Document cpflow app bootstrap#748
Conversation
WalkthroughThis PR updates three deployment documentation files to document the required one-time bootstrap procedure using ChangesBootstrap procedure documentation
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🚀 Quick Review App CommandsWelcome! Here are the commands you can use in this PR:
|
Greptile SummaryThis PR adds first-time bootstrap documentation for the persistent staging and production Control Plane apps across three documentation files, clarifying that
Confidence Score: 4/5Documentation-only change; no executable code is modified. Safe to merge after the minor formatting fix in cpflow-help.md. All three files contain accurate, consistent bootstrap instructions. The only issue is a missing blank line in .github/cpflow-help.md — missing blank line between the existing 'Staging deploys use…' sentence and the new bootstrap paragraph. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[First deploy / promotion?] -->|Yes| B["cpflow setup-app -a APP\n--org ORG\n--skip-post-creation-hook"]
B --> C[Creates app identity\napp secret dictionary\napp secret policy\npolicy binding\ntemplate resources]
C --> D[Deploy or promote normally]
A -->|No — existing persistent app| E["cpflow apply-template\n(template updates only)"]
E --> F[Verify app identity\nhas 'reveal' permission\non app secret policy]
F --> D
Reviews (1): Last reviewed commit: "Document cpflow app bootstrap" | Re-trigger Greptile |
Code Review – PR #748: Document cpflow app bootstrapOverall: This is a clean, low-risk documentation PR. The content is accurate and fills a real gap (missing first-time bootstrap guidance). A few minor observations below. What's Good
Suggestions1. Production bootstrap note in The staging section in 2. Missing blank line in The sentence "Staging deploys use the same 3. Minor: idempotency of Operators new to VerdictReady to merge with the existing content as-is; the above are suggestions, not blockers. |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| Staging deploys use the same `CPLN_TOKEN_STAGING` secret plus `STAGING_APP_NAME`. | ||
| Before the first staging deploy, bootstrap the persistent staging app once: |
There was a problem hiding this comment.
| Staging deploys use the same `CPLN_TOKEN_STAGING` secret plus `STAGING_APP_NAME`. | |
| Before the first staging deploy, bootstrap the persistent staging app once: | |
| Staging deploys use the same `CPLN_TOKEN_STAGING` secret plus `STAGING_APP_NAME`. | |
| Before the first staging deploy, bootstrap the persistent staging app once: |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| @@ -39,6 +39,16 @@ Optional overrides exist for forks, clones, and unusual apps: | |||
| ## Staging And Production | |||
|
|
|||
There was a problem hiding this comment.
There's no blank line between the existing "Staging deploys use the same..." sentence and this new paragraph. Without one, the two sentences render as a single paragraph in Markdown. Adding a blank line makes the boundary between the context sentence and the action step clear.
| Staging deploys use the same `CPLN_TOKEN_STAGING` secret plus `STAGING_APP_NAME`. | |
| Before the first staging deploy, bootstrap the persistent staging app once: |
| | Production app | `react-webpack-rails-tutorial-production` | | ||
| | Production app secret dictionary | `react-webpack-rails-tutorial-production-secrets` | | ||
|
|
||
| Bootstrap production the same way before the first promotion, using the |
There was a problem hiding this comment.
The staging section above gives the full explicit command; this production note only says "the same way" without showing it. A reader who lands on the Production section directly (or who uses different org/app names) has to scroll up and mentally substitute values. Consider showing the production-specific command here, as shakacode-team.md already does:
| Bootstrap production the same way before the first promotion, using the | |
| Bootstrap production once before the first promotion: | |
| ```sh | |
| cpflow setup-app -a react-webpack-rails-tutorial-production --org shakacode-open-source-examples-production --skip-post-creation-hook |
Use the production org and production-only secret values.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.controlplane/readme.md (1)
99-100: ⚡ Quick winAdd the explicit production bootstrap command inline.
This note is correct, but adding the exact
cpflow setup-appcommand here (like staging) will make first-time setup less error-prone and easier to execute quickly.Suggested doc tweak
Bootstrap production the same way before the first promotion, using the production org and production-only secret values. + +```sh +cpflow setup-app -a react-webpack-rails-tutorial-production --org shakacode-open-source-examples-production --skip-post-creation-hook +```🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.controlplane/readme.md around lines 99 - 100, Add the explicit production bootstrap command inline after the sentence "Bootstrap production the same way before the first promotion, using the production org and production-only secret values." by inserting the exact cpflow setup-app invocation suggested in the review (use the cpflow setup-app command for react-webpack-rails-tutorial-production with the shakacode-open-source-examples-production org and the --skip-post-creation-hook flag) so readers have a copy-pasteable production bootstrap example.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.controlplane/readme.md:
- Around line 99-100: Add the explicit production bootstrap command inline after
the sentence "Bootstrap production the same way before the first promotion,
using the production org and production-only secret values." by inserting the
exact cpflow setup-app invocation suggested in the review (use the cpflow
setup-app command for react-webpack-rails-tutorial-production with the
shakacode-open-source-examples-production org and the --skip-post-creation-hook
flag) so readers have a copy-pasteable production bootstrap example.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: eb6bfa91-d10e-40d1-88b0-eb7dec990f1f
📒 Files selected for processing (3)
.controlplane/readme.md.controlplane/shakacode-team.md.github/cpflow-help.md
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3eb2fb8711
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Bootstrap the persistent staging app once before the first merge-to-master | ||
| deploy: | ||
|
|
||
| ```sh | ||
| cpflow setup-app -a react-webpack-rails-tutorial-staging --org shakacode-open-source-examples-staging --skip-post-creation-hook | ||
| ``` |
There was a problem hiding this comment.
apply-template for persistent app bootstrap
This new guidance tells operators to run cpflow setup-app for the persistent staging app, but the upstream command docs explicitly scope setup-app to temporary apps and direct persistent staging/production flows to cpflow apply-template. If someone follows this during first-time staging/production setup, they can run an unsupported path that creates/recreates full app resources instead of the documented persistent update flow, which risks unexpected infra changes in long-lived environments.
Useful? React with 👍 / 👎.
✅ Review App DeletedReview app for PR #748 is deleted |
1 participant
Summary
Verification
Note
Low Risk
Documentation-only changes with no application, workflow, or infrastructure code modifications.
Overview
Adds first-time bootstrap guidance for persistent Control Plane staging and production apps across
.controlplane/readme.md,.controlplane/shakacode-team.md, and.github/cpflow-help.md.Operators should run
cpflow setup-appwith--skip-post-creation-hookonce before the initial merge-to-master staging deploy or production promotion, so provisioning (identity, secret dictionary, policies, templates fromsetup_app_templates) happens without running DB setup before an image exists. Docs distinguish first bootstrap (setup-app) from later template changes (cpflow apply-templateplusrevealon the app secret policy). Production is called out to use the production org and production-only secrets.Reviewed by Cursor Bugbot for commit 3eb2fb8. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit