sloanops.admin/3031023-xyz-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use updated Cloudflare deployment token

Browse Source
This commit is contained in:
Kevin
2026-09-02 01:13:57 -04:00
parent 9042639dd4
commit 12063f53ab
3 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy.yml
+1 -1
View File
@@ -36,5 +36,5 @@ jobs:
- name: Deploy non-production Worker
run: npx wrangler deploy --config "wrangler/${SITE_KEY}.jsonc"
env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_WORKER_PREVIEW_TOKEN }}
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
README.md
+3 -3
View File
@@ -35,9 +35,9 @@ routes, account IDs, or secrets.
The Gitea workflow deploys only a non-production Worker from the pilot branch:
`3031023-xyz-www-preview` by default, or the manually selected `blog` site.
It uses `CF_WORKER_PREVIEW_TOKEN` and `CF_ACCOUNT_ID`. The preview token is a
separate, account-scoped Workers deployment credential; it does not replace
the Pages token retained on `main` for rollback.
It uses the existing `CF_API_TOKEN` and `CF_ACCOUNT_ID`. The token retains the
Pages permissions needed for the `main` rollback target and now also permits
the non-production Worker preview deployment.
Routine jobs do not configure DNS or custom domains.
Production hostname attachment and the `www` redirect are manual,
docs/preview-deployment.md
+5 -5
View File
@@ -10,11 +10,11 @@ separate Worker names:
`workers.dev` is the only preview destination. Neither Wrangler configuration
contains a route, custom domain, zone ID, account ID, or token. Cloudflare
credentials remain Gitea repository secrets. The preview workflow uses
`CF_WORKER_PREVIEW_TOKEN`, scoped only to the Cloudflare account hosting this
pilot. Grant it the Cloudflare **Edit Cloudflare Workers** template (including
Account Workers Scripts edit/write) and retain `CF_ACCOUNT_ID` as the account
selector. Do not grant DNS edit permissions for routine preview deployment.
credentials remain Gitea repository secrets. The preview workflow uses the
existing `CF_API_TOKEN`, which has Account Workers Scripts edit/write for this
pilot plus the retained Pages rollback permissions. It uses `CF_ACCOUNT_ID` as
the account selector. Do not grant DNS edit permissions for routine preview
deployment.
The primary Worker must pass its public preview test matrix before an operator
records the exact Pages deployment/DNS state and requests production-cutover