ThatGuySam 6d858d2a19 ci(cloudflare): stop leaking deploy config and stage TS migration ... The Cloudflare worker deploy workflow was printing secret-derived config into CI logs and doing unnecessary root installs. Tighten the workflow to use read-only permissions, secure file writes, and per-worker dependency installs, then add a staged TypeScript migration plan so the repo-wide conversion has explicit CI-safe ordering. Constraint: Must keep the current Cloudflare deploy path working while removing secret exposure from logs Rejected: Leave the workflow as-is and document the risk | known secret leakage in CI is an immediate operational defect Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep worker deploy inputs secret-only and validate repo-wide TypeScript work in bounded slices, not one bulk migration Tested: ruby YAML parse of .github/workflows/deploy-cloudflare-workers.yml; git diff --check; npm ci --prefix doesitarm-default --ignore-scripts --no-audit --no-fund; npm ci --prefix workers/analytics --ignore-scripts --no-audit --no-fund Not-tested: Full GitHub Actions execution after commit		2026-04-04 17:06:58 -05:00
..
ISSUE_TEMPLATE	fix: indention	2025-06-14 13:36:45 -05:00
PULL_REQUEST_TEMPLATE	Add version to App Addition checklist	2023-02-25 15:34:47 -06:00
workflows	ci(cloudflare): stop leaking deploy config and stage TS migration	2026-04-04 17:06:58 -05:00