From 6565dedbc6fe86aa0ec3d0d3c13beb8b213c3867 Mon Sep 17 00:00:00 2001 From: Justin Gordon Date: Mon, 1 Jun 2026 15:57:16 -1000 Subject: [PATCH 1/3] Clarify production environment secret setup --- .controlplane/readme.md | 11 +++++++++++ .controlplane/shakacode-team.md | 9 +++++++++ .github/cpflow-help.md | 11 +++++++++++ 3 files changed, 31 insertions(+) diff --git a/.controlplane/readme.md b/.controlplane/readme.md index 735f133a..b2064472 100644 --- a/.controlplane/readme.md +++ b/.controlplane/readme.md @@ -89,6 +89,17 @@ self-review, and consider disabling administrator bypass. Do not store promotion wrapper does not use `secrets: inherit`; GitHub exposes the production token only after the environment approval gate passes. +If promotion fails with +`CPLN_TOKEN_PRODUCTION is not set. Add it as a secret on the 'production' GitHub Environment.`, +the token is missing from the environment scope. A repository or organization +secret with the same name is not enough for this workflow. Create or verify the +environment secret with: + +```sh +gh secret set CPLN_TOKEN_PRODUCTION --repo shakacode/react-webpack-rails-tutorial --env production +gh secret list --repo shakacode/react-webpack-rails-tutorial --env production +``` + The matching Control Plane resources are: | Resource | Name | diff --git a/.controlplane/shakacode-team.md b/.controlplane/shakacode-team.md index cd4926c6..35a5d768 100644 --- a/.controlplane/shakacode-team.md +++ b/.controlplane/shakacode-team.md @@ -59,6 +59,15 @@ passes `production_environment: production`; the upstream reusable workflow runs its production job in that environment, and GitHub injects the production token only after approval. +If promotion fails with +`CPLN_TOKEN_PRODUCTION is not set. Add it as a secret on the 'production' GitHub Environment.`, +the token is missing from the environment scope. Configure it with: + +```sh +gh secret set CPLN_TOKEN_PRODUCTION --repo shakacode/react-webpack-rails-tutorial --env production +gh secret list --repo shakacode/react-webpack-rails-tutorial --env production +``` + Generated caller workflows pass only the named secrets each upstream workflow needs. They do not use `secrets: inherit`; `CPLN_TOKEN_PRODUCTION` is supplied only by the protected `production` Environment after approval. diff --git a/.github/cpflow-help.md b/.github/cpflow-help.md index 77b20ee2..049c04c1 100644 --- a/.github/cpflow-help.md +++ b/.github/cpflow-help.md @@ -70,6 +70,17 @@ prevent self-review. The generated promotion wrapper passes only the staging token from repository secrets; GitHub injects `CPLN_TOKEN_PRODUCTION` only after the environment approval gate passes. +If promotion fails with +`CPLN_TOKEN_PRODUCTION is not set. Add it as a secret on the 'production' GitHub Environment.`, +the token is missing from the environment scope. A repository or organization +secret with the same name is not enough for this workflow. Create or verify the +environment secret with: + +```sh +gh secret set CPLN_TOKEN_PRODUCTION --repo shakacode/react-webpack-rails-tutorial --env production +gh secret list --repo shakacode/react-webpack-rails-tutorial --env production +``` + Before the first promotion, bootstrap the production app the same way in the production org, using production-only secrets and values. From f76c3a14f1e518f8e48a20ca631a3fba9cbcf4ba Mon Sep 17 00:00:00 2001 From: Justin Gordon Date: Mon, 1 Jun 2026 16:07:08 -1000 Subject: [PATCH 2/3] Keep production secret docs consistent --- .controlplane/shakacode-team.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.controlplane/shakacode-team.md b/.controlplane/shakacode-team.md index 35a5d768..d57a8afd 100644 --- a/.controlplane/shakacode-team.md +++ b/.controlplane/shakacode-team.md @@ -61,7 +61,8 @@ only after approval. If promotion fails with `CPLN_TOKEN_PRODUCTION is not set. Add it as a secret on the 'production' GitHub Environment.`, -the token is missing from the environment scope. Configure it with: +the token is missing from the environment scope. A repository or organization +secret with the same name is not enough for this workflow. Configure it with: ```sh gh secret set CPLN_TOKEN_PRODUCTION --repo shakacode/react-webpack-rails-tutorial --env production From b31af7b18468ff8a3baaa54a97e91a9d2df0f6b2 Mon Sep 17 00:00:00 2001 From: Justin Gordon Date: Mon, 1 Jun 2026 16:18:00 -1000 Subject: [PATCH 3/3] Address final production secret docs review --- .controlplane/readme.md | 2 ++ .controlplane/shakacode-team.md | 5 ++++- .github/cpflow-help.md | 2 ++ 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/.controlplane/readme.md b/.controlplane/readme.md index b2064472..b0518bd2 100644 --- a/.controlplane/readme.md +++ b/.controlplane/readme.md @@ -94,6 +94,8 @@ If promotion fails with the token is missing from the environment scope. A repository or organization secret with the same name is not enough for this workflow. Create or verify the environment secret with: +You need permission to manage repository environments and secrets to run these +commands. ```sh gh secret set CPLN_TOKEN_PRODUCTION --repo shakacode/react-webpack-rails-tutorial --env production diff --git a/.controlplane/shakacode-team.md b/.controlplane/shakacode-team.md index d57a8afd..01b828eb 100644 --- a/.controlplane/shakacode-team.md +++ b/.controlplane/shakacode-team.md @@ -62,7 +62,10 @@ only after approval. If promotion fails with `CPLN_TOKEN_PRODUCTION is not set. Add it as a secret on the 'production' GitHub Environment.`, the token is missing from the environment scope. A repository or organization -secret with the same name is not enough for this workflow. Configure it with: +secret with the same name is not enough for this workflow. Create or verify the +environment secret with: +You need permission to manage repository environments and secrets to run these +commands. ```sh gh secret set CPLN_TOKEN_PRODUCTION --repo shakacode/react-webpack-rails-tutorial --env production diff --git a/.github/cpflow-help.md b/.github/cpflow-help.md index 049c04c1..f4f9be88 100644 --- a/.github/cpflow-help.md +++ b/.github/cpflow-help.md @@ -75,6 +75,8 @@ If promotion fails with the token is missing from the environment scope. A repository or organization secret with the same name is not enough for this workflow. Create or verify the environment secret with: +You need permission to manage repository environments and secrets to run these +commands. ```sh gh secret set CPLN_TOKEN_PRODUCTION --repo shakacode/react-webpack-rails-tutorial --env production