow actions
+        if: steps.check-branch.outputs.is_deployable == 'true'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Checkout control-plane-flow actions
         if: steps.check-branch.outputs.is_deployable == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -71,7 +85,7 @@ jobs:
 
       - name: Validate required secrets and variables
         if: steps.check-branch.outputs.is_deployable == 'true'
-        uses: ./.cpflow/.github/actions/cpflow-validate-config
+        uses: ./.github/actions/cpflow-validate-config
         env:
           CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
           CPLN_ORG_STAGING: ${{ vars.CPLN_ORG_STAGING }}
@@ -89,12 +103,12 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Checkout control-plane-flow actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -102,7 +116,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup environment
-        uses: ./.cpflow/.github/actions/cpflow-setup-environment
+        uses: ./.github/actions/cpflow-setup-environment
         with:
           token: ${{ secrets.CPLN_TOKEN_STAGING }}
           org: ${{ vars.CPLN_ORG_STAGING }}
@@ -112,12 +126,15 @@ jobs:
           control_plane_flow_ref: ${{ job.workflow_ref }}
 
       - name: Build Docker image
-        uses: ./.cpflow/.github/actions/cpflow-build-docker-image
+        uses: ./.github/actions/cpflow-build-docker-image
         with:
           app_name: ${{ env.APP_NAME }}
           org: ${{ vars.CPLN_ORG_STAGING }}
           commit: ${{ github.sha }}
-          docker_build_extra_args: ${{ vars.DOCKER_BUILD_EXTRA_ARGS }}
+          docker_build_extra_args: |
+            ${{ vars.DOCKER_BUILD_EXTRA_ARGS }}
+            ${{ inputs.docker_build_extra_args }}
+          docker_build_secrets: ${{ secrets.DOCKER_BUILD_SECRETS }}
           docker_build_ssh_key: ${{ secrets.DOCKER_BUILD_SSH_KEY }}
           docker_build_ssh_known_hosts: ${{ vars.DOCKER_BUILD_SSH_KNOWN_HOSTS }}
 
@@ -128,12 +145,12 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Checkout control-plane-flow actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -141,7 +158,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup environment
-        uses: ./.cpflow/.github/actions/cpflow-setup-environment
+        uses: ./.github/actions/cpflow-setup-environment
         with:
           token: ${{ secrets.CPLN_TOKEN_STAGING }}
           org: ${{ vars.CPLN_ORG_STAGING }}
@@ -152,7 +169,7 @@ jobs:
 
       - name: Detect release phase support
         id: release-phase
-        uses: ./.cpflow/.github/actions/cpflow-detect-release-phase
+        uses: ./.github/actions/cpflow-detect-release-phase
         with:
           app_name: ${{ env.APP_NAME }}