justin808 · Oct 10, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
diff --git a/.controlplane/docs/testing-cpflow-github-actions.md b/.controlplane/docs/testing-cpflow-github-actions.md
@@ -33,25 +33,41 @@ helper separately when validating workflow changes.
 
 ## Released Review-App Pair
 
-The deploy/delete callers and local CLI use cpflow **5.3.0**. Both callers pin
-`b1e5ff4a04adfccfd8b59996e8abdbb5defb3fd6` with a readable `v5.3.0`
+The deploy/delete callers and local CLI use cpflow **6.0.0**. Both callers pin
+`68b5d83152c02a70eb98ffdc7fd2072e28265fef` with a readable `v6.0.0`
 comment. Other generated callers intentionally remain on their existing
 **5.2.0** cohort; their migration is separate scope.
 
 The pair is inseparable: both need the generated authenticated redispatch
 input, exact run/job names, and matching permissions. A pin-only upgrade or a
 single divergent canary is rejected. The offline validator reads the installed
-5.3.0 gem's caller templates as its source of truth, without loading cpflow code.
+6.0.0 gem's caller templates as its source of truth, without loading cpflow code.
+
+From 6.0.0 the pair runs the composite actions checked in under
+`.github/actions/cpflow-*` instead of the copies in the upstream checkout. Keep
+those directories identical to the bundled gem's `.github/actions`; the contract
+check fails when they differ. The older cohort still loads its actions from its
+own pinned upstream source.
+
+The released 6.0.0 workflow checks this repository out at the triggering
+event's own revision before it runs these actions, and checks the pull
+request's application code out separately under `app/`. The actions therefore
+carry the caller workflow's trust, not the application code's. The repository
+variables `REVIEW_APP_PREFIX` and `CPLN_ORG_STAGING` must stay set: they take
+precedence over the prefix and org in the pull request's `controlplane.yml`. The deploy caller also maps the optional
+`REVIEW_APP_DOCKER_BUILD_SECRETS` secret, which this repo does not define. A
+pull request's Dockerfile can read it during the build, so only ever store
+review-grade values there.
 
 Leave `CPFLOW_VERSION` unset for these SHA-pinned callers: upstream builds the
 CLI from the same pinned source. The variable-based RubyGems override requires
 a release-tag ref and cannot be combined with a commit SHA.
 
 Do not run the all-wrapper pin helper or blindly regenerate over the customized
 validation script for this split migration. A future upgrade must update both
-callers, the local dependency/lockfile, validator release constants, and fixture
-tests together. Preserve the renderer assertions and separately review any
-changes to other caller cohorts.
+callers, the local dependency/lockfile, the checked-in local actions, validator
+release constants, and fixture tests together. Preserve the renderer assertions
+and separately review any changes to other caller cohorts.
 
 ## Review App Canary
 

diff --git a/.controlplane/readme.md b/.controlplane/readme.md
@@ -40,11 +40,15 @@ heads because Docker builds use repository secrets; if a forked change needs a
 review app, first move the reviewed change to a trusted branch in this
 repository.
 
-No review-app repository variables are required for the standard path. The
-workflow infers `qa-react-webpack-rails-tutorial` and
-`shakacode-open-source-examples-staging` from `.controlplane/controlplane.yml`,
-because that file has one app with `match_if_app_name_starts_with: true`.
-`PRIMARY_WORKLOAD` also stays unset because the public workload is `rails`.
+Review apps need two repository variables. Without them the workflow infers
+the prefix and org from the pull request's `.controlplane/controlplane.yml`:
+
+| Name | Value |
+| --- | --- |
+| `REVIEW_APP_PREFIX` | `qa-react-webpack-rails-tutorial` |
+| `CPLN_ORG_STAGING` | `shakacode-open-source-examples-staging` |
+
+`PRIMARY_WORKLOAD` stays unset because the public workload is `rails`.
 
 For staging auto-deploys, also set these repository variables:
 
@@ -156,11 +160,12 @@ production or long-lived staging secret dictionaries for review apps.
 
 ### Advanced Overrides
 
-Most repos should leave these unset. They exist so forks and clones can test
-against their own Control Plane org, prefix, workload, or toolchain:
+This repository sets `CPLN_ORG_STAGING` and
+`REVIEW_APP_PREFIX=qa-react-webpack-rails-tutorial`; keep both set so review
+apps never take their org or prefix from a pull request's
+`.controlplane/controlplane.yml`. Leave the rest unset unless a fork or clone
+needs its own workload or toolchain:
 
-- `CPLN_ORG_STAGING`
-- `REVIEW_APP_PREFIX`
 - `PRIMARY_WORKLOAD`
 - `REVIEW_APP_DEPLOYING_ICON_URL`
 - `CPLN_CLI_VERSION`
@@ -559,8 +564,8 @@ waits for Control Plane to report both `status.ready` and `status.readyLatest`
 before probing the public endpoint.
 
 The GitHub settings and Control Plane resources must match the app names in
-`.controlplane/controlplane.yml`. For the standard review-app path, leave
-`REVIEW_APP_PREFIX` unset and let the workflow infer
+`.controlplane/controlplane.yml`. Keep the repository variable
+`REVIEW_APP_PREFIX` set to
 `qa-react-webpack-rails-tutorial`; generated review apps are named
 `qa-react-webpack-rails-tutorial-<PR number>`.
 If you have older review apps from the previous
@@ -633,9 +638,11 @@ Keep the reusable-workflow mechanics in the upstream
 [`control-plane-flow` CI automation guide](https://github.com/shakacode/control-plane-flow/blob/v5.2.0/docs/ci-automation.md).
 This repo deliberately keeps two release cohorts:
 
-- The review-app deploy/delete callers pin cpflow `v5.3.0` at
-  `b1e5ff4a04adfccfd8b59996e8abdbb5defb3fd6`. The bundled `cpflow` gem and
-  lockfile use `5.3.0`.
+- The review-app deploy/delete callers pin cpflow `v6.0.0` at
+  `68b5d83152c02a70eb98ffdc7fd2072e28265fef`. The bundled `cpflow` gem and
+  lockfile use `6.0.0`. From 6.0.0 these workflows run the composite actions
+  checked in under `.github/actions/cpflow-*`, so those files must match the
+  bundled gem.
 - Staging, cleanup, help, and promotion retain `v5.2.0` at
   `1d1ec7f7af181c5c6cf07f512ce336dbdb367246`. Their migration is separate
   scope, not an automatic consequence of updating the local gem.

diff --git a/.controlplane/shakacode-team.md b/.controlplane/shakacode-team.md
@@ -13,10 +13,10 @@ Deployments are handled by Control Plane configuration in this repo and GitHub A
 
 ### Review Apps
 - Add a comment `+review-app-deploy` to any PR to deploy a review app
-- Leave `REVIEW_APP_PREFIX` unset for the standard path. The workflow infers
-  `qa-react-webpack-rails-tutorial` from `.controlplane/controlplane.yml`, so
-  generated review apps use names like
-  `qa-react-webpack-rails-tutorial-1234`.
+- Keep the repository variable `REVIEW_APP_PREFIX` set to
+  `qa-react-webpack-rails-tutorial`, so the prefix never comes from a pull
+  request's `.controlplane/controlplane.yml`. Generated review apps use names
+  like `qa-react-webpack-rails-tutorial-1234`.
 - New pushes to a PR redeploy only after the review app already exists.
 - Add `+review-app-delete` to delete a review app manually; closing the PR also
   deletes it automatically. Use `+review-app-help` for the command reference.
@@ -58,11 +58,12 @@ Required repository variables for staging deploys:
 - `STAGING_APP_NAME=react-webpack-rails-tutorial-staging`
 - `STAGING_APP_BRANCH=master`
 
-Review apps infer `CPLN_ORG_STAGING`, `REVIEW_APP_PREFIX`, and
-`PRIMARY_WORKLOAD` from `.controlplane/controlplane.yml` and workflow defaults,
-so those values do not need to be set just to test review apps. Set them only
-when testing a fork or clone against a different Control Plane org, review-app
-prefix, or public workload.
+Review apps also need `REVIEW_APP_PREFIX=qa-react-webpack-rails-tutorial` and
+the `CPLN_ORG_STAGING` value above. Both are set in this repository and must
+stay set: without them the workflow infers the prefix and org from the pull
+request's `.controlplane/controlplane.yml`. `PRIMARY_WORKLOAD` can stay unset.
+Change these values only when testing a fork or clone against a different
+Control Plane org, review-app prefix, or public workload.
 
 App secret dictionaries for review, staging, and production must include
 `SECRET_KEY_BASE`, `RENDERER_PASSWORD`, `ROLLING_DEPLOY_TOKEN`, and
@@ -141,8 +142,10 @@ filter in `.github/workflows/cpflow-deploy-staging.yml`.
 Keep upstream workflow and action references on reviewed, immutable full commit
 SHAs with readable release comments, not release tags, `main`, or feature
 branches. The review-app deploy/delete pair advances together on released
-**5.3.0**; other generated callers and promotion actions retain their reviewed
-**5.2.0** cohort until a separately scoped migration.
+**6.0.0**; other generated callers and promotion actions retain their reviewed
+**5.2.0** cohort until a separately scoped migration. From 6.0.0 the pair runs
+the composite actions checked in under `.github/actions/cpflow-*`; keep them
+identical to the bundled gem.
 
 Do not blanket-regenerate the automation or use the all-wrapper pin helper for
 this split migration. Preserve the customized validator and renderer assertions,