ci(deploy): provision Cloudflare infra via pulumi up before deploy

[timothygithinji]

Why

The Deploy workflow ran only vite build && wrangler deploy (+ Worker secret sync). Pulumi-managed infra — the Zero Trust Access policy/app, R2, KV, and the R2 API token — was never applied on merge; it depended on a manual t-stack provision. So the partner-email Access allowlist (#3) merged but never reached production — she still can't get past Cloudflare Access.

What

Adds a pulumi up step against gaff-cloudflare/production, before the Worker deploy:

• Runs on every push to main; no-op when nothing under infra/cloudflare changed.
• Own dependency install — infra/cloudflare isn't in the root Bun workspace.
• Reuses the existing full-scope CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID repo secrets.

Credential wiring

PULUMI_ACCESS_TOKEN lives in Doppler (gaff/prd), not a GitHub secret. So:

• Provision runs after Fetch-secrets, which exports it into $GITHUB_ENV; pulumi/actions reads it from the environment.
• The Worker secret sync strips it via jq 'del(.PULUMI_ACCESS_TOKEN)' — a gaff/prd secret would otherwise be bulk-pushed onto the Worker, putting an account-provisioning token on the edge runtime.

Test plan

• deploy.yml is valid YAML
• jq del drops only the Pulumi token (verified locally)
• PULUMI_ACCESS_TOKEN present in Doppler gaff/prd
• Post-merge: Deploy run's "Provision infrastructure" step shows the Access policy update (+1 email include) and succeeds, and "Sync Worker secrets" does NOT list PULUMI_ACCESS_TOKEN

Summary by CodeRabbit

• Chores
  • Deployment workflow now automatically provisions Cloudflare infrastructure during pushes to main and installs required infra dependencies before deployment.
  • Secrets sync updated to filter out provisioning credentials before uploading to the runtime, ensuring sensitive infra tokens are not propagated.

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 890f615f-85a2-45a2-8f1b-2a3a4c59e5e9

📥 Commits

Reviewing files that changed from the base of the PR and between c9ebd80 and 779ced8.

📒 Files selected for processing (1)

• .github/workflows/deploy.yml

---

Walkthrough

The deploy workflow now installs infra dependencies and runs Pulumi up against the production stack, then strips PULUMI_ACCESS_TOKEN from the Doppler secrets JSON before syncing Worker secrets and continuing the existing deploy steps.

Changes

Deploy workflow infrastructure provisioning

Layer / File(s)	Summary
Install infra deps and run Pulumi .github/workflows/deploy.yml	Adds CI steps to run bun install in infra/cloudflare and execute pulumi up for the timothygithinji/production stack using Pulumi, Cloudflare and Doppler secrets.
Strip Pulumi token before Worker secret sync .github/workflows/deploy.yml	Updates the secret-sync step to remove .PULUMI_ACCESS_TOKEN from the Doppler JSON payload (using jq 'del(.PULUMI_ACCESS_TOKEN)') before wrangler secret bulk to avoid uploading the Pulumi credential.

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant Doppler
  participant PulumiAction
  participant CloudflareAPI
  participant Wrangler
  GitHubActions->>Doppler: fetch secrets (exports PULUMI_ACCESS_TOKEN)
  GitHubActions->>PulumiAction: install infra deps + run pulumi up (env includes PULUMI_ACCESS_TOKEN, DOPPLER_TOKEN, CF tokens)
  PulumiAction->>CloudflareAPI: provision Cloudflare resources/bindings
  GitHubActions->>Doppler: read secrets JSON
  GitHubActions->>GitHubActions: remove .PULUMI_ACCESS_TOKEN from JSON
  GitHubActions->>Wrangler: wrangler secret bulk (upload remaining secrets)

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}