sloanops.admin/3031023-xyz-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Record completed internal CMS rollout

Browse Source
This commit is contained in:
Kevin
2026-09-04 22:25:57 -04:00
parent dc3ec3ff30
commit 5652339676
5 changed files with 234 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/preview-deployment.md
+26 -20
View File
@@ -1,24 +1,30 @@
# Preview deployment and later cutover controls
# Worker version previews
The preview workflow deploys static output only. It has two deliberately
separate Worker names:
Non-`main` pushes build and verify the affected site, then upload a
non-production version of its production Worker with a readable branch alias.
They do not deploy the version to production traffic.
| Site key | Preview Worker | Future hostname |
| --- | --- | --- |
| `www` | `3031023-xyz-www-preview` | `3031023.xyz` |
| `blog` | `3031023-xyz-blog-preview` | `blog.3031023.xyz` |
| Site key | Versioned Worker | Stable `cms` alias | Production hostname |
| --- | --- | --- | --- |
| `www` | `3031023-xyz-www` | `cms-3031023-xyz-www.ksloan90.workers.dev` | `3031023.xyz` |
| `blog` | `3031023-xyz-blog` | `cms-3031023-xyz-blog.ksloan90.workers.dev` | `blog.3031023.xyz` |
`workers.dev` is the only preview destination. Neither Wrangler configuration
contains a route, custom domain, zone ID, account ID, or token. Cloudflare
credentials remain Gitea repository secrets. The preview workflow uses the
existing `CF_API_TOKEN`, which has Account Workers Scripts edit/write for this
pilot plus the retained Pages rollback permissions. It uses `CF_ACCOUNT_ID` as
the account selector. Do not grant DNS edit permissions for routine preview
deployment.
The workflows derive the preview alias from the branch name, build with
preview robots rules, run output verification, and call `wrangler versions
upload`. They use the existing `CF_API_TOKEN` and `CF_ACCOUNT_ID` repository
secrets but contain no DNS, routes, custom-domain mutations, account IDs, or
tokens in source.
The primary Worker must pass its public preview test matrix before an operator
records the exact Pages deployment/DNS state and requests production-cutover
approval. A production deployment should use a separately named approved
Worker or an explicitly promoted Worker version; it must not be an ordinary
push job. Attaching `3031023.xyz`, configuring the `www.3031023.xyz` redirect,
and attaching `blog.3031023.xyz` each remain manual approval-boundary actions.
Only the stable CMS and production admin origins are registered with Gitea
OAuth/CORS. A CMS login attempt from a temporary branch alias is expected to
fail with `Unregistered Redirect URI`; do not add a wildcard. Review rendered
site output on the branch alias and use `https://3031023.xyz/admin/` or the
stable `cms` admin origin for editing tests.
Relevant pushes to `main` use separate production workflows and `wrangler
deploy` for the affected Worker after a production build and verifier pass.
The existing domain bindings do not change during routine deployments.
The older `*-preview` Wrangler configurations and Workers are retained as
rollback artifacts. Current branch workflows use Worker version previews of
the production-named Workers instead.