sloanops.admin/3031023-xyz-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use updated Cloudflare deployment token

Browse Source
This commit is contained in:
Kevin
2026-09-02 01:13:57 -04:00
parent 9042639dd4
commit 12063f53ab
3 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy.yml
+1 -1
View File
@@ -36,5 +36,5 @@ jobs:
- name: Deploy non-production Worker - name: Deploy non-production Worker
run: npx wrangler deploy --config "wrangler/${SITE_KEY}.jsonc" run: npx wrangler deploy --config "wrangler/${SITE_KEY}.jsonc"
env: env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_WORKER_PREVIEW_TOKEN }} CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
README.md
+3 -3
View File
@@ -35,9 +35,9 @@ routes, account IDs, or secrets.
The Gitea workflow deploys only a non-production Worker from the pilot branch: The Gitea workflow deploys only a non-production Worker from the pilot branch:
`3031023-xyz-www-preview` by default, or the manually selected `blog` site. `3031023-xyz-www-preview` by default, or the manually selected `blog` site.
It uses `CF_WORKER_PREVIEW_TOKEN` and `CF_ACCOUNT_ID`. The preview token is a It uses the existing `CF_API_TOKEN` and `CF_ACCOUNT_ID`. The token retains the
separate, account-scoped Workers deployment credential; it does not replace Pages permissions needed for the `main` rollback target and now also permits
the Pages token retained on `main` for rollback. the non-production Worker preview deployment.
Routine jobs do not configure DNS or custom domains. Routine jobs do not configure DNS or custom domains.
Production hostname attachment and the `www` redirect are manual, Production hostname attachment and the `www` redirect are manual,
docs/preview-deployment.md
+5 -5
View File
@@ -10,11 +10,11 @@ separate Worker names:
`workers.dev` is the only preview destination. Neither Wrangler configuration `workers.dev` is the only preview destination. Neither Wrangler configuration
contains a route, custom domain, zone ID, account ID, or token. Cloudflare contains a route, custom domain, zone ID, account ID, or token. Cloudflare
credentials remain Gitea repository secrets. The preview workflow uses credentials remain Gitea repository secrets. The preview workflow uses the
`CF_WORKER_PREVIEW_TOKEN`, scoped only to the Cloudflare account hosting this existing `CF_API_TOKEN`, which has Account Workers Scripts edit/write for this
pilot. Grant it the Cloudflare **Edit Cloudflare Workers** template (including pilot plus the retained Pages rollback permissions. It uses `CF_ACCOUNT_ID` as
Account Workers Scripts edit/write) and retain `CF_ACCOUNT_ID` as the account the account selector. Do not grant DNS edit permissions for routine preview
selector. Do not grant DNS edit permissions for routine preview deployment. deployment.
The primary Worker must pass its public preview test matrix before an operator The primary Worker must pass its public preview test matrix before an operator
records the exact Pages deployment/DNS state and requests production-cutover records the exact Pages deployment/DNS state and requests production-cutover