Add production blog Worker workflow

.gitea/workflows/production-blog.yml

@@ -0,0 +1,47 @@
+name: Deploy blog production Worker
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - .gitea/workflows/production-blog.yml
+      - astro.config.mjs
+      - package.json
+      - package-lock.json
+      - public/**
+      - schemas/**
+      - scripts/**
+      - sites.json
+      - sites/blog/**
+      - src/**
+      - wrangler/blog.production.jsonc
+  workflow_dispatch:
+
+jobs:
+  production:
+    name: Build and deploy blog.3031023.xyz production
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      SITE_KEY: blog
+      DEPLOY_ENV: production
+      ASTRO_TELEMETRY_DISABLED: '1'
+    steps:
+      - name: Checkout source
+        uses: https://github.com/actions/checkout@v4
+      - name: Use Node 22
+        uses: https://github.com/actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Install locked dependencies
+        run: npm ci
+      - name: Validate and build production blog
+        run: npm run build:site
+      - name: Verify production blog output
+        run: npm run verify:build
+      - name: Deploy Worker without custom domains or routes
+        run: npx wrangler deploy --config wrangler/blog.production.jsonc
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}

README.md

@@ -37,6 +37,9 @@ The Gitea workflows deploy scoped non-production Workers from every non-`main`
 branch: `3031023-xyz-www-preview` for primary-site changes and
 `3031023-xyz-blog-preview` for blog changes. Relevant primary-site pushes to
 `main` deploy the existing `3031023-xyz-www` production Worker automatically.
+Relevant blog pushes to `main` deploy the separate `3031023-xyz-blog`
+production Worker automatically. Both production workflows deploy static assets
+only.
 It uses the existing `CF_API_TOKEN` and `CF_ACCOUNT_ID`. The token retains the
 Pages permissions needed for the `main` rollback target and now also permits
 the non-production Worker preview deployment.

docs/blog-preview.md

@@ -5,9 +5,10 @@ the same root repository. Its non-production Worker is
 `3031023-xyz-blog-preview` and its workers.dev preview URL is published by
 Cloudflare after the pilot workflow completes.
 
-The Worker is now attached only to `blog.3031023.xyz` for the Phase 5 hosted
-subdomain test. Its deployed preview build intentionally remains `noindex` and
-disallows crawling until a separately approved production blog release exists.
+The preview Worker remains attached only to `blog.3031023.xyz` during the
+hosted-test period. Its deployed preview build intentionally remains `noindex`
+and disallows crawling until the separately deployed production blog Worker is
+verified and the domain move is approved.
 
 The sample posts remain structured site data for this pilot. Markdown content
 collections and any editor/CMS workflow are explicitly deferred.

docs/blog-production-runbook.md

@@ -0,0 +1,40 @@
+# Blog production Worker runbook
+
+## Scope and safety boundary
+
+This runbook moves only `blog.3031023.xyz` from the independent preview Worker
+to the independent static production Worker `3031023-xyz-blog`. It does not
+change the primary site, the Pages rollback project, DNS records, redirects,
+forms, n8n, onboarding, CMS, or client-editing boundaries.
+
+The routine workflows deploy static assets only:
+
+- relevant `main` changes deploy `3031023-xyz-blog` in production mode;
+- relevant non-`main` changes deploy `3031023-xyz-blog-preview` in preview
+  mode; and
+- neither workflow can create, remove, or alter custom domains, DNS, routes,
+  or redirects.
+
+## Pre-cutover verification
+
+1. Record the production Worker version and verify its `workers.dev` URL.
+2. Confirm the journal home page and all published post pages return 200.
+3. Confirm a nonexistent post returns the static 404.
+4. Confirm production metadata is indexable, `robots.txt` allows crawling, and
+   the sitemap lists the journal and published posts.
+5. Confirm the preview Worker remains untouched and its current deployment is
+   available as the immediate blog rollback target.
+
+## Domain move (requires separate approval)
+
+1. Remove `blog.3031023.xyz` from `3031023-xyz-blog-preview`; do not delete
+   that Worker or its deployment history.
+2. Attach `blog.3031023.xyz` to `3031023-xyz-blog` as its only custom domain.
+3. Re-run the public verification checks against the hostname.
+
+## Rollback
+
+1. Remove `blog.3031023.xyz` from `3031023-xyz-blog`.
+2. Reattach it to the unchanged `3031023-xyz-blog-preview` Worker.
+3. Verify the preview Worker’s known-good deployment at the hostname. The
+   preview build will intentionally return to its no-index behavior.

sites.json

@@ -12,9 +12,9 @@
     },
     "blog": {
       "hostname": "blog.3031023.xyz",
-      "workerName": "3031023-xyz-blog-preview",
+      "workerName": "3031023-xyz-blog",
       "contactSiteKey": "3031023-xyz-blog",
-      "status": "preview"
+      "status": "production"
     }
   }
 }

wrangler/blog.production.jsonc

@@ -0,0 +1,7 @@
+{
+  "$schema": "../node_modules/wrangler/config-schema.json",
+  "name": "3031023-xyz-blog",
+  "compatibility_date": "2026-09-02",
+  "workers_dev": true,
+  "assets": { "directory": "../dist/blog", "not_found_handling": "404-page" }
+}