secondsky/claude-skills/plugins-cloudflare-workers-skills-cloudflare-workers-ci-cd

api-token

# ❌ OLD (v3)
- uses: cloudflare/wrangler-action@3
  with:
    apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}

# ✅ NEW (v4)
- uses: cloudflare/wrangler-action@v4
  with:
    api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}

name: Deploy

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    name: Deploy to Cloudflare Workers

    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - run: bun install

      - run: bun test

      - name: Deploy
        uses: cloudflare/wrangler-action@v4
        with:
          api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          command: deploy

git add .github/workflows/deploy.yml
git commit -m "Add CI/CD pipeline"
git push

# Use GitHub Secrets
api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}

# ❌ NEVER hardcode tokens
api-token: "abc123def456..."

- run: bun test  # ✅ Tests run first

- name: Deploy
  uses: cloudflare/wrangler-action@v4
  with:
    api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}

# ❌ Skipping tests
- name: Deploy
  uses: cloudflare/wrangler-action@v4
  # No tests!

# Production (main branch)
- name: Deploy to Production
  if: github.ref == 'refs/heads/main'
  run: bunx wrangler deploy --env production

# Staging (other branches)
- name: Deploy to Staging
  if: github.ref != 'refs/heads/main'
  run: bunx wrangler deploy --env staging

# ❌ Always deploying to production
- run: bunx wrangler deploy

- name: Deploy
  id: deploy
  uses: cloudflare/wrangler-action@v4

- name: Verify Deployment
  run: |
    curl -f https://your-worker.workers.dev/health || exit 1

# ❌ No verification
- name: Deploy
  uses: cloudflare/wrangler-action@v4
  # Assuming it worked...

deploy-production:
  environment:
    name: production
    url: https://your-worker.workers.dev
  # Requires manual approval

# ❌ Auto-deploy to production without review
deploy-production:
  runs-on: ubuntu-latest

{
  "name": "my-worker",
  "main": "src/index.ts",

  "env": {
    "production": {
      "name": "my-worker-production",
      "vars": {
        "ENVIRONMENT": "production"
      }
    },
    "staging": {
      "name": "my-worker-staging",
      "vars": {
        "ENVIRONMENT": "staging"
      }
    }
  }
}

# Local development
wrangler secret put DATABASE_URL

# CI/CD (via GitHub Actions)
bunx wrangler secret put DATABASE_URL --env production <<< "${{ secrets.DATABASE_URL }}"

- name: Deploy Preview
  uses: cloudflare/wrangler-action@v4
  with:
    api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
    command: deploy --env preview-${{ github.event.number }}

name: Deploy Production

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
      - run: bun install
      - run: bun test
      - run: bun run build

      - name: Deploy to Production
        uses: cloudflare/wrangler-action@v4
        with:
          api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          command: deploy --env production

name: Preview

on:
  pull_request:
    branches: [main]

jobs:
  preview:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
      - run: bun install
      - run: bun test

      - name: Deploy Preview
        id: deploy
        uses: cloudflare/wrangler-action@v4
        with:
          api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          command: deploy --env preview-${{ github.event.number }}

      - name: Comment PR
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '✅ Preview deployed to: https://my-worker-preview-${{ github.event.number }}.workers.dev'
            })

name: Test

on:
  push:
    branches: ['**']
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
      - run: bun install
      - run: bun test --coverage

      - name: Upload Coverage
        uses: codecov/codecov-action@v4
        with:
          files: ./coverage/lcov.info

name: Deploy Production (Manual Approval)

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://my-worker.workers.dev
    # Requires manual approval in GitHub Settings

    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
      - run: bun install
      - run: bun test

      - name: Deploy
        uses: cloudflare/wrangler-action@v4
        with:
          api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          command: deploy --env production

name: Canary Deployment

on:
  workflow_dispatch:
    inputs:
      percentage:
        description: 'Traffic percentage to new version'
        required: true
        default: '10'

jobs:
  canary:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
      - run: bun install

      # Deploy to canary environment
      - name: Deploy Canary
        uses: cloudflare/wrangler-action@v4
        with:
          api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          command: deploy --env canary

      # Configure traffic split via Cloudflare API
      # (See references/deployment-strategies.md for full example)

Use semantic commit messages:

feat: add user authentication
fix: resolve rate limiting issue
chore: update dependencies

Run linting and type checking:

- run: bun run lint
- run: bun run type-check
- run: bun test

Cache dependencies:

- uses: oven-sh/setup-bun@v2
  with:
    bun-version: latest
# Bun automatically caches dependencies

Deploy different branches to different environments:

- name: Deploy
  run: |
    if [ "${{ github.ref }}" == "refs/heads/main" ]; then
      bunx wrangler deploy --env production
    else
      bunx wrangler deploy --env staging
    fi

Monitor deployments:

- name: Notify Slack
  if: failure()
  uses: slackapi/slack-github-action@v1
  with:
    payload: |
      {"text": "Deployment failed: ${{ github.sha }}"}

- name: Set Secrets
  run: |
    echo "${{ secrets.DATABASE_URL }}" | bunx wrangler secret put DATABASE_URL --env production

- uses: oven-sh/setup-bun@v2
  with:
    bun-version: latest # Lock version

- run: bun install --frozen-lockfile # Use exact versions

command: deploy --env preview-${{ github.event.number }}

# ❌ WRONG
- run: echo "Token: ${{ secrets.API_TOKEN }}"

# ✅ CORRECT
- run: echo "Deploying..." # No secrets in output

cloudflare-workers-ci-cd

Summary

SKILL.md

Cloudflare Workers CI/CD

Table of Contents

What Is Workers CI/CD?

New in 2025

Quick Start (10 Minutes)

GitHub Actions Setup

Critical Rules

1. Never Commit Secrets to Git

2. Always Run Tests Before Deploy

3. Use Different Environments

4. Verify Deployment Success

5. Use Deployment Gates for Production

Core Concepts

Multi-Environment Strategy

Secrets Management

Preview Deployments

Top 5 Use Cases

1. Deploy on Push to Main

2. Preview Deployments for PRs

3. Run Tests on Every Commit

4. Deploy with Approval Gate

5. Staged Rollout (Canary)

Best Practices

✅ DO

❌ DON'T

Top 7 Errors Prevented

1. ❌ `Error: A valid Cloudflare API token is required`

2. ❌ `Error: Not enough permissions to deploy`

3. ❌ `Error: wrangler.toml not found`

4. ❌ Deployment succeeds but worker doesn't work

5. ❌ Tests pass locally but fail in CI

6. ❌ Preview deployments conflict

7. ❌ Secrets exposed in logs

When to Load References

Secure Installation

Related Cloudflare Plugins

Related skills

cloudflare-workers-ci-cd

Summary

Cloudflare Workers CI/CD

Table of Contents

What Is Workers CI/CD?

New in 2025

Quick Start (10 Minutes)

GitHub Actions Setup

Critical Rules

1. Never Commit Secrets to Git

2. Always Run Tests Before Deploy

3. Use Different Environments

4. Verify Deployment Success

5. Use Deployment Gates for Production

Core Concepts

Multi-Environment Strategy

Secrets Management

Preview Deployments

Top 5 Use Cases

1. Deploy on Push to Main

2. Preview Deployments for PRs

3. Run Tests on Every Commit

4. Deploy with Approval Gate

5. Staged Rollout (Canary)

Best Practices

✅ DO

❌ DON'T

Top 7 Errors Prevented

1. ❌ Error: A valid Cloudflare API token is required

2. ❌ Error: Not enough permissions to deploy

3. ❌ Error: wrangler.toml not found

4. ❌ Deployment succeeds but worker doesn't work

5. ❌ Tests pass locally but fail in CI

6. ❌ Preview deployments conflict

7. ❌ Secrets exposed in logs

When to Load References

Secure Installation

Related Cloudflare Plugins

Related skills

1. ❌ `Error: A valid Cloudflare API token is required`

2. ❌ `Error: Not enough permissions to deploy`

3. ❌ `Error: wrangler.toml not found`