Skip to content

Repository navigation

Document required Cloudflare metadata read access #319

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
admdly merged 1 commit into from
Nov 14, 2026
Merged

Document required Cloudflare metadata read access #319

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 10 additions & 21 deletions services/api/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,11 +203,16 @@ Migration jobs serialize access to the shared staging databases.
repository secret from branch workflows. Fork PR runs do not receive the
deployment token.

Scope the token to the API Worker and its zone. It needs
`Individual Workers Editor` for that Worker, `Workers Routes Write` for route changes, `D1 Read`
and `D1 Write` for migrations, and `Queues Read` and `Queues Write` to configure
the existing consumer.
The Worker permission covers both production and Previews. Separate staging data
The token needs `Individual Workers Editor` for the API Worker,
`Workers Routes Write` for its zone, `D1 Read` and `D1 Write` for migrations,
and `Queues Read` and `Queues Write` to configure the existing consumer.
Also grant `Workers Content Read-Only` at the Workers product scope in the
FOSSBilling account: Wrangler's configuration comparison after dashboard edits
reads account-level Custom Domain metadata, which does not support per-Worker
roles. This grants read access to Worker source and configuration across the
account; Worker write access remains restricted to the API Worker.
See [Cloudflare's Workers permissions](https://developers.cloudflare.com/workers/authorization/workers/).
The Worker edit permission covers both production and Previews. Separate staging data
and runtime secrets isolate test state, not the deployment credential's authority.

If branch writers must not have production deployment authority, use protected
Expand Down Expand Up @@ -273,19 +278,3 @@ before running `npm run cf-preview`; CI performs those steps automatically.
`npm run cf-deploy` remains a deliberate manual production command. It applies remote
migrations and deploys through Wrangler. Neither command deploys the separate
[extension packager](../extension-packager/README.md). Production packaging remains disabled.

A dashboard change can trigger Wrangler's remote configuration comparison. If its
custom-domain metadata lookup returns 403 with the Worker-scoped CI token, use a
one-off local-auth deployment rather than broadening the token. Build artifacts
expire after one day; after expiry, rerun the full CI workflow to rebuild them.
After validation, build and migrations pass, unset `CLOUDFLARE_API_TOKEN` locally.
Use an existing Wrangler OAuth login to deploy that `main` run's artifact (replace `RUN_ID`):

```sh
gh run download RUN_ID --name api-worker-build --dir .wrangler/deployment
npx wrangler deploy --config .wrangler/deployment/wrangler.json --keep-vars
```

Download into an empty directory, keep `EXTENSION_PACKAGES_MODE=disabled`, then
rerun the failed CI deployment job. Further dashboard changes can trigger the same
comparison again.
Loading