|
| 1 | +name: Deploy well-known Worker |
| 2 | + |
| 3 | +# Deploys infra/well-known-worker, which serves |
| 4 | +# https://<host>/.well-known/assetlinks.json out of the private "well-known" R2 |
| 5 | +# bucket. The object itself is written by signing-fingerprint.yml; this workflow |
| 6 | +# owns only the code that reads it, and does not verify the served result - |
| 7 | +# signing-fingerprint.yml already does that end to end when it deploys. |
| 8 | +# |
| 9 | +# A Cloudflare Origin Rule cannot do this job on the Free plan: host header, SNI |
| 10 | +# and DNS record overrides are Enterprise-only, and R2 selects a bucket from the |
| 11 | +# Host header. The Worker uses an R2 binding instead, so the bucket stays private. |
| 12 | +# |
| 13 | +# Requires a CLOUDFLARE_WORKERS_DEPLOY_TOKEN secret with: |
| 14 | +# Account -> Workers Scripts -> Edit (upload the script) |
| 15 | +# Account -> Workers R2 Storage -> Read (see below) |
| 16 | +# Zone -> Workers Routes -> Edit (attach the routes on appdevforall.org) |
| 17 | +# The R2 read scope is not optional: wrangler resolves the bucket named in the |
| 18 | +# r2_buckets binding via GET /accounts/<id>/r2/buckets/well-known and fails the |
| 19 | +# deploy with "Authentication error [code: 10000]" without it. Note that a scope |
| 20 | +# added to an existing token takes a few minutes to take effect - that same error |
| 21 | +# persists across an immediate re-run, so wait before concluding the scope is wrong. |
| 22 | +# The existing CLOUDFLARE_KEY_ID / CLOUDFLARE_SECRET_ACCESS_KEY pair is an R2 |
| 23 | +# S3-compatible credential and cannot deploy a Worker. |
| 24 | + |
| 25 | +on: |
| 26 | + workflow_dispatch: |
| 27 | + # Dispatch is only offered for workflows on the default branch, so run on push |
| 28 | + # to let this work from a feature branch before it reaches stage. Note that a |
| 29 | + # push on any branch therefore deploys the live Worker. |
| 30 | + push: |
| 31 | + paths: |
| 32 | + - 'infra/well-known-worker/**' |
| 33 | + - '.github/workflows/deploy-well-known-worker.yml' |
| 34 | + |
| 35 | +permissions: |
| 36 | + contents: read |
| 37 | + |
| 38 | +# One deploy at a time: concurrent uploads of the same script race on the routes. |
| 39 | +concurrency: |
| 40 | + group: deploy-well-known-worker |
| 41 | + cancel-in-progress: false |
| 42 | + |
| 43 | +jobs: |
| 44 | + deploy: |
| 45 | + name: Deploy Worker |
| 46 | + runs-on: ubuntu-latest |
| 47 | + timeout-minutes: 10 |
| 48 | + |
| 49 | + steps: |
| 50 | + - name: Checkout repository |
| 51 | + uses: actions/checkout@v4 |
| 52 | + |
| 53 | + - name: Check Cloudflare credentials |
| 54 | + env: |
| 55 | + CLOUDFLARE_WORKERS_DEPLOY_TOKEN: ${{ secrets.CLOUDFLARE_WORKERS_DEPLOY_TOKEN }} |
| 56 | + CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} |
| 57 | + run: | |
| 58 | + set -euo pipefail |
| 59 | +
|
| 60 | + # wrangler reports a missing token as an opaque auth error, so name the |
| 61 | + # actual gap here. Required scopes are listed at the top of this file. |
| 62 | + for var in CLOUDFLARE_WORKERS_DEPLOY_TOKEN CLOUDFLARE_ACCOUNT_ID; do |
| 63 | + if [ -z "${!var:-}" ]; then |
| 64 | + echo "ERROR: $var is not set. See the header of this workflow." >&2 |
| 65 | + exit 1 |
| 66 | + fi |
| 67 | + done |
| 68 | +
|
| 69 | + - name: Deploy with Wrangler |
| 70 | + uses: cloudflare/wrangler-action@v4 |
| 71 | + with: |
| 72 | + apiToken: ${{ secrets.CLOUDFLARE_WORKERS_DEPLOY_TOKEN }} |
| 73 | + accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} |
| 74 | + workingDirectory: infra/well-known-worker |
| 75 | + wranglerVersion: '4.124.0' |
| 76 | + command: deploy |
| 77 | + |
| 78 | + - name: Write job summary |
| 79 | + run: | |
| 80 | + set -euo pipefail |
| 81 | + { |
| 82 | + echo "## well-known Worker deployed" |
| 83 | + echo |
| 84 | + echo "Routes now served from the \`well-known\` R2 bucket:" |
| 85 | + echo |
| 86 | + echo "- \`https://appdevforall.org/.well-known/assetlinks.json\`" |
| 87 | + echo "- \`https://www.appdevforall.org/.well-known/assetlinks.json\`" |
| 88 | + echo |
| 89 | + echo "A route with no matching object falls through to the site origin." |
| 90 | + echo "Run **Print release signing certificate fingerprint** with \`deploy\` enabled to publish the object and verify it end to end." |
| 91 | + } >> "$GITHUB_STEP_SUMMARY" |
0 commit comments