From 8b8cac2e03d2cd52aa2b9b23270367aac96ff03c Mon Sep 17 00:00:00 2001 From: mvm Date: Fri, 14 Aug 2026 13:41:52 -0500 Subject: [PATCH 1/4] [Flue] Add production deploy workflow on merge to production --- .flue/wrangler.jsonc | 8 ++++ .github/workflows/ci.yml | 1 + .github/workflows/flue-deploy.yml | 62 +++++++++++++++++++++++++++++++ package.json | 2 +- 4 files changed, 72 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/flue-deploy.yml diff --git a/.flue/wrangler.jsonc b/.flue/wrangler.jsonc index 0ce6a227997..730251ac16a 100644 --- a/.flue/wrangler.jsonc +++ b/.flue/wrangler.jsonc @@ -189,4 +189,12 @@ "head_sampling_rate": 1, }, }, + "secrets": { + "required": [ + "DOCS_FLUE_GITHUB_APP_ID", + "DOCS_FLUE_GITHUB_APP_PRIVATE_KEY", + "DOCS_FLUE_GITHUB_INSTALLATION_ID", + "GITHUB_WEBHOOK_SECRET", + ], + }, } diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1fe11e07268..1b6de0ef7ab 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,6 +7,7 @@ on: paths-ignore: - ".flue/**" - ".github/workflows/flue-ci.yml" + - ".github/workflows/flue-deploy.yml" concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} diff --git a/.github/workflows/flue-deploy.yml b/.github/workflows/flue-deploy.yml new file mode 100644 index 00000000000..daa4c44ee2e --- /dev/null +++ b/.github/workflows/flue-deploy.yml @@ -0,0 +1,62 @@ +name: Flue Deploy + +on: + push: + branches: + - production + paths: + - ".flue/**" + - ".github/workflows/flue-deploy.yml" + workflow_dispatch: + +concurrency: + group: flue-deploy-production + cancel-in-progress: false + +jobs: + deploy: + if: github.repository == 'cloudflare/cloudflare-docs' + name: Deploy + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + + - name: Set up pnpm + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5 + with: + version: 11 + + - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + with: + node-version: 24.x + cache: pnpm + cache-dependency-path: .flue/pnpm-lock.yaml + + - name: Install dependencies + run: pnpm install --frozen-lockfile + working-directory: .flue + + - name: Build + run: pnpm run flue:build + + - name: Deploy + run: pnpm run flue:deploy + env: + CLOUDFLARE_API_TOKEN: ${{ secrets.FLUE_DEPLOY_TOKEN }} + + - name: Notify Google Chat on failure + if: failure() + env: + WEBHOOK_URL: ${{ secrets.CED_TEAM_ALERTS_CHANNEL_WEBHOOK }} + ACTOR: ${{ github.actor }} + REPO: ${{ github.repository }} + RUN_ID: ${{ github.run_id }} + run: | + MESSAGE="❌ *Flue Deploy* workflow failed.\nActor: $ACTOR\n" + JSON_PAYLOAD=$(jq -n --arg text "$MESSAGE" '{text: $text}') + + curl -X POST "$WEBHOOK_URL" \ + -H "Content-Type: application/json" \ + -d "$JSON_PAYLOAD" diff --git a/package.json b/package.json index f0f1d88a636..dbf98d107a6 100644 --- a/package.json +++ b/package.json @@ -32,7 +32,7 @@ "flue:dev": "NODE_OPTIONS=--max-old-space-size=8192 pnpm --dir .flue exec vite dev", "flue:dev:wrangler": "pnpm --dir .flue exec vite build && cp -f .flue/.env.local .flue/dist/cloudflare_docs_flue/.dev.vars && pnpm --dir .flue exec wrangler dev --config dist/cloudflare_docs_flue/wrangler.json --remote", "flue:build": "pnpm --dir .flue exec vite build", - "flue:deploy": "pnpm run flue:build && pnpm --dir .flue exec wrangler deploy --config dist/cloudflare_docs_flue/wrangler.json --secrets-file .env", + "flue:deploy": "pnpm run flue:build && pnpm --dir .flue exec wrangler deploy --config dist/cloudflare_docs_flue/wrangler.json", "flue:clear-r2-pr-data:local": "tsx .flue/bin/clear-r2-pr-data.ts --local", "flue:reset:local": "rm -rf .flue/.wrangler/state .flue/.wrangler/tmp .flue/dist/cloudflare_docs_flue/.wrangler/state && echo 'Cleared local flue dev state (Durable Objects + R2). Stop the dev server before running this.'", "flue:evals": "tsx .flue/bin/run-evals.ts", From e57d09c9311997a66b879158572ed1a8735b43fc Mon Sep 17 00:00:00 2001 From: mvm Date: Fri, 14 Aug 2026 13:49:20 -0500 Subject: [PATCH 2/4] [Flue] List all production secrets in secrets.required --- .flue/wrangler.jsonc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.flue/wrangler.jsonc b/.flue/wrangler.jsonc index 730251ac16a..1a77173b420 100644 --- a/.flue/wrangler.jsonc +++ b/.flue/wrangler.jsonc @@ -191,10 +191,16 @@ }, "secrets": { "required": [ + "DOCS_FLUE_AI_GATEWAY_ID", + "DOCS_FLUE_AI_GATEWAY_AUTH_TOKEN", "DOCS_FLUE_GITHUB_APP_ID", "DOCS_FLUE_GITHUB_APP_PRIVATE_KEY", "DOCS_FLUE_GITHUB_INSTALLATION_ID", "GITHUB_WEBHOOK_SECRET", + "GITHUB_ORG_TOKEN", + "DOCS_FLUE_CF_TOKEN", + "DOCS_FLUE_INTERNAL_TOKEN", + "DOCS_FLUE_REVIEW_MODE", ], }, } From a1397b3b538cca00c4fb1216d0a93de4b69643a6 Mon Sep 17 00:00:00 2001 From: mvm Date: Fri, 14 Aug 2026 14:06:39 -0500 Subject: [PATCH 3/4] [Flue] Rename deploy secret to CLOUDFLARE_DOCS_BOT_FLUE_DEPLOY --- .github/workflows/flue-deploy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/flue-deploy.yml b/.github/workflows/flue-deploy.yml index daa4c44ee2e..eed1c7db705 100644 --- a/.github/workflows/flue-deploy.yml +++ b/.github/workflows/flue-deploy.yml @@ -44,7 +44,7 @@ jobs: - name: Deploy run: pnpm run flue:deploy env: - CLOUDFLARE_API_TOKEN: ${{ secrets.FLUE_DEPLOY_TOKEN }} + CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_DOCS_BOT_FLUE_DEPLOY }} - name: Notify Google Chat on failure if: failure() From 5ebe50069e6c8e944e5265c155509f95990cb6cb Mon Sep 17 00:00:00 2001 From: mvm Date: Fri, 14 Aug 2026 14:17:07 -0500 Subject: [PATCH 4/4] [Flue] Use existing CLOUDFLARE_API_TOKEN secret for deploy --- .github/workflows/flue-deploy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/flue-deploy.yml b/.github/workflows/flue-deploy.yml index eed1c7db705..885ead387f0 100644 --- a/.github/workflows/flue-deploy.yml +++ b/.github/workflows/flue-deploy.yml @@ -44,7 +44,7 @@ jobs: - name: Deploy run: pnpm run flue:deploy env: - CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_DOCS_BOT_FLUE_DEPLOY }} + CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} - name: Notify Google Chat on failure if: failure()