From eb56ca4d3859c98bc90b0895ba5743782c72e144 Mon Sep 17 00:00:00 2001 From: Kevin Date: Wed, 9 Sep 2026 21:04:39 -0400 Subject: [PATCH 1/2] Use permanent Cloudflare CI credentials --- .gitea/workflows/deploy-blog.yml | 6 +++--- .gitea/workflows/deploy.yml | 6 +++--- .gitea/workflows/production-blog.yml | 6 +++--- .gitea/workflows/production-candidate.yml | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.gitea/workflows/deploy-blog.yml b/.gitea/workflows/deploy-blog.yml index 497d39a..9eb3966 100644 --- a/.gitea/workflows/deploy-blog.yml +++ b/.gitea/workflows/deploy-blog.yml @@ -43,7 +43,7 @@ jobs: run: npm run verify:build - name: Verify SloanOps account target env: - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb" - name: Upload non-production preview version run: | @@ -52,5 +52,5 @@ jobs: preview_alias="${preview_alias:-preview}" npx wrangler versions upload --config wrangler/blog.production.jsonc --preview-alias "$preview_alias" env: - CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }} - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} + CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 1b8cb17..e4679d9 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -43,7 +43,7 @@ jobs: run: npm run verify:build - name: Verify SloanOps account target env: - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb" - name: Upload non-production preview version run: | @@ -52,5 +52,5 @@ jobs: preview_alias="${preview_alias:-preview}" npx wrangler versions upload --config wrangler/www.production.jsonc --preview-alias "$preview_alias" env: - CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }} - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} + CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} diff --git a/.gitea/workflows/production-blog.yml b/.gitea/workflows/production-blog.yml index 7c23d8d..5151e51 100644 --- a/.gitea/workflows/production-blog.yml +++ b/.gitea/workflows/production-blog.yml @@ -44,10 +44,10 @@ jobs: run: npm run verify:build - name: Verify SloanOps account target env: - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb" - name: Deploy Worker without custom domains or routes run: npx wrangler deploy --config wrangler/blog.production.jsonc env: - CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }} - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} + CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} diff --git a/.gitea/workflows/production-candidate.yml b/.gitea/workflows/production-candidate.yml index 7eddb63..eece44d 100644 --- a/.gitea/workflows/production-candidate.yml +++ b/.gitea/workflows/production-candidate.yml @@ -44,10 +44,10 @@ jobs: run: npm run verify:build - name: Verify SloanOps account target env: - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb" - name: Deploy Worker without custom domains or routes run: npx wrangler deploy --config wrangler/www.production.jsonc env: - CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }} - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} + CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} From 56ae3da86780ef1081bf83339ad4f2bbe0dc829c Mon Sep 17 00:00:00 2001 From: Kevin Date: Wed, 9 Sep 2026 21:10:02 -0400 Subject: [PATCH 2/2] Bound Cloudflare preview aliases --- .gitea/workflows/deploy-blog.yml | 5 +++-- .gitea/workflows/deploy.yml | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/deploy-blog.yml b/.gitea/workflows/deploy-blog.yml index 9eb3966..c5d0025 100644 --- a/.gitea/workflows/deploy-blog.yml +++ b/.gitea/workflows/deploy-blog.yml @@ -48,8 +48,9 @@ jobs: - name: Upload non-production preview version run: | raw_ref="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-preview}}" - preview_alias="$(printf '%s' "$raw_ref" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9-]+/-/g; s/^-+//; s/-+$//' | cut -c1-40)" - preview_alias="${preview_alias:-preview}" + preview_slug="$(printf '%s' "$raw_ref" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9-]+/-/g; s/^-+//; s/-+$//')" + preview_hash="$(printf '%s' "$raw_ref" | sha256sum | cut -c1-8)" + preview_alias="$(printf '%s' "${preview_slug:-preview}" | cut -c1-20)-$preview_hash" npx wrangler versions upload --config wrangler/blog.production.jsonc --preview-alias "$preview_alias" env: CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index e4679d9..1b07aac 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -48,8 +48,9 @@ jobs: - name: Upload non-production preview version run: | raw_ref="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-preview}}" - preview_alias="$(printf '%s' "$raw_ref" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9-]+/-/g; s/^-+//; s/-+$//' | cut -c1-40)" - preview_alias="${preview_alias:-preview}" + preview_slug="$(printf '%s' "$raw_ref" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9-]+/-/g; s/^-+//; s/-+$//')" + preview_hash="$(printf '%s' "$raw_ref" | sha256sum | cut -c1-8)" + preview_alias="$(printf '%s' "${preview_slug:-preview}" | cut -c1-20)-$preview_hash" npx wrangler versions upload --config wrangler/www.production.jsonc --preview-alias "$preview_alias" env: CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}