Repository navigation
Upgrade cpflow to 6.0.1 and drop vendored actions - #862
Conversation
cpflow 6.0.1 loads its composite actions from the pinned upstream ref again, so the review-app deploy and delete workflows no longer need the copies under .github/actions/cpflow-*. Move the gem and both callers to the v6.0.1 commit, delete the copies, and remove the contract check and specs that existed only to keep them in step. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Earlier review — findings are not automatically resolved. Latest local review: #862 (comment) Earlier local reviewLocal Adversarial ReviewReviewed revision: Outcome: No open findings; closed and optional findings are in history. Coverage: anthropic/claude: Supplied diff only; unchanged source and test execution are unavailable to this reviewer. Usage and attribution in the PR description. Review evidence and historyCommit: Finding details
Review coverage: Coverage excerpts may be incomplete or misidentified; inspect the original reports.
Unverified report excerpt · anthropic/claude: Repository criteria: supplied (AGENTS.md from 23cbd83927daf15e9258e3c249a6c801eff4c7be). - **Inspected:** the supplied diff only. - **Not inspected:** the checkout. It lies outside the directory the file tools are confined to, so every read was refused, and Git commands are unavailable. - **Tests run:** none. `bundle exec rspec`, `bundle exec rubocop` and `bin/check-cpflow-review-app-contract` were not executed, so there is no before/after evidence. - **Missing context:** - The upstream `control-plane-flow` source at `6aa575780f2d9175755881b79cbb3253adbc9c1f`: whether that SHA is the `v6.0.1` tag, and whether its reusable workflows load composite actions from upstream rather than from the caller repository. - The unchanged workflows for staging, cleanup, help and promotion, plus `dependabot.yml`, lint configs and any docs outside the diff that may still name `.github/actions/cpflow-*`. - The full `Gemfile.lock`: whether it has a `CHECKSUMS` section with a `cpflow` entry, and whether 6.0.1's dependency list matches the unchanged lines under `cpflow (6.0.1)`. - The installed 6.0.1 gem's `lib/github_flow_templates`, which the contract checker compares against. Execution metadata
Round 1 · 3abce9c · anthropic/claude · effort UNKNOWN · 4 findingsCoverageRepository criteria: supplied (AGENTS.md from 23cbd83).
Findings
Observations (not counted)
REVIEWED 3abce9c BY anthropic/claude EFFORT UNKNOWN FINDINGS 4 REVIEWED 3abce9c BY anthropic/claude EFFORT UNKNOWN FINDINGS 4 REVIEWED 3abce9c BY anthropic/claude EFFORT UNKNOWN FINDINGS 4 |
🚀 Quick Review App CommandsWelcome! Here are the commands you can use in this PR:
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Local Adversarial ReviewReviewed revision: Outcome: No open findings; closed and optional findings are in history. Coverage: anthropic/claude: Supplied diff only; unchanged source and test execution are unavailable to this reviewer. Usage and attribution in the PR description. Review evidence and historyCommit: Finding details
Review coverage: Coverage excerpts may be incomplete or misidentified; inspect the original reports.
Unverified report excerpt · anthropic/claude: - **Inspected:** the supplied diff only, in full: five docs, the nine deleted files under `.github/actions/cpflow-*`, both review-app caller workflows, `Gemfile`, `Gemfile.lock`, `bin/check-cpflow-review-app-contract`, and `spec/cpflow_review_app_contract_spec.rb`. - **Tests run:** none. I did not execute candidate code, and no before/after reproduction was supplied. - **Missing context:** - The checkout at the pinned commit was unreadable (file tools are confined to an empty working directory) and Git is unavailable. I could not read unchanged regions of the changed files or search the rest of the repository. - I could not inspect the cpflow 6.0.1 gem or the upstream workflows at `6aa575780f2d9175755881b79cbb3253adbc9c1f`. Whether that SHA is the `v6.0.1` tag, and whether 6.0.1 loads its composite actions from upstream, are both taken from the change's own docs, not observed. - I could not see the full `Gemfile.lock`, so I cannot tell whether it has a `CHECKSUMS` section or whether 6.0.1's dependency list differs outside the hunk shown. Execution metadata
Round 2 · 13a447c · anthropic/claude · effort UNKNOWN · 0 findingsRepository criteria: supplied (trusted Coverage
Prior rounds
Findingsno findings Observations (not classed, not counted):
REVIEWED 13a447c BY anthropic/claude EFFORT UNKNOWN FINDINGS 0 REVIEWED 13a447c BY anthropic/claude EFFORT UNKNOWN FINDINGS 0 |
|
No description provided. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe review-app deploy and delete workflows and local Changescpflow release and action migration
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Other Merge Risk: ⚪ Minimal · up to No actionable merge-blocking issue was established. Normal checks should still run before merge, including the contract check against the installed cpflow 6.0.1 gem. Pre-merge checks |
  |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (9 skipped: 9 … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (4 passed)
-
Check name Status Explanation Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely summarizes the two main changes: upgrading cpflow to 6.0.1 and removing vendored actions.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (9 skipped: 9 unsupported.)
- Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
-
-
-
📝 Generate docstrings 💡
-
-
-
-
- Commit to this branch
- Create a new PR
-
-
-
🧪 Generate unit tests (beta)
-
-
-
- Commit to this branch
- Create a new PR
-
-
-
-
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
|
No description provided. |
|
Reviewed: no blocking issues found.
Not verified: I didn't run |
🎉 Deploy Complete!Open Review AppDeployment successful for PR #862, commit 13a447c 🎮 Control Plane Console |
 |
|
No description provided. |
✅ Review App DeletedReview app for PR #862 is deleted |
justin808
left a comment
justin808
left a comment
There was a problem hiding this comment.
🤖 Claude Code · Anthropic · claude-opus-5-5 · medium
Code Walkthrough
Review-app deploys and deletes now run cpflow 6.0.1, whose actions come from the pinned upstream commit, so this repository stops carrying copies of them.
The pin moves as a pair
The gem pin, the deploy caller and the delete caller move from the v6.0.0 commit to the v6.0.1 commit, and the contract constants follow. Apart from the ref, both callers already equal the 6.0.1 templates.
The copies go away
Under 6.0.0 the reusable workflows ran actions checked in under .github/actions/cpflow-*. Under 6.0.1 they run the same actions from the upstream checkout at the pinned commit, as 5.3.0 did. The eight directories are deleted. So is the contract check that compared them with the gem, and the specs that exercised them; that behaviour is now upstream's to test. A baseline example still proves an unmodified fixture passes the contract check.
What was not changed
Staging, cleanup, help and production promotion keep their v5.2.0 pin; they never used the copies. The customized validator stays. The docs keep the rule that REVIEW_APP_PREFIX and CPLN_ORG_STAGING stay set.
Validation and rollback
A review app was deployed, smoked and deleted with this branch's workflows; the logs show all actions running from the upstream checkout. Reverting returns review apps to 6.0.0 with its copies.
| Gate | Result on 13a447c |
|---|---|
| test (22.x, 3.4.6): Rspec CI, JS CI, Lint CI | success |
| smoke / Demo fleet smoke | success |
| deploy / deploy (branch dispatch, run 38125208886) | success |
| delete-review-app (branch dispatch, run 38125842858) | success |
| claude-review | success |
| Greptile Review | success |
| CodeRabbit | success |
Walkthrough for commit 13a447cdcac42f1bbe06e496825b769bcedadc82. This is a COMMENT, not an approval.
|
🤖 Codex · OpenAI · gpt-6.1-sol (configured) · medium Post-implementation validationPR disposition (task owner): Merge The change removes the vendored actions the maintainer objected to, and a review app deployed, smoked and deleted on this head using upstream actions. Next action (task owner): The maintainer merges this head under Ask. Verification conclusion: Proceed This delivers the maintainer’s requested simplification while preserving demonstrated deployment and cleanup behavior. The resulting reduction in repository maintenance makes this approach worth choosing again. Head: Unresolved concerns: none Required checks, reviews, and merge authority still apply. Supporting analysis and execution detailsConclusion: Proceed The change removes unwanted generated copies and their synchronization burden. Reported deployment and deletion evidence supports preserving the review-app outcome. The two commits match the planned migration and baseline-spec repair: 21 files, 45 insertions, 1,479 deletions; other callers retain v5.2.0. Two review rounds show no recurring approach problem. Maintenance decreases without new dependencies or configuration. Quantified time savings and usage frequency are unknown. Alternative considered: Keeping v6.0.0 preserves local action inspection and equality checks but retains unwanted duplication. Immutable upstream pins, retained caller contracts, and the reported canary justify retiring those local guarantees. observed model: UNKNOWN; configured model: gpt-6.1-sol · recorded effort: medium Prompt: Shaka default. [
{
"configuration": [
"openai",
"gpt-6.1-sol",
"UNKNOWN",
"medium"
],
"usage": {
"input_tokens": 37556,
"cached_input_tokens": 12288,
"cache_write_input_tokens": 0,
"output_tokens": 79,
"reasoning_output_tokens": 0,
"total_tokens": 37635
}
},
{
"configuration": [
"openai",
"gpt-6.1-sol",
"UNKNOWN",
"medium"
],
"usage": {
"input_tokens": 40319,
"cached_input_tokens": 37376,
"cache_write_input_tokens": 0,
"output_tokens": 308,
"reasoning_output_tokens": 21,
"total_tokens": 40627
}
},
{
"configuration": [
"openai",
"gpt-6.1-sol",
"UNKNOWN",
"medium"
],
"usage": {
"input_tokens": 43301,
"cached_input_tokens": 40192,
"cache_write_input_tokens": 0,
"output_tokens": 266,
"reasoning_output_tokens": 0,
"total_tokens": 43567
}
}
]Ruby verified report shape and head binding. The reviewer judged value; the task owner handles concerns and merge readiness. This does not attest to technical review. |
justin808
added
the
awaiting-merge-approval
|
Squash commit message for |
|
No description provided. |
✅ Review App DeletedReview app for PR #862 is deleted |
justin808
removed
the
awaiting-merge-approval
🤖 Claude Code · Anthropic · claude-opus-5-5 · medium
This repository no longer carries copies of cpflow's composite actions. cpflow 6.0.1 loads them from the pinned upstream commit again, which resolves shakacode/control-plane-flow#510. The gem and the review-app deploy and delete workflows move to the v6.0.1 commit. The eight action directories added for 6.0.0 are deleted, along with the check and specs that kept them in step. Net change: about 1,480 lines removed. Merged as
a749064; master CI, the staging deploy and a comment-triggered review-app deploy and delete passed afterwards.PR prepared with Shaka.
Code Walkthrough · Post-implementation verification
Known gaps
The review app for this PR was deleted after its smoke passed, so there is no live preview. It was deployed and deleted by dispatching this branch's workflows; comment commands run the default-branch workflows, so they run 6.0.1 only after merge. Staging, cleanup, help and production promotion stay on their v5.2.0 pin. This PR deletes about 1,480 lines, above the 999-line merge limit; about 1,260 are the generated action files.
Execution provenance
d270475Provenance history
13a447c59aab3e13a447cd270475Usage and cost · $8.38 estimated
Understand the columns and accounting rules.
How each report was measured and priced
claude‑opus‑5‑5 implementation
Rate card: installed Shaka.
Anthropic API list prices, verified 2026-09-23.
Sources: Anthropic pricing.
Local adversarial reviewer usage: UNKNOWN. External reviewer/tool-model usage: UNKNOWN.
Native usage is PARTIAL. Scope: responses at or after 2026-10-11T08:15:00Z (whole-second sources include the cutoff second).
claude‑opus‑5‑5 review
Rate card: installed Shaka.
Claude CLI recorded estimated USD for an independent call; not an invoice.
Local adversarial reviewer usage: included below. External reviewer/tool-model usage: UNKNOWN.
Native usage is PARTIAL. Scope: all turns in selected sources.
Rate card: installed Shaka.
Anthropic API list prices, verified 2026-09-23.
Sources: Anthropic pricing.
Local adversarial reviewer usage: UNKNOWN. External reviewer/tool-model usage: UNKNOWN.
Native usage is PARTIAL. 22 responses. Scope: responses at or after 2026-10-11T08:15:00Z (whole-second sources include the cutoff second).
Shaka settings used
UNKNOWN: rerun missing evidence.
Local files remain local. This reports operation settings and cannot restore them. It does not prove earlier checks ran. Private merge.preference grants no Auto authority. Private trials default to Ask; explicit user authorization and live required gates govern merging.
Summary by CodeRabbit
Updates
Documentation