Regenerate cpflow wrappers from merged upstream

justin808 · justin808 · commit 9e5a0dddc8dc · 2026-05-24T19:50:50.000-10:00
diff --git a/.controlplane/docs/testing-cpflow-github-actions.md b/.controlplane/docs/testing-cpflow-github-actions.md
@@ -36,8 +36,8 @@ and tag ship, repin wrappers to the release tag, such as `v5.0.1`.
 
 1. Open or reuse a same-repository PR.
 2. Comment exactly `+review-app-deploy`.
-3. Confirm the deploy job checks out the expected upstream
-   `control_plane_flow_ref`.
+3. Confirm the deploy job checks out the expected upstream Control Plane Flow
+   source selected by the generated wrapper's `uses:` ref.
 4. Confirm `Setup environment`, `Check if review app exists`,
    `Build Docker image`, and `Deploy to Control Plane` all pass.
 5. Open the review-app URL from the PR comment and verify it returns HTTP 200.
diff --git a/.controlplane/shakacode-team.md b/.controlplane/shakacode-team.md
@@ -66,10 +66,10 @@ only by the protected `production` Environment after approval.
 Advanced optional settings are documented upstream in the
 [`control-plane-flow` CI automation guide](https://github.com/shakacode/control-plane-flow/blob/main/docs/ci-automation.md).
 
-Current workflow wrappers are pinned to upstream `control-plane-flow` PR #318 at
-`19ca93eadcba81e7438f26ab55a0f2ca7ace82b0` for downstream testing. After 5.0.1
-ships, repin the wrappers to `v5.0.1`; do not treat the temporary SHA as the
-steady-state master configuration.
+Current workflow wrappers are pinned to merged upstream `control-plane-flow`
+commit `c0ca750c4838dacf6a1d81d52cb151301516cb77` for downstream testing. After
+5.0.1 ships, repin the wrappers to `v5.0.1`; do not treat the temporary SHA as
+the steady-state master configuration.
 
 If staging moves off `master`, update both `STAGING_APP_BRANCH` and the branch
 filter in `.github/workflows/cpflow-deploy-staging.yml`.
diff --git a/.github/cpflow-help.md b/.github/cpflow-help.md
@@ -2,7 +2,7 @@
 
 These commands are generated by [cpflow](https://github.com/shakacode/control-plane-flow).
 For full setup, version-pinning, and troubleshooting details, see the upstream
-[CI automation guide](https://github.com/shakacode/control-plane-flow/blob/main/docs/ci-automation.md).
+[CI automation guide](https://github.com/shakacode/control-plane-flow/blob/c0ca750c4838dacf6a1d81d52cb151301516cb77/docs/ci-automation.md).
 
 ## Pull Request Commands
 
@@ -55,14 +55,18 @@ the environment approval gate passes.
 
 ## Version Locking
 
-Current wrappers pin both the reusable workflow `uses:` ref and
-`control_plane_flow_ref` to `19ca93eadcba81e7438f26ab55a0f2ca7ace82b0` only for
-upstream PR testing. Do not leave production automation on this temporary SHA:
-after `cpflow` 5.0.1 ships, switch both refs to `v5.0.1`.
+Generated wrappers pin Control Plane Flow once with the reusable workflow
+`uses:` ref, for example `@c0ca750c4838dacf6a1d81d52cb151301516cb77`. For stable releases,
+this ref should be a release tag. The upstream reusable workflow automatically
+loads its matching shared actions from GitHub's workflow context, so downstream
+wrappers should not pass a duplicate Control Plane Flow ref input. If your
+generated wrappers still include a `with:` block whose only purpose is to repeat
+the same ref, regenerate them with a newer `cpflow`.
+
 Leave `CPFLOW_VERSION` unset so the workflow builds cpflow from the same
 checked-out upstream source. If you set `CPFLOW_VERSION`, it must match the
-release tag, for example `CPFLOW_VERSION=5.0.1` with
-`control_plane_flow_ref: v5.0.1`.
+release tag, for example `CPFLOW_VERSION=5.0.1` with a wrapper pinned to
+`uses: ...@v5.0.1`.
 
 Do not leave downstream apps pinned to a moving branch such as `main`. For a
 short-lived test of an unreleased upstream PR, pin to a full 40-character commit
diff --git a/.github/testing-github-actions.md b/.github/testing-github-actions.md
@@ -25,8 +25,9 @@ guide:
 4. For comment-triggered review-app commands, test a real `+review-app-deploy`
    after the trusted default-branch wrapper points at the code under test.
 5. When testing unreleased upstream `control-plane-flow` changes downstream, pin
-   both the reusable workflow `uses:` ref and `control_plane_flow_ref` to the
-   same upstream commit SHA.
+   the generated reusable workflow `uses:` refs to the same upstream commit SHA.
+   Newer upstream workflows load their matching shared actions automatically; do
+   not add a duplicate ref input to downstream wrappers.
 
 Avoid testing production automation against moving branch refs such as `main` or
 a feature branch. Use release tags for normal operation and full commit SHAs for
diff --git a/.github/workflows/cpflow-cleanup-stale-review-apps.yml b/.github/workflows/cpflow-cleanup-stale-review-apps.yml
@@ -10,10 +10,8 @@ permissions:
 
 jobs:
   cleanup:
-    # Cleanup targets qa-react-webpack-rails-tutorial-<PR>. Manually delete any
-    # legacy qa-react-webpack-rails-tutorial-pr-<PR> apps during migration.
-    uses: shakacode/control-plane-flow/.github/workflows/cpflow-cleanup-stale-review-apps.yml@19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
-    with:
-      control_plane_flow_ref: 19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
+    # Cleanup targets the current inferred review-app prefix. If you changed
+    # naming conventions, manually delete review apps under the old prefix.
+    uses: shakacode/control-plane-flow/.github/workflows/cpflow-cleanup-stale-review-apps.yml@c0ca750c4838dacf6a1d81d52cb151301516cb77
     secrets:
       CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
diff --git a/.github/workflows/cpflow-delete-review-app.yml b/.github/workflows/cpflow-delete-review-app.yml
@@ -19,15 +19,18 @@ permissions:
 
 jobs:
   delete-review-app:
+    # pull_request_target is intentional: fork PR-close events need access to
+    # staging secrets to delete review apps and update PR comments. The upstream
+    # reusable workflow checks out trusted base-branch action code, not fork code.
     if: |
       (github.event_name == 'issue_comment' &&
        github.event.issue.pull_request &&
        contains(fromJson('["+review-app-delete","+review-app-delete\n","+review-app-delete\r\n"]'), github.event.comment.body) &&
        contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
       (github.event_name == 'pull_request_target' && github.event.action == 'closed') ||
       github.event_name == 'workflow_dispatch'
-    uses: shakacode/control-plane-flow/.github/workflows/cpflow-delete-review-app.yml@19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
-    with:
-      control_plane_flow_ref: 19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
+    # This `if:` mirrors the upstream job guard to avoid a billable workflow_call
+    # when the event does not match. Keep both conditions in sync.
+    uses: shakacode/control-plane-flow/.github/workflows/cpflow-delete-review-app.yml@c0ca750c4838dacf6a1d81d52cb151301516cb77
     secrets:
       CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
diff --git a/.github/workflows/cpflow-deploy-review-app.yml b/.github/workflows/cpflow-deploy-review-app.yml
@@ -30,9 +30,7 @@ jobs:
        github.event.issue.pull_request &&
        contains(fromJson('["+review-app-deploy","+review-app-deploy\n","+review-app-deploy\r\n"]'), github.event.comment.body) &&
        contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))
-    uses: shakacode/control-plane-flow/.github/workflows/cpflow-deploy-review-app.yml@19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
-    with:
-      control_plane_flow_ref: 19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
+    uses: shakacode/control-plane-flow/.github/workflows/cpflow-deploy-review-app.yml@c0ca750c4838dacf6a1d81d52cb151301516cb77
     secrets:
       CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
       DOCKER_BUILD_SSH_KEY: ${{ secrets.DOCKER_BUILD_SSH_KEY }}
diff --git a/.github/workflows/cpflow-deploy-staging.yml b/.github/workflows/cpflow-deploy-staging.yml
@@ -8,18 +8,17 @@ on:
     # deploy branches unless `cpflow generate-github-actions --staging-branch BRANCH`
     # was used. If STAGING_APP_BRANCH is later changed in repository variables, keep
     # this list in sync so pushes to that branch actually trigger the workflow.
-    branches: ["main", "master"]
+    branches: ["master"]
   workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
   deploy-staging:
-    uses: shakacode/control-plane-flow/.github/workflows/cpflow-deploy-staging.yml@19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
+    uses: shakacode/control-plane-flow/.github/workflows/cpflow-deploy-staging.yml@c0ca750c4838dacf6a1d81d52cb151301516cb77
     with:
-      control_plane_flow_ref: 19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
-      staging_app_branch_default: ""
+      staging_app_branch_default: "master"
     secrets:
       CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
       DOCKER_BUILD_SSH_KEY: ${{ secrets.DOCKER_BUILD_SSH_KEY }}
diff --git a/.github/workflows/cpflow-help-command.yml b/.github/workflows/cpflow-help-command.yml
@@ -23,6 +23,4 @@ jobs:
        contains(fromJson('["+review-app-help","+review-app-help\n","+review-app-help\r\n"]'), github.event.comment.body) &&
        contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
       github.event_name == 'workflow_dispatch'
-    uses: shakacode/control-plane-flow/.github/workflows/cpflow-help-command.yml@19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
-    with:
-      control_plane_flow_ref: 19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
+    uses: shakacode/control-plane-flow/.github/workflows/cpflow-help-command.yml@c0ca750c4838dacf6a1d81d52cb151301516cb77
diff --git a/.github/workflows/cpflow-promote-staging-to-production.yml b/.github/workflows/cpflow-promote-staging-to-production.yml
@@ -16,11 +16,8 @@ permissions:
 jobs:
   promote-to-production:
     if: github.event.inputs.confirm_promotion == 'promote'
-    # Keep the @ref in `uses:` and `control_plane_flow_ref` below in sync: the
-    # first selects the reusable workflow, the second selects its shared actions.
-    uses: shakacode/control-plane-flow/.github/workflows/cpflow-promote-staging-to-production.yml@19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
+    uses: shakacode/control-plane-flow/.github/workflows/cpflow-promote-staging-to-production.yml@c0ca750c4838dacf6a1d81d52cb151301516cb77
     with:
-      control_plane_flow_ref: 19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
       # Keep CPLN_TOKEN_PRODUCTION as a secret on this protected GitHub
       # Environment. The caller passes the environment name, the upstream
       # reusable workflow runs its production job in that environment, and
diff --git a/.github/workflows/cpflow-review-app-help.yml b/.github/workflows/cpflow-review-app-help.yml
@@ -17,6 +17,4 @@ jobs:
     # This is intentionally unconditional: adding this wrapper opts the repo in
     # to PR-open help. Remove the wrapper or add a repo-specific `if:` guard if
     # review apps should not be advertised before Control Plane is configured.
-    uses: shakacode/control-plane-flow/.github/workflows/cpflow-review-app-help.yml@19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
-    with:
-      control_plane_flow_ref: 19ca93eadcba81e7438f26ab55a0f2ca7ace82b0
+    uses: shakacode/control-plane-flow/.github/workflows/cpflow-review-app-help.yml@c0ca750c4838dacf6a1d81d52cb151301516cb77
diff --git a/bin/pin-cpflow-github-ref b/bin/pin-cpflow-github-ref
@@ -8,6 +8,9 @@ USAGE = <<~USAGE
 
   Use a release tag for normal operation, e.g. v5.0.0.
   Use a full 40-character commit SHA for temporary unreleased upstream testing.
+  This only updates generated reusable-workflow `uses:` refs. The called
+  workflows load their own matching shared actions from that same workflow
+  commit automatically. Regenerate from the cpflow gem when templates changed.
   Use --allow-moving-ref only for short-lived local branch/ref experiments.
 USAGE
 
@@ -32,7 +35,7 @@ end
 ref = positional.first
 allow_moving_ref = options.include?("--allow-moving-ref")
 
-unless ref.match?(/\A[0-9A-Za-z._\/-]+\z/)
+unless ref.match?(%r{\A[0-9A-Za-z._/-]+\z})
   warn "Ref contains unsupported characters: #{ref.inspect}"
   exit 1
 end
@@ -44,7 +47,7 @@ unless ref.match?(FULL_COMMIT_SHA) || ref.match?(RELEASE_TAG) || allow_moving_re
 end
 
 root = Pathname.new(__dir__).join("..").expand_path
-workflow_paths = Dir[root.join(".github/workflows/cpflow-*.yml")].sort
+workflow_paths = Dir[root.join(".github/workflows/cpflow-*.yml")]
 
 if workflow_paths.empty?
   warn "No cpflow workflow wrappers found."
@@ -55,8 +58,7 @@ changed = []
 workflow_paths.each do |path|
   text = File.read(path)
   updated = text
-    .gsub(%r{(uses:\s+shakacode/control-plane-flow/\.github/workflows/[^@\s]+@)[^\s]+}, "\\1#{ref}")
-    .gsub(/(\bcontrol_plane_flow_ref:\s*)\S+/, "\\1#{ref}")
+            .gsub(%r{(uses:\s+shakacode/control-plane-flow/\.github/workflows/[^@\s]+@)[^\s]+}, "\\1#{ref}")
 
   next if updated == text
 
diff --git a/bin/test-cpflow-github-flow b/bin/test-cpflow-github-flow
@@ -10,10 +10,10 @@ if [[ $# -gt 0 ]]; then
 fi
 
 echo "==> cpflow github-flow-readiness"
-bin/conductor-exec "${cpflow_cmd[@]}" github-flow-readiness
+"${cpflow_cmd[@]}" github-flow-readiness
 
 echo "==> parse generated GitHub Actions YAML"
-bin/conductor-exec ruby <<'RUBY'
+ruby <<'RUBY'
 require "yaml"
 
 Dir[".github/actions/**/action.yml", ".github/workflows/*.yml"].sort.each do |path|
@@ -23,7 +23,7 @@ end
 RUBY
 
 echo "==> check composite action input descriptions"
-bin/conductor-exec ruby <<'RUBY'
+ruby <<'RUBY'
 require "yaml"
 
 bad = []
@@ -39,7 +39,7 @@ puts "no action metadata descriptions contain GitHub expressions"
 RUBY
 
 echo "==> check cpflow reusable workflow refs"
-bin/conductor-exec ruby <<'RUBY'
+ruby <<'RUBY'
 require "yaml"
 
 CONTROL_PLANE_FLOW_WORKFLOW = %r{\Ashakacode/control-plane-flow/\.github/workflows/[^@\s]+@([^\s]+)\z}
@@ -60,9 +60,11 @@ Dir[".github/workflows/cpflow-*.yml"].sort.each do |path|
       abort "#{path}:#{job_name} uses secrets: inherit; pass only the named secrets the upstream workflow needs"
     end
 
-    unless uses_match
-      abort "#{path}:#{job_name} has control_plane_flow_ref but no control-plane-flow reusable workflow" if input_ref
+    if input_ref
+      abort "#{path}:#{job_name} passes obsolete control_plane_flow_ref. Remove it; the upstream reusable workflow checks out its own source from GitHub's job.workflow_* context."
+    end
 
+    unless uses_match
       next
     end
 
@@ -80,12 +82,6 @@ Dir[".github/workflows/cpflow-*.yml"].sort.each do |path|
       end
     end
 
-    if input_ref
-      refs[input_ref] << "#{path}:#{job_name}"
-      abort "#{path}:#{job_name} mismatched cpflow refs: #{uses_ref}, #{input_ref}" if uses_ref != input_ref
-    elsif job.key?("secrets")
-      abort "#{path}:#{job_name} passes secrets but is missing control_plane_flow_ref for #{uses_ref}"
-    end
   end
 end
 
@@ -102,4 +98,7 @@ end
 RUBY
 
 echo "==> actionlint"
-actionlint -ignore "SC2129" .github/workflows/cpflow-*.yml
+actionlint \
+  -ignore "SC2129" \
+  -ignore 'property "workflow_(ref|sha|repository|file_path)" is not defined in object type' \
+  .github/workflows/cpflow-*.yml
