ringdrill/.github/workflows/deploy-proxy.yml at main · DISCOOS/ringdrill · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
name: Deploy apex proxy

# Deploys the apex reverse-proxy Worker (workers/apex-proxy) to Cloudflare.
# The Worker restores 200-proxying of the dynamic apex paths that Cloudflare
# Pages cannot proxy itself (ADR-0039 Phase 3). See workers/apex-proxy/src.
#
# Required secrets, all on the PROD environment
# (Settings -> Environments -> PROD -> Secrets):
#   CLOUDFLARE_API_TOKEN   - Cloudflare API token. In addition to the Pages
#                            permission used by deploy-site.yml, deploying a
#                            Worker with zone routes requires:
#                              * Account · Workers Scripts · Edit
#                              * Zone · Workers Routes · Edit  (ringdrill.app)
#                              * Zone · Zone · Read            (ringdrill.app)
#                            Either extend the existing token with these, or
#                            issue a dedicated token for this workflow.
#   CLOUDFLARE_ACCOUNT_ID  - Cloudflare account ID.

on:
  push:
    branches: [main]
    paths:
      - 'workers/apex-proxy/**'
      - '.github/workflows/deploy-proxy.yml'
  workflow_dispatch:

concurrency:
  group: deploy-proxy
  cancel-in-progress: true

# Wrangler is pinned rather than tracking the newest release. These jobs hold a
# Cloudflare API token with edit rights, and an unpinned `npx` invocation
# resolves and executes whatever was published to npm minutes earlier — so an
# upstream compromise would run with that token, on a push, unattended. A
# version bump should be a reviewed commit like any other.
#
# Nothing bumps it automatically: dependabot's github-actions ecosystem tracks
# `uses:` versions, not `npx` inside a `run:` step. Bump it here by hand when
# Cloudflare needs a newer client.
env:
  WRANGLER: wrangler@4.118.0

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    environment: PROD
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Verify required secrets are present
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          missing=()
          [ -z "$CLOUDFLARE_API_TOKEN"  ] && missing+=("CLOUDFLARE_API_TOKEN")
          [ -z "$CLOUDFLARE_ACCOUNT_ID" ] && missing+=("CLOUDFLARE_ACCOUNT_ID")
          if [ ${#missing[@]} -ne 0 ]; then
            echo "::error::Missing or empty repository secrets: ${missing[*]}"
            echo "Check Settings -> Environments -> PROD -> Secrets."
            exit 1
          fi
          echo "CLOUDFLARE_API_TOKEN length: ${#CLOUDFLARE_API_TOKEN}"
          echo "CLOUDFLARE_ACCOUNT_ID length: ${#CLOUDFLARE_ACCOUNT_ID}"

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: 22

      - name: Deploy Worker
        working-directory: workers/apex-proxy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: npx "$WRANGLER" deploy