Clarify production environment secret setup#753
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
WalkthroughThis PR adds consistent troubleshooting documentation across three files describing a common production promotion failure: when ChangesProduction promotion troubleshooting guidance
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code ReviewOverview: Documentation-only PR that adds troubleshooting steps for the What it does well:
Issues found: Minor inconsistency across the three files
That sentence is the most important clarification — it's the likely source of confusion. Omitting it from the team notes file leaves that audience without the explicit warning. Suggestion: Add that sentence to Security note: The Overall: Low-risk, high-value docs change. Approved pending the consistency fix above. |
Greptile SummaryThis PR adds identical troubleshooting blocks to three documentation files, clarifying that
Confidence Score: 4/5Documentation-only change; no executable code is modified and the remediation commands are correct for the described failure scenario. All three files describe the same workflow correctly, but
Important Files Changed
Sequence DiagramsequenceDiagram
participant Dev as Developer
participant GH as GitHub Actions
participant Env as production Environment
participant CP as Control Plane
Dev->>GH: Push / trigger promotion workflow
GH->>Env: Request approval gate
Env-->>GH: Approved → inject CPLN_TOKEN_PRODUCTION
GH->>CP: Deploy using CPLN_TOKEN_PRODUCTION
CP-->>GH: Deployment success
Note over Dev,Env: If CPLN_TOKEN_PRODUCTION missing from Env scope:
Dev->>GH: gh secret set CPLN_TOKEN_PRODUCTION --env production
GH->>Env: Secret stored in environment scope
Dev->>GH: gh secret list --env production (verify)
Reviews (1): Last reviewed commit: "Clarify production environment secret se..." | Re-trigger Greptile |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| If promotion fails with | ||
| `CPLN_TOKEN_PRODUCTION is not set. Add it as a secret on the 'production' GitHub Environment.`, | ||
| the token is missing from the environment scope. Configure it with: | ||
|
|
There was a problem hiding this comment.
The other two files (.controlplane/readme.md and .github/cpflow-help.md) include the sentence:
A repository or organization secret with the same name is not enough for this workflow.
This is the key clarification that prevents confusion. It's missing here, leaving team members without the explicit warning.
| the token is missing from the environment scope. A repository or organization | |
| secret with the same name is not enough for this workflow. Configure it with: |
There was a problem hiding this comment.
Fixed in f76c3a1 by adding the missing repository/organization-secret warning to .controlplane/shakacode-team.md.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
|
||
| If promotion fails with | ||
| `CPLN_TOKEN_PRODUCTION is not set. Add it as a secret on the 'production' GitHub Environment.`, | ||
| the token is missing from the environment scope. Configure it with: |
There was a problem hiding this comment.
.controlplane/readme.md and .github/cpflow-help.md) include the sentence "A repository or organization secret with the same name is not enough for this workflow." This context is the key reason someone reaches for the gh secret set --env flag rather than the repository-level secret page, and its absence here leaves a gap for readers of this file.
| the token is missing from the environment scope. Configure it with: | |
| the token is missing from the environment scope. A repository or organization | |
| secret with the same name is not enough for this workflow. Configure it with: |
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
There was a problem hiding this comment.
Fixed in f76c3a1 by adding the missing repository/organization-secret warning to .controlplane/shakacode-team.md.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
🚀 Quick Review App CommandsWelcome! Here are the commands you can use in this PR:
|
Code Review: PR #753 — Clarify production environment secret setupOverall: LGTM. Documentation-only, low risk. The additions are clear, actionable, and placed in the right locations for discoverability. What the PR doesAdds a consistent troubleshooting section to three docs ( SuggestionsMinor — wording inconsistency across files Minor — missing permission note Minor — No concerns on
|
| If promotion fails with | ||
| `CPLN_TOKEN_PRODUCTION is not set. Add it as a secret on the 'production' GitHub Environment.`, | ||
| the token is missing from the environment scope. A repository or organization | ||
| secret with the same name is not enough for this workflow. Configure it with: |
There was a problem hiding this comment.
Minor wording inconsistency: the other two files (readme.md, cpflow-help.md) use "Create or verify the environment secret with:" at this point. Consider aligning for consistency:
| secret with the same name is not enough for this workflow. Configure it with: | |
| secret with the same name is not enough for this workflow. Create or verify the | |
| environment secret with: |
There was a problem hiding this comment.
Fixed in b31af7b by aligning the wording with the other two files and adding the permission note across all three docs.
| secret with the same name is not enough for this workflow. Create or verify the | ||
| environment secret with: | ||
| You need permission to manage repository environments and secrets to run these | ||
| commands. |
There was a problem hiding this comment.
The permission note was inserted between the colon-ending sentence and its code block, breaking the prose flow. A sentence ending with : implies the code block immediately follows — a reader following the colon lands on a second sentence instead.
Consider either folding the caveat into the lead-in line or placing it after the block:
| secret with the same name is not enough for this workflow. Create or verify the | |
| environment secret with: | |
| You need permission to manage repository environments and secrets to run these | |
| commands. | |
| secret with the same name is not enough for this workflow. Create or verify the | |
| environment secret with the `gh` CLI (requires permission to manage repository environments and secrets): |
| secret with the same name is not enough for this workflow. Create or verify the | ||
| environment secret with: | ||
| You need permission to manage repository environments and secrets to run these | ||
| commands. |
There was a problem hiding this comment.
Same prose-flow issue as in readme.md — the permission note lands between the colon and its code block.
| secret with the same name is not enough for this workflow. Create or verify the | |
| environment secret with: | |
| You need permission to manage repository environments and secrets to run these | |
| commands. | |
| secret with the same name is not enough for this workflow. Create or verify the | |
| environment secret with the `gh` CLI (requires permission to manage repository environments and secrets): |
| secret with the same name is not enough for this workflow. Create or verify the | ||
| environment secret with: | ||
| You need permission to manage repository environments and secrets to run these | ||
| commands. |
There was a problem hiding this comment.
Same prose-flow issue — permission note interrupts the colon→code-block expectation.
| secret with the same name is not enough for this workflow. Create or verify the | |
| environment secret with: | |
| You need permission to manage repository environments and secrets to run these | |
| commands. | |
| secret with the same name is not enough for this workflow. Create or verify the | |
| environment secret with the `gh` CLI (requires permission to manage repository environments and secrets): |
| commands. | ||
|
|
||
| ```sh | ||
| gh secret set CPLN_TOKEN_PRODUCTION --repo shakacode/react-webpack-rails-tutorial --env production |
There was a problem hiding this comment.
gh secret set without --body or piped input will prompt interactively for the secret value, which is the right behaviour — but worth noting for readers who aren't familiar with the CLI, otherwise the command looks incomplete. A short comment like # (prompts for the token value) or a preceding sentence would help.
| gh secret set CPLN_TOKEN_PRODUCTION --repo shakacode/react-webpack-rails-tutorial --env production | |
| gh secret set CPLN_TOKEN_PRODUCTION --repo shakacode/react-webpack-rails-tutorial --env production # prompts for the token value | |
| gh secret list --repo shakacode/react-webpack-rails-tutorial --env production |
Review: Clarify production environment secret setupOverall: Documentation-only change. The troubleshooting block is valuable and the core content is accurate. One structural prose issue appears in all three files (introduced in the final commit), plus a minor UX nit on the IssuesProse flow broken in all three files (must-fix) The third commit inserted the permission note directly after a sentence ending with a colon, without a blank line separating it from the code block the colon was pointing to: A sentence ending in
Running Positives
|
✅ Review App DeletedReview app for PR #753 is deleted |
1 participant
Summary
CPLN_TOKEN_PRODUCTION is not setproduction promotion failure.productionGitHub Environment, not as a repository or organization secret.gh secret set/list --env productioncommands in the generated help, team notes, and Control Plane docs.Related upstream generator/docs PR: shakacode/control-plane-flow#351
Verification
git diff --check -- .github/cpflow-help.md .controlplane/shakacode-team.md .controlplane/readme.md/Users/justin/.agents/skills/autoreview/scripts/autoreview --mode local(clean, no actionable findings)Note
Low Risk
Documentation-only changes with no runtime, CI, or secret-handling code changes.
Overview
Adds matching production promotion troubleshooting to
.controlplane/readme.md,.controlplane/shakacode-team.md, and.github/cpflow-help.md.When promotion fails with
CPLN_TOKEN_PRODUCTION is not set. Add it as a secret on the 'production' GitHub Environment., the docs now explain that the token must be on the protectedproductionGitHub Environment, not a repo/org secret, and givegh secret set/gh secret listwith--env production, plus a note that environment-management permissions are required.Reviewed by Cursor Bugbot for commit b31af7b. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit