From 12063f53abe696166410c38d6e77f5e2eac8ce4f Mon Sep 17 00:00:00 2001 From: Kevin Date: Wed, 2 Sep 2026 01:13:57 -0400 Subject: [PATCH] Use updated Cloudflare deployment token --- .gitea/workflows/deploy.yml | 2 +- README.md | 6 +++--- docs/preview-deployment.md | 10 +++++----- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 90310c2..1f95a98 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -36,5 +36,5 @@ jobs: - name: Deploy non-production Worker run: npx wrangler deploy --config "wrangler/${SITE_KEY}.jsonc" env: - CLOUDFLARE_API_TOKEN: ${{ secrets.CF_WORKER_PREVIEW_TOKEN }} + CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} diff --git a/README.md b/README.md index 333ebf1..3ed9c78 100644 --- a/README.md +++ b/README.md @@ -35,9 +35,9 @@ routes, account IDs, or secrets. The Gitea workflow deploys only a non-production Worker from the pilot branch: `3031023-xyz-www-preview` by default, or the manually selected `blog` site. -It uses `CF_WORKER_PREVIEW_TOKEN` and `CF_ACCOUNT_ID`. The preview token is a -separate, account-scoped Workers deployment credential; it does not replace -the Pages token retained on `main` for rollback. +It uses the existing `CF_API_TOKEN` and `CF_ACCOUNT_ID`. The token retains the +Pages permissions needed for the `main` rollback target and now also permits +the non-production Worker preview deployment. Routine jobs do not configure DNS or custom domains. Production hostname attachment and the `www` redirect are manual, diff --git a/docs/preview-deployment.md b/docs/preview-deployment.md index 7d17076..e9e9c06 100644 --- a/docs/preview-deployment.md +++ b/docs/preview-deployment.md @@ -10,11 +10,11 @@ separate Worker names: `workers.dev` is the only preview destination. Neither Wrangler configuration contains a route, custom domain, zone ID, account ID, or token. Cloudflare -credentials remain Gitea repository secrets. The preview workflow uses -`CF_WORKER_PREVIEW_TOKEN`, scoped only to the Cloudflare account hosting this -pilot. Grant it the Cloudflare **Edit Cloudflare Workers** template (including -Account Workers Scripts edit/write) and retain `CF_ACCOUNT_ID` as the account -selector. Do not grant DNS edit permissions for routine preview deployment. +credentials remain Gitea repository secrets. The preview workflow uses the +existing `CF_API_TOKEN`, which has Account Workers Scripts edit/write for this +pilot plus the retained Pages rollback permissions. It uses `CF_ACCOUNT_ID` as +the account selector. Do not grant DNS edit permissions for routine preview +deployment. The primary Worker must pass its public preview test matrix before an operator records the exact Pages deployment/DNS state and requests production-cutover