fix(web-og): stop workers-og's 1-year immutable default overriding OG cache-control #42
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Preview | |
| # Isolated preview deploys of the web + og Workers for each PR (issue #70). | |
| # Per-version Preview URLs can't serve a Worker that implements a Durable | |
| # Object (the GitlabRelay relay), so the preview is a separately-named pair: | |
| # released-web-preview ← released-web-og-preview (Service Binding) | |
| # Deployed from the [env.preview] blocks in each wrangler.toml. web-preview | |
| # deploys FIRST (og-preview service-binds to it). Each PR overwrites the same | |
| # preview Workers (last deploy wins — one preview at a time, fine for a solo app). | |
| # | |
| # The preview Workers are created by the first deploy. Secrets are set per-env | |
| # AFTER that first deploy (see issue #70): | |
| # wrangler secret put GITHUB_TOKEN --env preview (packages/web) | |
| # wrangler secret put INTERNAL_SECRET --env preview (packages/web AND web-og, same value) | |
| # Until they are set, lookups run unauthenticated and OG render 401s — that is a | |
| # runtime degrade, not a deploy failure. | |
| on: | |
| pull_request: | |
| paths: | |
| # Only spend a preview deploy when something that ships in a Worker changes. | |
| - 'packages/web/**' | |
| - 'packages/web-og/**' | |
| - 'packages/core/**' | |
| - '.github/workflows/preview.yml' | |
| workflow_dispatch: {} | |
| # A new push to the same PR cancels the in-flight preview deploy. | |
| concurrency: | |
| group: preview-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| preview: | |
| name: deploy preview workers | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: write # comment the preview URLs back on the PR | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # pnpm version is read from package.json#packageManager. | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| # Build core first: web/web-og bundle @released/core, whose dist is only | |
| # generated by the build (same reason release.yml / validate.sh build first). | |
| - run: pnpm -r build | |
| # Dependabot runs (and some forks) withhold repo secrets, so | |
| # CLOUDFLARE_API_TOKEN arrives empty and `wrangler deploy` fails at auth — | |
| # a false-red on a non-required check. The `secrets` context can't be | |
| # evaluated in a step `if:` expression, so check the env here and gate the | |
| # deploy + comment steps on this output (issue #70 / #131). | |
| - name: Check preview deploy secret | |
| id: has_secret | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| run: | | |
| if [ -n "${CLOUDFLARE_API_TOKEN}" ]; then | |
| echo "present=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "present=false" >> "$GITHUB_OUTPUT" | |
| echo "::notice::Skipping preview deploy — CLOUDFLARE_API_TOKEN is unset (expected on Dependabot runs, which withhold repo secrets)." | |
| fi | |
| # web-preview FIRST — og-preview's Service Binding targets released-web-preview. | |
| - name: Deploy web-preview | |
| if: steps.has_secret.outputs.present == 'true' | |
| id: web | |
| working-directory: packages/web | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| PR: ${{ github.event.pull_request.number || github.run_id }} | |
| run: | | |
| set -euo pipefail | |
| npx wrangler deploy --env preview \ | |
| --tag "pr-${PR}" --message "preview PR#${PR}" 2>&1 | tee /tmp/web.log | |
| url=$(grep -oE 'https://[a-z0-9.-]+\.workers\.dev' /tmp/web.log | head -n1 || true) | |
| echo "url=${url}" >> "$GITHUB_OUTPUT" | |
| - name: Deploy og-preview | |
| if: steps.has_secret.outputs.present == 'true' | |
| id: og | |
| working-directory: packages/web-og | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| PR: ${{ github.event.pull_request.number || github.run_id }} | |
| run: | | |
| set -euo pipefail | |
| npx wrangler deploy --env preview \ | |
| --tag "pr-${PR}" --message "preview PR#${PR}" 2>&1 | tee /tmp/og.log | |
| url=$(grep -oE 'https://[a-z0-9.-]+\.workers\.dev' /tmp/og.log | head -n1 || true) | |
| echo "url=${url}" >> "$GITHUB_OUTPUT" | |
| # workflow_dispatch has no PR (context.issue.number is undefined), so the | |
| # listComments/createComment calls below would 422. Skip the comment there — | |
| # a manual dispatch is a smoke-deploy of the current branch to preview, not | |
| # a PR update. Deploy steps above still run (issue #70). | |
| - name: Comment preview URLs on the PR | |
| if: steps.has_secret.outputs.present == 'true' && github.event_name == 'pull_request' | |
| uses: actions/github-script@v9 | |
| env: | |
| # Pass deploy output through env (not inline ${{ }}) so a malformed | |
| # wrangler URL can never inject into the script below. | |
| WEB_URL: ${{ steps.web.outputs.url }} | |
| OG_URL: ${{ steps.og.outputs.url }} | |
| with: | |
| script: | | |
| const web = process.env.WEB_URL || 'released-web-preview (open the Cloudflare dashboard for the URL)'; | |
| const og = process.env.OG_URL || 'released-web-og-preview (open the Cloudflare dashboard for the URL)'; | |
| const body = [ | |
| '### Preview deployed', | |
| '', | |
| `- **web**: <${web}>`, | |
| `- **og**: <${og}>`, | |
| '', | |
| 'Federated GitLab lookups (freedesktop / GNOME) degrade to the "use the CLI" card — the Anubis relay is off in preview. GitHub lookups, permalinks, and OG render work once `INTERNAL_SECRET`/`GITHUB_TOKEN` are set on the preview env.', | |
| ].join('\n'); | |
| const { data: comments } = await github.rest.issues.listComments({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.issue.number, | |
| }); | |
| const marker = comments.find(c => c.user.type === 'Bot' && c.body.includes('### Preview deployed')); | |
| if (marker) { | |
| await github.rest.issues.updateComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| comment_id: marker.id, | |
| body, | |
| }); | |
| } else { | |
| await github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.issue.number, | |
| body, | |
| }); | |
| } |