Harden production promotion image copy and readiness

.github/workflows/cpflow-promote-staging-to-production.yml

@@ -317,10 +317,10 @@ jobs:
           echo "image=${staging_image}" >> "$GITHUB_OUTPUT"
 
       - name: Copy image from staging
+        id: copy-image
         env:
           # Pass the upstream token via env rather than `-t` so it doesn't appear in /proc/<pid>/cmdline.
           CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
-          CPLN_UPSTREAM_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
           PRODUCTION_APP_NAME: ${{ vars.PRODUCTION_APP_NAME }}
           CPLN_ORG_STAGING: ${{ vars.CPLN_ORG_STAGING }}
           CPLN_ORG_PRODUCTION: ${{ vars.CPLN_ORG_PRODUCTION }}
@@ -348,9 +348,38 @@ jobs:
             exit 1
           fi
 
+          staging_commit="${STAGING_IMAGE##*_}"
+          if [[ "${staging_commit}" == "${STAGING_IMAGE}" || -z "${staging_commit}" ]]; then
+            echo "::error::Staging image '${STAGING_IMAGE}' does not include the expected '_<commit>' suffix."
+            exit 1
+          fi
+
+          latest_number="$(
+            cpln image query --org "${CPLN_ORG_PRODUCTION}" --prop "name~${PRODUCTION_APP_NAME}:" -o json |
+              jq -r --arg prefix "${PRODUCTION_APP_NAME}:" \
+                '[.items[].name | select(startswith($prefix)) | (try capture("^[^:]+:(?<number>[0-9]+)") catch empty) | .number | tonumber] | max // 0'
+          )"
+          production_image="${PRODUCTION_APP_NAME}:$((latest_number + 1))_${staging_commit}"
+          source_image_ref="${CPLN_ORG_STAGING}.registry.cpln.io/${STAGING_IMAGE}"
+
+          docker_config_dir="$(mktemp -d)"
+          cleanup_copy_credentials() {
+            rm -rf "${docker_config_dir}"
+          }
+          trap cleanup_copy_credentials EXIT
+
+          export DOCKER_CONFIG="${docker_config_dir}"
+
           copy_status=1
           for attempt in $(seq 1 "${copy_image_attempts}"); do
-            if cpflow copy-image-from-upstream -a "${PRODUCTION_APP_NAME}" --org "${CPLN_ORG_PRODUCTION}" --image "${STAGING_IMAGE}"; then
+            if CPLN_TOKEN="${CPLN_TOKEN_STAGING}" cpln image docker-login --org "${CPLN_ORG_STAGING}" >/dev/null &&
+              docker manifest inspect "${source_image_ref}" >/dev/null &&
+              CPLN_TOKEN="${CPLN_TOKEN_STAGING}" \
+              cpln image copy "${STAGING_IMAGE}" \
+              --org "${CPLN_ORG_STAGING}" \
+              --to-profile default \
+              --to-org "${CPLN_ORG_PRODUCTION}" \
+              --to-name "${production_image}"; then
               copy_status=0
               break
             else
@@ -370,6 +399,8 @@ jobs:
             exit "${copy_status}"
           fi
 
+          echo "image=${production_image}" >> "$GITHUB_OUTPUT"
+
       - name: Deploy image to production
         env:
           PRODUCTION_APP_NAME: ${{ vars.PRODUCTION_APP_NAME }}
@@ -531,19 +562,23 @@ jobs:
           HEALTHY: ${{ steps.health-check.outputs.healthy }}
           PREVIOUS_IMAGE: ${{ steps.capture-current.outputs.current_image }}
           PREVIOUS_VERSION: ${{ steps.capture-current.outputs.current_version }}
+          COPIED_IMAGE: ${{ steps.copy-image.outputs.image }}
         shell: bash
         run: |
           {
             echo "## Promotion Summary"
             echo
             if [[ "${HEALTHY}" == "true" ]]; then
               echo "✅ Status: deployment successful"
+              deployed_image="${COPIED_IMAGE}"
             else
               echo "❌ Status: deployment failed"
+              deployed_image="${PREVIOUS_IMAGE}"
             fi
             echo
             echo "Previous image: \`${PREVIOUS_IMAGE}\`"
             echo "Previous version: ${PREVIOUS_VERSION}"
+            echo "Deployed image: \`${deployed_image}\`"
           } >> "$GITHUB_STEP_SUMMARY"
 
   create-github-release:

lib/github_flow_templates/.github/workflows/cpflow-promote-staging-to-production.yml

@@ -336,10 +336,10 @@ jobs:
           echo "image=${staging_image}" >> "$GITHUB_OUTPUT"
 
       - name: Copy image from staging
+        id: copy-image
         env:
           # Pass the upstream token via env rather than `-t` so it doesn't appear in /proc/<pid>/cmdline.
           CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
-          CPLN_UPSTREAM_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
           PRODUCTION_APP_NAME: ${{ vars.PRODUCTION_APP_NAME }}
           CPLN_ORG_STAGING: ${{ vars.CPLN_ORG_STAGING }}
           CPLN_ORG_PRODUCTION: ${{ vars.CPLN_ORG_PRODUCTION }}
@@ -367,9 +367,38 @@ jobs:
             exit 1
           fi
 
+          staging_commit="${STAGING_IMAGE##*_}"
+          if [[ "${staging_commit}" == "${STAGING_IMAGE}" || -z "${staging_commit}" ]]; then
+            echo "::error::Staging image '${STAGING_IMAGE}' does not include the expected '_<commit>' suffix."
+            exit 1
+          fi
+
+          latest_number="$(
+            cpln image query --org "${CPLN_ORG_PRODUCTION}" --prop "name~${PRODUCTION_APP_NAME}:" -o json |
+              jq -r --arg prefix "${PRODUCTION_APP_NAME}:" \
+                '[.items[].name | select(startswith($prefix)) | (try capture("^[^:]+:(?<number>[0-9]+)") catch empty) | .number | tonumber] | max // 0'
+          )"
+          production_image="${PRODUCTION_APP_NAME}:$((latest_number + 1))_${staging_commit}"
+          source_image_ref="${CPLN_ORG_STAGING}.registry.cpln.io/${STAGING_IMAGE}"
+
+          docker_config_dir="$(mktemp -d)"
+          cleanup_copy_credentials() {
+            rm -rf "${docker_config_dir}"
+          }
+          trap cleanup_copy_credentials EXIT
+
+          export DOCKER_CONFIG="${docker_config_dir}"
+
           copy_status=1
           for attempt in $(seq 1 "${copy_image_attempts}"); do
-            if cpflow copy-image-from-upstream -a "${PRODUCTION_APP_NAME}" --org "${CPLN_ORG_PRODUCTION}" --image "${STAGING_IMAGE}"; then
+            if CPLN_TOKEN="${CPLN_TOKEN_STAGING}" cpln image docker-login --org "${CPLN_ORG_STAGING}" >/dev/null &&
+              docker manifest inspect "${source_image_ref}" >/dev/null &&
+              CPLN_TOKEN="${CPLN_TOKEN_STAGING}" \
+              cpln image copy "${STAGING_IMAGE}" \
+              --org "${CPLN_ORG_STAGING}" \
+              --to-profile default \
+              --to-org "${CPLN_ORG_PRODUCTION}" \
+              --to-name "${production_image}"; then
               copy_status=0
               break
             else
@@ -389,6 +418,8 @@ jobs:
             exit "${copy_status}"
           fi
 
+          echo "image=${production_image}" >> "$GITHUB_OUTPUT"
+
       - name: Deploy image to production
         env:
           PRODUCTION_APP_NAME: ${{ vars.PRODUCTION_APP_NAME }}
@@ -553,21 +584,23 @@ jobs:
           HEALTHY: ${{ steps.health-check.outputs.healthy }}
           PREVIOUS_IMAGE: ${{ steps.capture-current.outputs.current_image }}
           PREVIOUS_VERSION: ${{ steps.capture-current.outputs.current_version }}
-          DEPLOYED_IMAGE: ${{ steps.staging-image.outputs.image }}
+          COPIED_IMAGE: ${{ steps.copy-image.outputs.image }}
         shell: bash
         run: |
           {
             echo "## Promotion Summary"
             echo
             if [[ "${HEALTHY}" == "true" ]]; then
               echo "✅ Status: deployment successful"
+              deployed_image="${COPIED_IMAGE}"
             else
               echo "❌ Status: deployment failed"
+              deployed_image="${PREVIOUS_IMAGE}"
             fi
             echo
             echo "Previous image: \`${PREVIOUS_IMAGE}\`"
             echo "Previous version: ${PREVIOUS_VERSION}"
-            echo "Deployed image: \`${DEPLOYED_IMAGE}\`"
+            echo "Deployed image: \`${deployed_image}\`"
           } >> "$GITHUB_STEP_SUMMARY"
 
   create-github-release:

spec/command/generate_github_actions_spec.rb

@@ -826,13 +826,32 @@ def shared_workflow_path(name)
       expect(contents).to include("COPY_IMAGE_RETRY_INTERVAL must be a non-negative integer")
       expect(contents).to include("copy_image_attempts=$((copy_image_retries + 1))")
       expect(contents).to include("Staging image '${STAGING_IMAGE}' was not found")
+      expect(contents).to include("id: copy-image")
+      expect(contents).to include('staging_commit="${STAGING_IMAGE##*_}"')
+      expect(contents).to include('production_image="${PRODUCTION_APP_NAME}:$((latest_number + 1))_${staging_commit}"')
+      expect(contents).to include('docker_config_dir="$(mktemp -d)"')
+      expect(contents).to include("cleanup_copy_credentials")
+      expect(contents).to include('export DOCKER_CONFIG="${docker_config_dir}"')
+      expect(contents).to include('CPLN_TOKEN="${CPLN_TOKEN_STAGING}" cpln image docker-login')
+      expect(contents).to include('docker manifest inspect "${source_image_ref}"')
       expect(contents).to include('for attempt in $(seq 1 "${copy_image_attempts}"); do')
+      expect(contents).to include('CPLN_TOKEN="${CPLN_TOKEN_STAGING}" \\')
+      expect(contents).to include('cpln image copy "${STAGING_IMAGE}"')
+      expect(contents).to include("--to-profile default")
+      expect(contents).to include("--to-name \"${production_image}\"")
+      expect(contents).to include('echo "image=${production_image}" >> "$GITHUB_OUTPUT"')
+      expect(contents).to include("COPIED_IMAGE: ${{ steps.copy-image.outputs.image }}")
+      expect(contents).to include('deployed_image="${COPIED_IMAGE}"')
+      expect(contents).to include('deployed_image="${PREVIOUS_IMAGE}"')
       expect(contents).to include("Image copy attempt ${attempt}/${copy_image_attempts} failed")
       expect(contents).to include("no attempts remain")
       expect(contents).to include("workload_name: ${{ steps.workloads.outputs.primary }}")
       expect(contents).not_to include("workload_name: ${{ env.PRIMARY_WORKLOAD || 'rails' }}")
-      expect(contents).to include('cpflow copy-image-from-upstream -a "${PRODUCTION_APP_NAME}" ' \
-                                  '--org "${CPLN_ORG_PRODUCTION}" --image "${STAGING_IMAGE}"')
+      expect(contents).not_to include("CPLN_UPSTREAM_TOKEN:")
+      expect(contents).not_to include('cpln profile create "${upstream_profile}"')
+      expect(contents).not_to include("--profile \"${upstream_profile}\"")
+      expect(contents).not_to include("cpflow copy-image-from-upstream")
+      expect(contents).not_to include("--cleanup")
     end
 
     it "detects release phase support from controlplane.yml instead of cpflow config text" do