deploy: enforce HTTPS on hayatepy.dev

Author: yhay81

.github/workflows/documentation.yml

@@ -98,6 +98,14 @@ jobs:
           apiToken: ${{ env.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
           wranglerVersion: "4.114.0"
+      - id: deploy-http-redirect
+        if: env.CLOUDFLARE_API_TOKEN != ''
+        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
+        with:
+          apiToken: ${{ env.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          command: deploy --config wrangler.redirect.jsonc
+          wranglerVersion: "4.114.0"
       - if: env.CLOUDFLARE_API_TOKEN == ''
         run: >-
           echo "::warning::Cloudflare deploy skipped because

README.md

@@ -39,6 +39,11 @@ Deploy with the account authenticated by Wrangler:
 npm run deploy
 ```
 
+The deploy publishes the static site on the `hayatepy.dev` Custom Domain and a
+separate HTTP-only Route that redirects requests to HTTPS. Keeping the redirect
+Worker separate means HTTPS asset requests continue to use the static site
+Worker directly.
+
 The central site owns cross-package onboarding, runtime selection, ecosystem
 navigation, and evidence interpretation. Package-specific API details remain
 next to their implementation repositories.

package.json

@@ -5,7 +5,9 @@
   "description": "Unified documentation for the Hayate Python ecosystem",
   "scripts": {
     "build": "uv run zensical build --clean --strict && uv run python scripts/write_headers.py site && uv run python scripts/check_site.py site",
-    "deploy": "npm run build && wrangler deploy",
+    "deploy": "npm run build && npm run deploy:site && npm run deploy:redirect",
+    "deploy:site": "wrangler deploy",
+    "deploy:redirect": "wrangler deploy --config wrangler.redirect.jsonc",
     "preview": "npm run build && wrangler dev"
   },
   "devDependencies": {

tests/test_cloudflare_config.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+ROOT = Path(__file__).parents[1]
+
+
+def load_config(name: str) -> dict:
+    return json.loads((ROOT / name).read_text(encoding="utf-8"))
+
+
+def test_site_uses_canonical_custom_domain() -> None:
+    config = load_config("wrangler.jsonc")
+
+    assert config["name"] == "hayate-docs"
+    assert config["routes"] == [
+        {"pattern": "hayatepy.dev", "custom_domain": True},
+    ]
+    assert config["assets"]["directory"] == "./site"
+
+
+def test_http_redirect_only_intercepts_plaintext_requests() -> None:
+    config = load_config("wrangler.redirect.jsonc")
+
+    assert config["name"] != "hayate-docs"
+    assert config["workers_dev"] is False
+    assert config["routes"] == [
+        {"pattern": "http://hayatepy.dev/*", "zone_name": "hayatepy.dev"},
+    ]
+    assert (ROOT / config["main"]).is_file()

workers/http-redirect.js

@@ -0,0 +1,7 @@
+export default {
+  fetch(request) {
+    const url = new URL(request.url);
+    url.protocol = "https:";
+    return Response.redirect(url, 301);
+  },
+};

wrangler.redirect.jsonc

@@ -0,0 +1,14 @@
+{
+  "$schema": "./node_modules/wrangler/config-schema.json",
+  "name": "hayate-docs-http-redirect",
+  "main": "workers/http-redirect.js",
+  "compatibility_date": "2026-07-28",
+  "preview_urls": false,
+  "workers_dev": false,
+  "routes": [
+    {
+      "pattern": "http://hayatepy.dev/*",
+      "zone_name": "hayatepy.dev"
+    }
+  ]
+}