v5.3.0

Added

• Added an early diagnostic warning when a shared_secret_grants target still uses the generated Postgres password placeholder. setup-app and deploy-image now identify the affected grant and secret before release or deployment work without printing secret values. PR 441 by Justin Gordon. Fixes issue 421.
• Added CPFLOW_GVC_ID and CPFLOW_GVC_CREATED to the environment of one-off jobs started by cpflow run, exposing the app's immutable GVC identity so that a release script can tell which GVC incarnation it is running in. PR 433 by Justin Gordon. Fixes issue 432. Unlike the mutable CPLN_GVC_ALIAS, these values identify the GVC incarnation itself, so they change only when a GVC is deleted and recreated under the same name. CPFLOW_GVC_CREATED is an ISO 8601 UTC timestamp with millisecond precision and a Z suffix. Both variables are always set and are empty when the GVC cannot be read, so a consumer can fail closed; they are never omitted, because the runner inherits the original workload's environment and an omitted variable could otherwise expose a stale inherited value.
• Added bounded retry with exponential backoff to direct Control Plane API requests. PR 416 by Justin Gordon. Fixes issue 383. With the default request policy, GET requests retry transient network errors and retryable HTTP responses for up to three attempts; another attempt is approved only when the retry decision occurs before a 120-second deadline. Delta-seconds Retry-After values are honored up to a 10-second cap; HTTP-date values fall back to jittered backoff. Under that policy, explicit HTTP 429 responses are retried for every method. Best-effort sensitive requests disable all transient retries. Mutating requests are not retried after ambiguous transport failures once they may have reached the server. Net::HTTP's hidden resend of PUT and DELETE requests is disabled. A failed cpln profile token lookup now raises an actionable error instead of continuing with unusable output.

Changed

• Simplified generated review-app help comments to a three-command quick reference, moved setup behind expandable details, and clarified GitHub Actions secret and variable terminology. PR 410 by Justin Gordon.
• Updated reusable GitHub Actions setup to install Control Plane CLI 3.11.0 by default. PR 423 by Justin Gordon.

Fixed

• Fixed cpflow run runner observation so a missing replica no longer relies on the generic 1,001-poll retry loop or exits without the cron status. PR 435 by Justin Gordon. Replica observation now uses a monotonic deadline capped by the smaller of runner_job_timeout and 1,000 seconds, stops polling when that deadline is reached, fails immediately on terminal non-success, and preserves replica-found and success-before-replica behavior.
• Fixed review-app deploy and delete authorization failing while recording accepted intent comments. PR 449 by Justin Gordon. The authorization job now has the PR write permission GitHub requires to post bot-owned comments on pull requests. Follow-up to issue 442.
• Made successful review-app checks report when they skipped the Docker image build. PR 444 by Justin Gordon. Fixes issue 412. The reusable workflow now writes a prominent no-build summary and exposes image_built=false, while generated guidance explains that repositories needing Dockerfile validation should use a separate required build gate.
• Fixed cpflow run argument corruption and shell interpolation when command arguments contain spaces, quotes, dollar signs, backticks, or semicolons. PR 443 by Justin Gordon. Fixes issue 381. Separately supplied arguments are shell-escaped at the remote runner boundary, while one quoted command string remains an explicit opt-in to shell syntax; the local cpln workload exec invocation now uses process argv instead of a shell-built command string.
• Fixed generated review-app deploy and delete commands so only the newest accepted operation can mutate an app, even when GitHub replaces a pending concurrency run or authorization finishes out of order. PR 440 by Justin Gordon. Fixes issue 427. GitHub now verifies manual actors have current write, maintain, or admin repository permission both before and after queueing, rejects closed-PR deploys before recording, records accepted triggers as durable bot-owned intents, authenticates each intent against its originating Actions run and successful recording step, binds internal redispatches to the workflow-run ID returned by GitHub and its exact successful dispatch step, and fails closed on lookup or ledger inconsistencies. Edits or deletion of the original command, mixed-case command admission, manual dispatch, and GitHub's single replaceable pending concurrency slot can no longer make an older deploy override a newer delete (or the reverse). After upgrading, run cpflow update-github-actions so the generated deploy and delete caller workflows adopt the new run-name and reconcile_intent_run_id contract; a caller that only bumps the uses: ref is rejected during provenance reconciliation.
• Fixed direct Control Plane API retries so HTTP 429 responses retry every request method and honor Retry-After, while 5xx retries remain limited to idempotent methods. PR 439 by Justin Gordon. Fixes issue 417.
• Fixed the spec suite leaking dummy-test-* GVCs that exhausted the CI org's GVC quota and blocked later runs. PR 434 by Justin Gordon. Fixes issue 399. Apps are now registered for after(:suite) cleanup by the command runner before an app-creating command runs, so a command that fails after creating the GVC, or an example that fails before its own teardown, no longer leaves the app behind. A before(:suite) sweep additionally reclaims apps leaked by runs that were killed before cleanup could run. The sweep is confined to the suite's own org and to the anchored dummy-test-* fixture naming boundary, never touches an app younger than 12 hours or one belonging to the current run, keeps anything it cannot positively identify as stale, and reports rather than raises on failure. This change is limited to the spec suite; no gem behavior changes.
• Fixed review-app deletion leaving successful GitHub deployments active after the Control Plane app was removed. PR 430 by Justin Gordon.
• Fixed template refreshes for existing apps whose workload-list response omits readiness status by consulting each workload's detailed state before selecting a safe fallback image. PR 429 by Justin Gordon.
• Fixed reusable deployment health checks on BYOK locations by falling back from a disabled standard workload endpoint only after every location is settled, while preserving configured app_domain review-app links and using the verified location endpoint as the final URL fallback. PR 426 by Justin Gordon.
• Fixed template refresh recovery for unhealthy or partially deployed review apps by preserving each workload's configured app image independently, while limiting missing-image fallbacks to one unambiguous image from ready workloads. PR 425 by Justin Gordon.
• Fixed reusable review-app deployments so existing apps receive changes from configured setup_app_templates before the new image is deployed, without deleting the GVC, rerunning post-creation hooks, replacing deployed images before rollout gates pass, or modifying existing secret resources. PR 424 by Justin Gordon.
• Fixed cpflow deploy-image crashing when an internal-only workload has no public endpoint. Deployments now consult the existing deployment fallback and report when no public endpoint is available. PR 423 by Justin Gordon.
• Fixed generated review-app status links so reusable deployments prefer the deployed app domain instead of the raw Control Plane workload endpoint. PR 395 by Justin Gordon.