cpflow 6.0.0.rc.0 → 6.0.1

data/lib/core/repo_introspection.rb

@@ -1,8 +1,9 @@
 # frozen_string_literal: true
 
 require "yaml"
+require "uri"
 
-module RepoIntrospection
+module RepoIntrospection # rubocop:disable Metrics/ModuleLength
   DEFAULT_APP_PREFIX = "my-app"
   RUBY_VERSION_DIRECTIVE_PATTERN = /^\s*ruby\s+['"\d]/
   RUBY_VERSION_DIRECTIVE_PREFIX = /^\s*ruby\s+/
@@ -87,6 +88,49 @@ module RepoIntrospection
     sqlite_database_config?(production)
   end
 
+  # Returns literal SQLite database paths from the production configuration.
+  # Dynamic ERB values are intentionally omitted because the generator cannot
+  # safely redirect a path that is only known at runtime.
+  def self.sqlite_database_paths_in_production(root)
+    path = File.join(root, "config/database.yml")
+    return [] unless File.file?(path)
+
+    parsed = safe_load_database_yml(File.read(path))
+    production = parsed.is_a?(Hash) ? parsed["production"] : nil
+    return [] unless production.is_a?(Hash) && sqlite_database_config?(production)
+
+    database_connection_configs(production).filter_map do |config|
+      sqlite_database_path(config)
+    end.uniq
+  end
+
+  def self.unresolved_sqlite_database_paths_in_production?(root)
+    path = File.join(root, "config/database.yml")
+    return false unless File.file?(path)
+
+    parsed = safe_load_database_yml(File.read(path))
+    production = parsed.is_a?(Hash) ? parsed["production"] : nil
+    return false unless production.is_a?(Hash) && sqlite_database_config?(production)
+
+    database_connection_configs(production).any? do |config|
+      sqlite_database_path(config).nil? && !sqlite_in_memory_database_config?(config)
+    end
+  end
+
+  def self.dynamic_database_url_in_production?(root)
+    path = File.join(root, "config/database.yml")
+    return false unless File.file?(path)
+
+    parsed = safe_load_database_yml(File.read(path))
+    production = parsed.is_a?(Hash) ? parsed["production"] : nil
+    return false unless production.is_a?(Hash)
+
+    database_connection_configs(production).any? do |config|
+      url = config["url"]
+      url.is_a?(String) && url.include?("__erb__") && !sqlite_database_url?(url)
+    end
+  end
+
   # Determines whether a database config hash uses SQLite. Handles both
   # the single-database shape (top-level `adapter`/`url`) and Rails 6.1+ multi-database
   # shape where each connection sits one level deeper (`primary:`, `cache:`, etc.).
@@ -106,7 +150,15 @@ module RepoIntrospection
   # rubocop:disable Style/ReturnNilInPredicateMethodDefinition -- ternary nil/true/false is load-bearing for the caller
   def self.direct_sqlite_database_config?(config)
     url = config["url"]
-    return sqlite_database_url?(url) if url.is_a?(String) && !url.strip.empty?
+    if url.is_a?(String) && !url.strip.empty?
+      if url.include?("__erb__")
+        return true if sqlite_database_url?(url)
+
+        return sqlite_adapter_in_hash?(config)
+      end
+
+      return sqlite_database_url?(url)
+    end
 
     return sqlite_adapter_in_hash?(config) if config["adapter"].is_a?(String)
 
@@ -128,6 +180,64 @@ module RepoIntrospection
     config.is_a?(Hash) && (config.key?("adapter") || config.key?("url"))
   end
 
+  def self.database_connection_configs(config)
+    return [config] unless direct_sqlite_database_config?(config).nil?
+
+    config.values.select { |value| database_connection_config?(value) }
+  end
+
+  def self.sqlite_database_path(config)
+    return if sqlite_in_memory_database_config?(config)
+
+    url = config["url"]
+    if url.is_a?(String) && !url.strip.empty?
+      return sqlite_database_path_from_url(url) if sqlite_database_url?(url)
+
+      return
+    end
+
+    database = config["database"]
+    database.strip if literal_database_path?(database)
+  end
+
+  def self.sqlite_database_path_from_url(url)
+    parser = URI::RFC2396_Parser.new
+    uri = parser.parse(url.strip)
+    encoded_path = uri.opaque ? uri.opaque.split("?", 2).first : uri.path
+    encoded_path = sqlite_file_uri_path(encoded_path, parser)
+    parser.unescape(encoded_path) if literal_database_path?(encoded_path)
+  rescue URI::InvalidURIError
+    nil
+  end
+
+  def self.sqlite_file_uri_path(path, parser)
+    return path unless path&.downcase&.start_with?("file:")
+
+    uri = parser.parse(path)
+    uri.opaque || uri.path
+  end
+
+  def self.sqlite_in_memory_database_config?(config)
+    value = config["url"] || config["database"]
+    return false unless value.is_a?(String)
+
+    identifier = value.strip.sub(/\Asqlite3?:/i, "")
+    encoded_path, query = identifier.split("?", 2)
+    path = URI::RFC2396_Parser.new.unescape(encoded_path)
+    path == ":memory:" || path == "file::memory:" || memory_mode_query?(query)
+  end
+
+  def self.memory_mode_query?(query)
+    query.to_s.split("&").any? do |pair|
+      key, value = pair.split("=", 2)
+      key.casecmp?("mode") && value&.casecmp?("memory")
+    end
+  end
+
+  def self.literal_database_path?(value)
+    value.is_a?(String) && !value.strip.empty? && !value.include?("__erb__")
+  end
+
   def self.safe_load_database_yml(raw_contents)
     # ERB conditionals can change YAML structure, so avoid guessing. Output-only
     # ERB is stubbed as a scalar so common Rails defaults like `pool: <%= ... %>`

data/lib/cpflow/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Cpflow
-  VERSION = "6.0.0.rc.0"
+  VERSION = "6.0.1"
   MIN_CPLN_VERSION = "3.1.0"
 end

data/lib/generator_templates/.dockerignore

@@ -0,0 +1,16 @@
+.git
+.github
+.env*
+!.env.example
+.bundle
+.ruby-lsp
+coverage
+log/*
+node_modules
+storage/*
+tmp/*
+vendor/bundle
+config/master.key
+config/credentials/*.key
+db/*.sqlite3
+db/*.sqlite3-*

data/lib/generator_templates/Dockerfile

@@ -38,9 +38,13 @@ RUN printf '%s\n' '#!/bin/sh' 'exec corepack yarn "$@"' > /usr/bin/yarn && \
 # install ruby gems
 COPY Gemfile* ./
 
-RUN bundle config set without 'development test' && \
+RUN apt-get update -qq && \
+    apt-get install --no-install-recommends -y build-essential && \
+    bundle config set without 'development test' && \
     bundle config set with 'production' && \
-    bundle install --jobs=3 --retry=3
+    bundle install --jobs=3 --retry=3 && \
+    apt-get purge -y --auto-remove build-essential && \
+    rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 COPY . ./
 
@@ -75,11 +79,11 @@ RUN if [ -f package.json ]; then \
 
 ENV RAILS_ENV=production
 
-# compiling assets requires any value for ENV of SECRET_KEY_BASE
-ENV SECRET_KEY_BASE=NOT_USED_NON_BLANK
+# Asset compilation requires a non-blank secret, but the placeholder must not
+# remain in the final image environment.
 
 __ASSET_PRECOMPILE_HOOK_RUN__
-RUN rails assets:precompile
+RUN SECRET_KEY_BASE=NOT_USED_NON_BLANK rails assets:precompile
 
 # add entrypoint
 COPY .controlplane/entrypoint.sh ./

data/lib/generator_templates/entrypoint.sh

@@ -2,6 +2,8 @@
 set -e
 # Runs before the main command
 
+__SQLITE_DATABASE_SETUP__
+
 is_rails_server_command() {
   if [ "${1:-}" = "env" ]; then
     shift

data/lib/generator_templates/templates/postgres.yml

@@ -19,6 +19,9 @@ spec:
 ---
 kind: secret
 name: "{{APP_NAME}}-pg"
+# Only newly created dynamically named review-app helpers acquire this marker.
+tags:
+  cpflow-disposable-postgres-app: "{{APP_NAME}}"
 description: ''
 type: dictionary
 data:
@@ -28,6 +31,9 @@ data:
 ---
 kind: secret
 name: "{{APP_NAME}}-pg-script"
+# Only newly created dynamically named review-app helpers acquire this marker.
+tags:
+  cpflow-disposable-postgres-app: "{{APP_NAME}}"
 type: opaque
 data:
   encoding: base64
@@ -98,6 +104,9 @@ description: "{{APP_NAME}}-pg-identity"
 ---
 kind: policy
 name: "{{APP_NAME}}-pg-access"
+# Only newly created dynamically named review-app helpers acquire this marker.
+tags:
+  cpflow-disposable-postgres-app: "{{APP_NAME}}"
 description: "{{APP_NAME}}-pg-access"
 bindings:
   - permissions:

data/lib/generator_templates_sqlite/controlplane.yml

@@ -1,7 +1,8 @@
 # Keys beginning with "cpln_" correspond to your settings in Control Plane.
 #
 # Generated baseline for a Rails app that uses SQLite in production. This setup
-# keeps `/app/db` and `/app/storage` on persistent volumes.
+# keeps SQLite data under `/app/data` and Active Storage under `/app/storage`
+# on persistent volumes without hiding migrations shipped in `/app/db`.
 
 allow_org_override_by_env: true
 allow_app_override_by_env: true

data/lib/generator_templates_sqlite/release_script.sh

@@ -12,7 +12,7 @@ error_exit() {
 
 log "Running release_script.sh per controlplane.yml"
 
-mkdir -p db storage
+mkdir -p data storage
 
 if [ -x ./bin/rails ]; then
   log "Run DB migrations"

data/lib/generator_templates_sqlite/templates/rails.yml

@@ -16,7 +16,8 @@ spec:
           # See https://www.shakacode.com/control-plane-flow/docs/thruster/ for details.
           protocol: http
       volumes:
-        - path: /app/db
+        # Keep migrations and schema from the image visible under /app/db.
+        - path: /app/data
           recoveryPolicy: retain
           uri: cpln://volumeset/app-db
         - path: /app/storage

data/lib/github_flow_templates/.github/cpflow-help.md

@@ -132,21 +132,30 @@ production org, using production-only secrets and values.
 
 ## Version Locking
 
-Generated wrappers pin Control Plane Flow with a release tag, for example
-`__CPFLOW_GITHUB_ACTIONS_REF__`. Reusable review-app, staging, cleanup, and
-helper workflows pin the tag in their `uses:` ref. Production promotion pins
-the same tag in the `Checkout control-plane-flow actions` step so the
+Freshly generated wrappers start with a Control Plane Flow release tag, for
+example `__CPFLOW_GITHUB_ACTIONS_REF__`. Before review and merge, use the pin
+helper below to replace that tag with its immutable commit SHA and retain the
+reviewed tag in a readable comment. Reusable review-app, staging, cleanup, and
+helper workflows then use that SHA. Production promotion uses the same SHA and
+tag in the `Checkout control-plane-flow actions` step so the
 caller-owned job can keep `environment: production` and receive production
 environment secrets directly.
 
 Leave `CPFLOW_VERSION` unset so the workflow builds cpflow from the same
-checked-out upstream source. If you set `CPFLOW_VERSION`, it must match the
-release tag your wrappers are pinned to: a `CPFLOW_VERSION=__CPFLOW_MINOR_SERIES__` runtime
-override goes with a wrapper pinned to `uses: ...@v__CPFLOW_MINOR_SERIES__` (substitute the
-release you pinned above).
+checked-out upstream source. `CPFLOW_VERSION` is supported only while the
+wrapper itself uses an actual release-tag ref; it must match that tag. Keep it
+unset after replacing the wrapper ref with an immutable SHA because the
+checked-out source already determines the runtime version.
 
-After updating the `cpflow` gem in this repo, update the generated wrappers in
-the same PR:
+If an existing `bin/test-cpflow-github-flow` differs from cpflow's generated
+validator, first preserve its downstream checks in executable
+`bin/test-cpflow-github-flow-custom`, then remove or rename the old generated
+validator before retrying the update.
+
+After updating the `cpflow` gem in this repo, refresh the generated
+validation helpers in the same PR. The default command
+preserves every top-level workflow, including its refs, triggers, permissions, and
+downstream customizations:
 
 ```sh
 cpflow update-github-actions
@@ -160,12 +169,30 @@ bundle exec cpflow update-github-actions
 bin/test-cpflow-github-flow bundle exec cpflow
 ```
 
+Replace workflow wrappers only after explicitly selecting and reviewing them:
+
+```sh
+cpflow update-github-actions --workflows FILE...
+```
+
+Reapply required downstream customizations after a selected replacement, then
+pin and validate the complete flow.
+
+For a reviewed release, resolve its tag to the exact commit SHA, then pin and
+validate that immutable source:
+
+```sh
+bin/pin-cpflow-github-ref --version vX.Y.Z <40-character-control-plane-flow-commit-sha>
+bin/test-cpflow-github-flow
+```
+
 Do not leave downstream apps pinned to a moving branch such as `main`. For a
 short-lived test of an unreleased upstream PR, pin to a full 40-character commit
-SHA and leave `CPFLOW_VERSION` unset:
+SHA, use the upstream source's current in-progress version tag as the readable
+`--version` label, and leave `CPFLOW_VERSION` unset:
 
 ```sh
-bin/pin-cpflow-github-ref <40-character-control-plane-flow-commit-sha>
+bin/pin-cpflow-github-ref --version vX.Y.Z <40-character-control-plane-flow-commit-sha>
 bin/test-cpflow-github-flow ruby /path/to/control-plane-flow/bin/cpflow
 ```
 

data/lib/github_flow_templates/.github/workflows/cpflow-deploy-review-app.yml

@@ -42,4 +42,5 @@ jobs:
     uses: shakacode/control-plane-flow/.github/workflows/cpflow-deploy-review-app.yml@__CPFLOW_GITHUB_ACTIONS_REF__
     secrets:
       CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
+      REVIEW_APP_DOCKER_BUILD_SECRETS: ${{ secrets.REVIEW_APP_DOCKER_BUILD_SECRETS }}
       DOCKER_BUILD_SSH_KEY: ${{ secrets.DOCKER_BUILD_SSH_KEY }}

data/lib/github_flow_templates/.github/workflows/cpflow-deploy-staging.yml

@@ -21,4 +21,5 @@ jobs:
       staging_app_branch_default: "__STAGING_BRANCH_DEFAULT__"
     secrets:
       CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
+      DOCKER_BUILD_SECRETS: ${{ secrets.DOCKER_BUILD_SECRETS }}
       DOCKER_BUILD_SSH_KEY: ${{ secrets.DOCKER_BUILD_SSH_KEY }}

data/lib/github_flow_templates/.github/workflows/cpflow-promote-staging-to-production.yml

@@ -46,18 +46,84 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  preview-promotion:
+    if: github.event.inputs.confirm_promotion == 'promote'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # No production Environment or production token: this finishes before approval.
+    outputs:
+      primary_workload: ${{ steps.preview.outputs.primary_workload }}
+      staging_image: ${{ steps.preview.outputs.staging_image }}
+      production_commit: ${{ steps.preview.outputs.production_commit }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Checkout control-plane-flow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: shakacode/control-plane-flow
+          ref: __CPFLOW_GITHUB_ACTIONS_REF__
+          path: .cpflow
+          persist-credentials: false
+
+      - name: Normalize staging org
+        id: staging-org
+        env:
+          STAGING_ORG: ${{ vars.CPLN_ORG_STAGING }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          org="${STAGING_ORG#"${STAGING_ORG%%[![:space:]]*}"}"
+          org="${org%"${org##*[![:space:]]}"}"
+          if ! [[ "$org" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ ]]; then
+            echo "::error::CPLN_ORG_STAGING must be a valid Control Plane org name."
+            exit 1
+          fi
+          echo "org=$org" >> "$GITHUB_OUTPUT"
+
+      - name: Setup staging environment
+        uses: ./.cpflow/.github/actions/cpflow-setup-environment
+        with:
+          token: ${{ secrets.CPLN_TOKEN_STAGING }}
+          org: ${{ steps.staging-org.outputs.org }}
+          working_directory: .cpflow
+          cpln_cli_version: ${{ vars.CPLN_CLI_VERSION }}
+          cpflow_version: ${{ vars.CPFLOW_VERSION }}
+          # The setup action validates CPFLOW_VERSION against this full workflow ref.
+          control_plane_flow_ref: shakacode/control-plane-flow/.github/workflows/cpflow-promote-staging-to-production.yml@__CPFLOW_GITHUB_ACTIONS_REF__
+
+      - name: Preview commits before production approval
+        id: preview
+        uses: ./.cpflow/.github/actions/cpflow-preview-promotion
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
+        with:
+          staging_app_name: ${{ vars.STAGING_APP_NAME }}
+          staging_org: ${{ steps.staging-org.outputs.org }}
+          primary_workload: ${{ vars.PRIMARY_WORKLOAD }}
+
   promote-to-production:
+    needs: preview-promotion
     if: github.event.inputs.confirm_promotion == 'promote'
     runs-on: ubuntu-latest
     # This normal caller-repo job declares the protected production Environment
     # directly, so GitHub exposes environment secrets in this job after the
     # environment gate. Do not move production promotion back behind a
     # cross-repo reusable workflow; environment secrets are not available there.
-    environment: production
+    # The URL gives the deployment a "View deployment" link on GitHub.
+    environment:
+      name: production
+      url: ${{ steps.health-check.outputs.endpoint }}
     timeout-minutes: 45
     outputs:
       staging_app_name: ${{ steps.release-context.outputs.staging_app_name }}
       production_app_name: ${{ steps.release-context.outputs.production_app_name }}
+      staging_commit: ${{ steps.copy-image.outputs.staging_commit }}
 
     steps:
       - name: Checkout repository
@@ -90,7 +156,7 @@ jobs:
           fi
 
       - name: Validate required secrets and variables
-        uses: ./.github/actions/cpflow-validate-config
+        uses: ./.cpflow/.github/actions/cpflow-validate-config
         # Pass secrets via env so the composite action checks indirect shell
         # variables instead of interpolating secret values into a run script.
         env:
@@ -171,7 +237,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Setup production environment
-        uses: ./.github/actions/cpflow-setup-environment
+        uses: ./.cpflow/.github/actions/cpflow-setup-environment
         with:
           token: ${{ secrets.CPLN_TOKEN_PRODUCTION }}
           org: ${{ steps.cpln-orgs.outputs.production }}
@@ -237,7 +303,7 @@ jobs:
 
       - name: Detect release phase support
         id: release-phase
-        uses: ./.github/actions/cpflow-detect-release-phase
+        uses: ./.cpflow/.github/actions/cpflow-detect-release-phase
         with:
           app_name: ${{ vars.PRODUCTION_APP_NAME }}
 
@@ -440,6 +506,33 @@ jobs:
 
           echo "image=${staging_image}" >> "$GITHUB_OUTPUT"
 
+      - name: Verify approved promotion snapshot
+        id: verify-preview
+        env:
+          PREVIEW_WORKLOAD: ${{ needs.preview-promotion.outputs.primary_workload }}
+          CURRENT_PRIMARY_WORKLOAD: ${{ steps.workloads.outputs.primary }}
+          PREVIEW_IMAGE: ${{ needs.preview-promotion.outputs.staging_image }}
+          PREVIEW_PRODUCTION_COMMIT: ${{ needs.preview-promotion.outputs.production_commit }}
+          CURRENT_STAGING_IMAGE: ${{ steps.staging-image.outputs.image }}
+          CURRENT_PRODUCTION_IMAGE: ${{ steps.capture-current.outputs.current_image }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -z "$PREVIEW_WORKLOAD" || "$PREVIEW_WORKLOAD" != "$CURRENT_PRIMARY_WORKLOAD" ]]; then
+            echo "::error::The production primary workload differs from the preview. Set PRIMARY_WORKLOAD as a repository variable shared by both jobs and rerun."
+            exit 1
+          fi
+          if [[ -z "$PREVIEW_IMAGE" || "$CURRENT_STAGING_IMAGE" != "$PREVIEW_IMAGE" ]]; then
+            echo "::error::Staging changed since the preview. Rerun promotion and review the new comparison."
+            exit 1
+          fi
+          production_tag="${CURRENT_PRODUCTION_IMAGE%%@*}"
+          production_commit="${production_tag##*_}"
+          if [[ -n "$PREVIEW_PRODUCTION_COMMIT" && "$production_commit" != "$PREVIEW_PRODUCTION_COMMIT" ]]; then
+            echo "::error::Live production does not match its recorded release. Reconcile the production release record, then rerun promotion."
+            exit 1
+          fi
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
@@ -476,22 +569,26 @@ jobs:
             exit 1
           fi
 
-          if ! CPLN_TOKEN="${CPLN_TOKEN_STAGING}" cpln image get "${staging_image}" --org "${CPLN_ORG_STAGING}" -o json >/dev/null; then
+          staging_image_without_digest="${staging_image%%@*}"
+          if ! CPLN_TOKEN="${CPLN_TOKEN_STAGING}" cpln image get "${staging_image_without_digest}" --org "${CPLN_ORG_STAGING}" -o json >/dev/null; then
             echo "::error::Staging image '${STAGING_IMAGE}' was not found in org '${CPLN_ORG_STAGING}'; aborting promotion."
             exit 1
           fi
 
           staging_tag=""
-          if [[ "${staging_image}" == *@* ]]; then
-            staging_tag="${staging_image##*@}"
-          elif [[ "${staging_image}" == *:* ]]; then
-            staging_tag="${staging_image##*:}"
+          if [[ "${staging_image_without_digest}" == *:* ]]; then
+            staging_tag="${staging_image_without_digest##*:}"
           fi
           staging_commit=""
           if [[ "${staging_tag}" == *_* ]]; then
             staging_commit="${staging_tag##*_}"
           else
-            echo "::warning::Staging image '${staging_image}' did not include a '_<commit>' suffix; production image tag will omit the commit suffix."
+            echo "::error::Staging image '${staging_image}' does not include the commit suffix required for a traceable production release."
+            exit 1
+          fi
+          if ! [[ "${staging_commit}" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::Staging image '${staging_image}' has an invalid commit suffix; expected a full lowercase Git commit SHA."
+            exit 1
           fi
 
           # The workflow-level concurrency group serializes this sequence so two
@@ -566,8 +663,10 @@ jobs:
           fi
 
           echo "image=${production_image}" >> "$GITHUB_OUTPUT"
+          echo "staging_commit=${staging_commit}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy image to production
+        id: deploy-production
         env:
           PRODUCTION_APP_NAME: ${{ vars.PRODUCTION_APP_NAME }}
           CPLN_ORG_PRODUCTION: ${{ steps.cpln-orgs.outputs.production }}
@@ -576,6 +675,16 @@ jobs:
         run: |
           set -euo pipefail
 
+          deployment_marker_dir="$(mktemp -d)"
+          export CPFLOW_DEPLOYMENT_STARTED_FILE="${deployment_marker_dir}/started"
+          record_deployment_state() {
+            if [[ -f "${CPFLOW_DEPLOYMENT_STARTED_FILE}" ]]; then
+              echo "deployment_started=true" >> "${GITHUB_OUTPUT}"
+            fi
+            rm -rf "${deployment_marker_dir}"
+          }
+          trap record_deployment_state EXIT
+
           deploy_args=(-a "${PRODUCTION_APP_NAME}")
           if [[ -n "${RELEASE_PHASE_FLAG}" ]]; then
             deploy_args+=("${RELEASE_PHASE_FLAG}")
@@ -589,7 +698,7 @@ jobs:
 
       - name: Wait for deployment health
         id: health-check
-        uses: ./.github/actions/cpflow-wait-for-health
+        uses: ./.cpflow/.github/actions/cpflow-wait-for-health
         with:
           workload_name: ${{ steps.workloads.outputs.primary }}
           app_name: ${{ vars.PRODUCTION_APP_NAME }}
@@ -599,7 +708,11 @@ jobs:
           accepted_statuses: ${{ env.HEALTH_CHECK_ACCEPTED_STATUSES }}
 
       - name: Roll back on failure
-        if: failure() && steps.capture-current.outcome == 'success'
+        if: >-
+          failure() &&
+          steps.deploy-production.outputs.deployment_started == 'true' &&
+          steps.capture-current.outputs.rollback_state != '' &&
+          steps.capture-current.outputs.rollback_state != '{}'
         env:
           ROLLBACK_STATE: ${{ steps.capture-current.outputs.rollback_state }}
           PRODUCTION_APP_NAME: ${{ vars.PRODUCTION_APP_NAME }}
@@ -661,7 +774,11 @@ jobs:
           fi
 
       - name: Wait for rollback readiness
-        if: failure() && steps.capture-current.outcome == 'success'
+        if: >-
+          failure() &&
+          steps.deploy-production.outputs.deployment_started == 'true' &&
+          steps.capture-current.outputs.rollback_state != '' &&
+          steps.capture-current.outputs.rollback_state != '{}'
         env:
           ROLLBACK_STATE: ${{ steps.capture-current.outputs.rollback_state }}
           PRODUCTION_APP_NAME: ${{ vars.PRODUCTION_APP_NAME }}
@@ -770,6 +887,7 @@ jobs:
           GITHUB_RUN_ID: ${{ github.run_id }}
           STAGING_APP_NAME: ${{ needs.promote-to-production.outputs.staging_app_name }}
           PRODUCTION_APP_NAME: ${{ needs.promote-to-production.outputs.production_app_name }}
+          STAGING_COMMIT: ${{ needs.promote-to-production.outputs.staging_commit }}
         shell: bash
         run: |
           set -euo pipefail
@@ -779,5 +897,6 @@ jobs:
           release_tag="production-${release_date}-${timestamp}-${GITHUB_RUN_ID}"
 
           gh release create "${release_tag}" \
+            --target "${STAGING_COMMIT}" \
             --title "Production Release ${release_date} ${timestamp}" \
             --notes "Promoted ${STAGING_APP_NAME} to ${PRODUCTION_APP_NAME} on ${release_date} at ${timestamp}."