mirror of
https://github.com/ThatGuySam/doesitarm.git
synced 2026-05-15 06:35:20 -07:00
6d858d2a19
The Cloudflare worker deploy workflow was printing secret-derived config into CI logs and doing unnecessary root installs. Tighten the workflow to use read-only permissions, secure file writes, and per-worker dependency installs, then add a staged TypeScript migration plan so the repo-wide conversion has explicit CI-safe ordering. Constraint: Must keep the current Cloudflare deploy path working while removing secret exposure from logs Rejected: Leave the workflow as-is and document the risk | known secret leakage in CI is an immediate operational defect Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep worker deploy inputs secret-only and validate repo-wide TypeScript work in bounded slices, not one bulk migration Tested: ruby YAML parse of .github/workflows/deploy-cloudflare-workers.yml; git diff --check; npm ci --prefix doesitarm-default --ignore-scripts --no-audit --no-fund; npm ci --prefix workers/analytics --ignore-scripts --no-audit --no-fund Not-tested: Full GitHub Actions execution after commit
62 lines
1.7 KiB
YAML
62 lines
1.7 KiB
YAML
# https://github.com/marketplace/actions/deploy-to-cloudflare-workers-with-wrangler
|
|
# https://github.com/cloudflare/wrangler-action
|
|
name: Deploy to Cloudflare Workers with Wrangler
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: cloudflare-workers-master
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
name: Deploy
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Use Node.js 24
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: .nvmrc
|
|
cache: npm
|
|
cache-dependency-path: |
|
|
doesitarm-default/package-lock.json
|
|
workers/analytics/package-lock.json
|
|
|
|
- name: Write Wrangler configs
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
umask 077
|
|
|
|
printf '%s' '${{ secrets.WRANGLER_ENV }}' | base64 --decode > doesitarm-default/.env
|
|
printf '%s' '${{ secrets.WRANGLER_TOML }}' | base64 --decode > doesitarm-default/wrangler.toml
|
|
printf '%s' '${{ secrets.ANALYTICS_WRANGER_TOML }}' | base64 --decode > workers/analytics/wrangler.toml
|
|
|
|
- name: Install default worker dependencies
|
|
working-directory: doesitarm-default
|
|
run: npm ci
|
|
|
|
- name: Install analytics worker dependencies
|
|
working-directory: workers/analytics
|
|
run: npm ci
|
|
|
|
- name: Deploy Default Worker
|
|
uses: cloudflare/wrangler-action@1.3.0
|
|
with:
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
workingDirectory: 'doesitarm-default'
|
|
|
|
- name: Deploy Analytics Worker
|
|
uses: cloudflare/wrangler-action@1.3.0
|
|
with:
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
workingDirectory: 'workers/analytics'
|