fix(cloudflare): default to worker, optional account id, infer prod branch#846
Merged
Conversation
…ranch Addresses review feedback on the cloudflare target (#843): - Default `deployType` is now `worker` (was `pages`). Cloudflare is steering new projects to Workers with static assets and positioning Pages as legacy, so Workers is the forward-looking default. Pages is still fully supported via `deployType: pages`. - `CLOUDFLARE_ACCOUNT_ID` is no longer treated as a required secret -- it is an identifier, not a credential. Only `CLOUDFLARE_API_TOKEN` remains a required secret. The account id is forwarded to wrangler only when set; otherwise wrangler auto-discovers it for single-account tokens. - `productionBranch` is now optional and auto-inferred for Pages. When unset, the target reads the project's production branch from the Cloudflare API (`GET /accounts/{id}/pages/projects/{name}`, the same call wrangler makes internally -- no extra token scope) and passes it as `--branch` so the release reliably lands on production instead of a silent preview. A 404 (wrong project/account) fails loudly; transient errors fall back to omitting `--branch` (a bare non-git deploy defaults to production). The dry-run guard runs before any network call, so a dry run still makes zero remote calls. API-sourced branch values are also checked against the `${VAR}` env-expansion guard as defense-in-depth. Docs updated to lead with worker, describe the branch-inference flow, mark the account id optional, and note there is no OIDC option for Cloudflare.
Contributor
|
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #843 addressing the review comments left on the cloudflare docs. Three behavior changes + docs/tests.
1. Default
deployType: worker(waspages)Cloudflare is steering new projects to Workers (with static assets) and positioning Pages as legacy, so
workeris the forward-looking default. Pages remains fully supported viadeployType: pages.2.
CLOUDFLARE_ACCOUNT_IDis now optional (not a secret)The account ID is an identifier, not a credential. Only
CLOUDFLARE_API_TOKENis a required secret now. The account ID is read from the environment and forwarded towrangleronly when set; otherwisewranglerauto-discovers it for single-account tokens (confirmed against wrangler v4 behavior).3.
productionBranchauto-inferred for Pageswrangler pages deploy --branch <X>deploys to production only when<X>exactly matches the project's server-side production branch — any other value silently produces a preview deploy. Previously we defaulted tomain, which is a guess. Now:productionBranchis configured → used verbatim.production_branchfromGET /accounts/{id}/pages/projects/{name}(the same call wrangler makes internally, so no extra token scope — Pages:Edit covers it).--branch(a bare deploy from the non-git temp dir defaults to production).A 404 (wrong project/account) fails loudly rather than masking a misconfig; transient/network errors fall back to omitting
--branch.Safety
isDryRun()guard runs before both the inferencefetch()andspawnProcess.${VAR}env-expansion guard before reaching argv.fetch(Node 24.18.0 baseline).Testing
pnpm test— full suite green (1052 passed). 27 cloudflare tests covering: worker default, account-id optional/forwarded-when-set, branch inference (correct URL +Bearerauth header), config-branch-skips-API, 404 hard-fail, API-failure/no-account-id fallbacks, suspicious-branch guard, worker-never-calls-API, and dry-run-makes-no-fetch.tsc/pnpm lintclean. Docs build clean.Review
Adversarial subagent review: dry-run zero-network-call invariant verified by code walk; no token leak; no CRITICAL/MAJOR issues. Findings MINOR-1 (guard the API-sourced branch) and MINOR-3 (hard-fail on 404) were addressed in this PR.
Addresses review comments on #843 (productionBranch default, account-id-not-a-secret, auto-discovery/inference).
🤖 Generated with opencode