chore: replace Cloudflare GitHub-app deploy now that the repo lives on Forgejo #1

New issue

Open

opened 2026-05-17 21:41:16 +00:00 by jturner · 0 comments

jturner commented

2026-05-17 21:41:16 +00:00

Owner

Today the site is deployed via Cloudflare's GitHub App git integration (Cloudflare watches smartsquidtech/smartsquid on GitHub and rebuilds on push). Now that the repo has moved to Forgejo (forgejo.smartsquid.dev/smartsquid/smartsquidinc.com), this stops working on the next change — and Cloudflare doesn't natively support Forgejo as a git provider, so a like-for-like swap isn't possible.

We need to pick a replacement and cut over.

Options

Forgejo Actions + wrangler deploy (recommended)
- Mirrors the .forgejo/workflows/ pattern already in use in nautilus
- Workflow installs deps, runs npm run check && npm run typecheck && npm run build, then cloudflare/wrangler-action publishes the Worker using the existing wrangler.jsonc
- Requires CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID as repo secrets
- Pro: single source of truth on Forgejo, parity with the rest of the org, no third-party git mirror
- Con: lose Cloudflare's automatic preview deployments per push (workflow can recreate this, but it's extra plumbing)
Mirror Forgejo → GitHub, keep the Cloudflare App pointed at the mirror
- Forgejo push-mirror to a read-only smartsquidtech/smartsquid clone; Cloudflare app keeps watching that mirror
- Pro: zero change to the deploy mechanism; preview deploys keep working
- Con: still depends on GitHub for production, defeats part of the reason for moving off GitHub, mirror lag = deploy lag
Webhook → Forgejo Action → Direct Upload API
- Forgejo Action triggered on push calls Cloudflare's Direct Upload API
- Functionally equivalent to option 1 with more glue; no reason to prefer it unless wrangler-action doesn't work for our setup

Tasks (assuming option 1)

Disconnect the existing Cloudflare ↔ GitHub App connection for the smartsquid Worker
Add .forgejo/workflows/deploy.yml on push to main:
- actions/checkout
- Node setup + npm ci
- npm run check && npm run typecheck
- npm run build (produces out/)
- cloudflare/wrangler-action consuming the existing wrangler.jsonc
Add CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID repo secrets (Settings → Actions → Secrets)
Scope the token to the minimum: Workers Scripts:Edit, Account:Read, plus Zone:Read on the smartsquidinc.com zone (needed for the custom-domain routes)
Verify a full round-trip on a branch: push → watch the run on the Forgejo Actions tab → confirm the Worker version bumps and the site updates
Decide if/how to replace Cloudflare's per-PR preview deploys (separate ticket if non-trivial)
Update CLAUDE.md — it still claims the site deploys to a GCS bucket fronted by Cloudflare; that's stale

Notes

Reference workflow style: .forgejo/workflows/ in nautilus
wrangler.jsonc already declares apex + www as custom_domain: true, so DNS and TLS keep flowing automatically — the workflow only needs to publish

Today the site is deployed via **Cloudflare's GitHub App git integration** (Cloudflare watches `smartsquidtech/smartsquid` on GitHub and rebuilds on push). Now that the repo has moved to Forgejo (`forgejo.smartsquid.dev/smartsquid/smartsquidinc.com`), this stops working on the next change — and Cloudflare doesn't natively support Forgejo as a git provider, so a like-for-like swap isn't possible. We need to pick a replacement and cut over. ## Options 1. **Forgejo Actions + `wrangler deploy`** *(recommended)* - Mirrors the `.forgejo/workflows/` pattern already in use in `nautilus` - Workflow installs deps, runs `npm run check && npm run typecheck && npm run build`, then `cloudflare/wrangler-action` publishes the Worker using the existing `wrangler.jsonc` - Requires `CLOUDFLARE_API_TOKEN` + `CLOUDFLARE_ACCOUNT_ID` as repo secrets - Pro: single source of truth on Forgejo, parity with the rest of the org, no third-party git mirror - Con: lose Cloudflare's automatic preview deployments per push (workflow can recreate this, but it's extra plumbing) 2. **Mirror Forgejo → GitHub, keep the Cloudflare App pointed at the mirror** - Forgejo push-mirror to a read-only `smartsquidtech/smartsquid` clone; Cloudflare app keeps watching that mirror - Pro: zero change to the deploy mechanism; preview deploys keep working - Con: still depends on GitHub for production, defeats part of the reason for moving off GitHub, mirror lag = deploy lag 3. **Webhook → Forgejo Action → Direct Upload API** - Forgejo Action triggered on push calls Cloudflare's Direct Upload API - Functionally equivalent to option 1 with more glue; no reason to prefer it unless `wrangler-action` doesn't work for our setup ## Tasks (assuming option 1) - [ ] Disconnect the existing Cloudflare ↔ GitHub App connection for the `smartsquid` Worker - [ ] Add `.forgejo/workflows/deploy.yml` on push to `main`: - `actions/checkout` - Node setup + `npm ci` - `npm run check && npm run typecheck` - `npm run build` (produces `out/`) - `cloudflare/wrangler-action` consuming the existing `wrangler.jsonc` - [ ] Add `CLOUDFLARE_API_TOKEN` + `CLOUDFLARE_ACCOUNT_ID` repo secrets (Settings → Actions → Secrets) - [ ] Scope the token to the minimum: `Workers Scripts:Edit`, `Account:Read`, plus `Zone:Read` on the `smartsquidinc.com` zone (needed for the custom-domain routes) - [ ] Verify a full round-trip on a branch: push → watch the run on the Forgejo Actions tab → confirm the Worker version bumps and the site updates - [ ] Decide if/how to replace Cloudflare's per-PR preview deploys (separate ticket if non-trivial) - [ ] Update `CLAUDE.md` — it still claims the site deploys to a GCS bucket fronted by Cloudflare; that's stale ## Notes - Reference workflow style: `.forgejo/workflows/` in `nautilus` - `wrangler.jsonc` already declares apex + `www` as `custom_domain: true`, so DNS and TLS keep flowing automatically — the workflow only needs to publish

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

smartsquid/smartsquidinc.com#1

No description provided.

Rows
Columns