From 9042639dd4bba437889eed9653e22f6f25b11c0f Mon Sep 17 00:00:00 2001 From: Kevin Date: Wed, 2 Sep 2026 01:06:51 -0400 Subject: [PATCH] Avoid slow cache restore and scope Worker preview token --- .gitea/workflows/deploy.yml | 3 +-- README.md | 4 +++- docs/preview-deployment.md | 6 +++++- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 2a597ad..90310c2 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -27,7 +27,6 @@ jobs: uses: https://github.com/actions/setup-node@v4 with: node-version: 22 - cache: npm - name: Install locked dependencies run: npm ci - name: Validate and build selected site @@ -37,5 +36,5 @@ jobs: - name: Deploy non-production Worker run: npx wrangler deploy --config "wrangler/${SITE_KEY}.jsonc" env: - CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} + CLOUDFLARE_API_TOKEN: ${{ secrets.CF_WORKER_PREVIEW_TOKEN }} CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} diff --git a/README.md b/README.md index ac8c2a6..333ebf1 100644 --- a/README.md +++ b/README.md @@ -35,7 +35,9 @@ routes, account IDs, or secrets. The Gitea workflow deploys only a non-production Worker from the pilot branch: `3031023-xyz-www-preview` by default, or the manually selected `blog` site. -It uses the existing repository secrets `CF_API_TOKEN` and `CF_ACCOUNT_ID`. +It uses `CF_WORKER_PREVIEW_TOKEN` and `CF_ACCOUNT_ID`. The preview token is a +separate, account-scoped Workers deployment credential; it does not replace +the Pages token retained on `main` for rollback. Routine jobs do not configure DNS or custom domains. Production hostname attachment and the `www` redirect are manual, diff --git a/docs/preview-deployment.md b/docs/preview-deployment.md index d67d4ed..7d17076 100644 --- a/docs/preview-deployment.md +++ b/docs/preview-deployment.md @@ -10,7 +10,11 @@ separate Worker names: `workers.dev` is the only preview destination. Neither Wrangler configuration contains a route, custom domain, zone ID, account ID, or token. Cloudflare -credentials remain Gitea repository secrets. +credentials remain Gitea repository secrets. The preview workflow uses +`CF_WORKER_PREVIEW_TOKEN`, scoped only to the Cloudflare account hosting this +pilot. Grant it the Cloudflare **Edit Cloudflare Workers** template (including +Account Workers Scripts edit/write) and retain `CF_ACCOUNT_ID` as the account +selector. Do not grant DNS edit permissions for routine preview deployment. The primary Worker must pass its public preview test matrix before an operator records the exact Pages deployment/DNS state and requests production-cutover