sloanops.admin/3031023-xyz-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid slow cache restore and scope Worker preview token

Browse Source
This commit is contained in:
Kevin
2026-09-02 01:06:51 -04:00
parent 15f03016b5
commit 9042639dd4
3 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy.yml
+1 -2
View File
@@ -27,7 +27,6 @@ jobs:
uses: https://github.com/actions/setup-node@v4 uses: https://github.com/actions/setup-node@v4
with: with:
node-version: 22 node-version: 22
cache: npm
- name: Install locked dependencies - name: Install locked dependencies
run: npm ci run: npm ci
- name: Validate and build selected site - name: Validate and build selected site
@@ -37,5 +36,5 @@ jobs:
- name: Deploy non-production Worker - name: Deploy non-production Worker
run: npx wrangler deploy --config "wrangler/${SITE_KEY}.jsonc" run: npx wrangler deploy --config "wrangler/${SITE_KEY}.jsonc"
env: env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} CLOUDFLARE_API_TOKEN: ${{ secrets.CF_WORKER_PREVIEW_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
README.md
+3 -1
View File
@@ -35,7 +35,9 @@ routes, account IDs, or secrets.
The Gitea workflow deploys only a non-production Worker from the pilot branch: The Gitea workflow deploys only a non-production Worker from the pilot branch:
`3031023-xyz-www-preview` by default, or the manually selected `blog` site. `3031023-xyz-www-preview` by default, or the manually selected `blog` site.
It uses the existing repository secrets `CF_API_TOKEN` and `CF_ACCOUNT_ID`. It uses `CF_WORKER_PREVIEW_TOKEN` and `CF_ACCOUNT_ID`. The preview token is a
separate, account-scoped Workers deployment credential; it does not replace
the Pages token retained on `main` for rollback.
Routine jobs do not configure DNS or custom domains. Routine jobs do not configure DNS or custom domains.
Production hostname attachment and the `www` redirect are manual, Production hostname attachment and the `www` redirect are manual,
docs/preview-deployment.md
+5 -1
View File
@@ -10,7 +10,11 @@ separate Worker names:
`workers.dev` is the only preview destination. Neither Wrangler configuration `workers.dev` is the only preview destination. Neither Wrangler configuration
contains a route, custom domain, zone ID, account ID, or token. Cloudflare contains a route, custom domain, zone ID, account ID, or token. Cloudflare
credentials remain Gitea repository secrets. credentials remain Gitea repository secrets. The preview workflow uses
`CF_WORKER_PREVIEW_TOKEN`, scoped only to the Cloudflare account hosting this
pilot. Grant it the Cloudflare **Edit Cloudflare Workers** template (including
Account Workers Scripts edit/write) and retain `CF_ACCOUNT_ID` as the account
selector. Do not grant DNS edit permissions for routine preview deployment.
The primary Worker must pass its public preview test matrix before an operator The primary Worker must pass its public preview test matrix before an operator
records the exact Pages deployment/DNS state and requests production-cutover records the exact Pages deployment/DNS state and requests production-cutover