1.3 KiB
Preview deployment and later cutover controls
The preview workflow deploys static output only. It has two deliberately separate Worker names:
| Site key | Preview Worker | Future hostname |
|---|---|---|
www |
3031023-xyz-www-preview |
3031023.xyz |
blog |
3031023-xyz-blog-preview |
blog.3031023.xyz |
workers.dev is the only preview destination. Neither Wrangler configuration
contains a route, custom domain, zone ID, account ID, or token. Cloudflare
credentials remain Gitea repository secrets. The preview workflow uses
CF_WORKER_PREVIEW_TOKEN, scoped only to the Cloudflare account hosting this
pilot. Grant it the Cloudflare Edit Cloudflare Workers template (including
Account Workers Scripts edit/write) and retain CF_ACCOUNT_ID as the account
selector. Do not grant DNS edit permissions for routine preview deployment.
The primary Worker must pass its public preview test matrix before an operator
records the exact Pages deployment/DNS state and requests production-cutover
approval. A production deployment should use a separately named approved
Worker or an explicitly promoted Worker version; it must not be an ordinary
push job. Attaching 3031023.xyz, configuring the www.3031023.xyz redirect,
and attaching blog.3031023.xyz each remain manual approval-boundary actions.