ADFA-3078: Search the on-device Maven repo before the remote ones #33
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy well-known Worker | |
| # Deploys infra/well-known-worker, which serves | |
| # https://<host>/.well-known/assetlinks.json out of the private "well-known" R2 | |
| # bucket. The object itself is written by signing-fingerprint.yml; this workflow | |
| # owns only the code that reads it, and does not verify the served result - | |
| # signing-fingerprint.yml already does that end to end when it deploys. | |
| # | |
| # A Cloudflare Origin Rule cannot do this job on the Free plan: host header, SNI | |
| # and DNS record overrides are Enterprise-only, and R2 selects a bucket from the | |
| # Host header. The Worker uses an R2 binding instead, so the bucket stays private. | |
| # | |
| # Requires a CLOUDFLARE_WORKERS_DEPLOY_TOKEN secret with: | |
| # Account -> Workers Scripts -> Edit (upload the script) | |
| # Account -> Workers R2 Storage -> Read (see below) | |
| # Zone -> Workers Routes -> Edit (attach the routes on appdevforall.org) | |
| # The R2 read scope is not optional: wrangler resolves the bucket named in the | |
| # r2_buckets binding via GET /accounts/<id>/r2/buckets/well-known and fails the | |
| # deploy with "Authentication error [code: 10000]" without it. Note that a scope | |
| # added to an existing token takes a few minutes to take effect - that same error | |
| # persists across an immediate re-run, so wait before concluding the scope is wrong. | |
| # The existing CLOUDFLARE_KEY_ID / CLOUDFLARE_SECRET_ACCESS_KEY pair is an R2 | |
| # S3-compatible credential and cannot deploy a Worker. | |
| on: | |
| workflow_dispatch: | |
| # Dispatch is only offered for workflows on the default branch, so run on push | |
| # to let this work from a feature branch before it reaches stage. Note that a | |
| # push on any branch therefore deploys the live Worker. | |
| push: | |
| paths: | |
| - 'infra/well-known-worker/**' | |
| - '.github/workflows/deploy-well-known-worker.yml' | |
| permissions: | |
| contents: read | |
| # One deploy at a time: concurrent uploads of the same script race on the routes. | |
| concurrency: | |
| group: deploy-well-known-worker | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| name: Deploy Worker | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Check Cloudflare credentials | |
| env: | |
| CLOUDFLARE_WORKERS_DEPLOY_TOKEN: ${{ secrets.CLOUDFLARE_WORKERS_DEPLOY_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} | |
| run: | | |
| set -euo pipefail | |
| # wrangler reports a missing token as an opaque auth error, so name the | |
| # actual gap here. Required scopes are listed at the top of this file. | |
| for var in CLOUDFLARE_WORKERS_DEPLOY_TOKEN CLOUDFLARE_ACCOUNT_ID; do | |
| if [ -z "${!var:-}" ]; then | |
| echo "ERROR: $var is not set. See the header of this workflow." >&2 | |
| exit 1 | |
| fi | |
| done | |
| - name: Deploy with Wrangler | |
| uses: cloudflare/wrangler-action@v4 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_WORKERS_DEPLOY_TOKEN }} | |
| accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} | |
| workingDirectory: infra/well-known-worker | |
| wranglerVersion: '4.124.0' | |
| command: deploy | |
| - name: Write job summary | |
| run: | | |
| set -euo pipefail | |
| { | |
| echo "## well-known Worker deployed" | |
| echo | |
| echo "Routes now served from the \`well-known\` R2 bucket:" | |
| echo | |
| echo "- \`https://appdevforall.org/.well-known/assetlinks.json\`" | |
| echo "- \`https://www.appdevforall.org/.well-known/assetlinks.json\`" | |
| echo | |
| echo "A route with no matching object falls through to the site origin." | |
| echo "Run **Print release signing certificate fingerprint** with \`deploy\` enabled to publish the object and verify it end to end." | |
| } >> "$GITHUB_STEP_SUMMARY" |