feat: add --force to cf deploy for CI conflict overrides by penalosa · Pull Request #163 · cloudflare/cf

penalosa · 2026-10-01T11:34:13Z

Summary

Add --force (-f) to cf deploy so CI deployments can proceed despite conflicting remote Worker changes. Deployments stay strict by default, and aborted uploads recommend cf deploy --force without printing a success message.

Forced real uploads warn on stderr, including with --quiet; dry runs omit the warning. Successful uploads without a version ID remain successful, and abort detection isolates pre-existing process exit codes. Version creation remains strict. Typed metadata, generated command catalogs, regression tests, and a minor changeset are included.

Addresses #69.

Dependencies

Updated onto current main and replaced the deploy-helpers preview with the released @cloudflare/deploy-helpers@0.26.0, which includes strictModeAbortMessage from cloudflare/workers-sdk#16020. Removed the temporary sibling overrides and preview documentation. All dependency manifests, the lockfile, and cleanup patches now match main.

Validation

Exact root pnpm check passes: generation, builds, workspace type checks, lint, and formatting.
180 focused tests pass across deployment, version upload, deploy-input conversion, command metadata, previews, and triggers.
Regenerated metadata reviewed; only the two expected command catalogs differ from main. git diff --check passes.
GitHub CI runs on the updated head before merge.

pkg-pr-new · 2026-10-01T11:35:17Z

npm i https://pkg.pr.new/cf@163

commit: 5141199

github-actions · 2026-10-01T11:36:43Z

`cf --help` startup

	mean	stddev	min	max
PR	174.8 ms	3.1 ms	169.5 ms	180.7 ms
base	180.0 ms	8.7 ms	171.2 ms	211.4 ms

Δ (PR vs base): ↓ -5.2 ms (-2.9%)

Measured with hyperfine on ubuntu-latest (3 warmup runs, 20 timed runs). CI numbers carry ±a few ms of runner jitter; treat small deltas as noise.

ask-bonk · 2026-10-01T11:37:23Z

🤖 I've done a thorough review of your PR.

Adds --force support for deploy conflict overrides and updates metadata/tests.

Blocking: Posted one inline suggestion: successful deploys may legitimately return versionId: null, so the new null check can report failure after an upload completes.

github run

ask-bonk · 2026-10-02T11:21:11Z

🤖 I've done a thorough review of your PR.

Adds --force to cf deploy with metadata and CI conflict coverage.

Clarity: Posted a suggestion to avoid an overwrite warning during --dry-run, which cannot upload.

github run

ask-bonk · 2026-10-02T11:29:24Z

🤖 I've done a thorough review of your PR.

Adds cf deploy --force conflict overrides with metadata and coverage.

Warning: Posted one inline suggestion to correct the changeset’s unsupported strict-abort guidance claim.

github run

ask-bonk · 2026-10-05T11:07:42Z

No new concerns since the last review

github run

ask-bonk · 2026-10-05T11:23:05Z

No new concerns since the last review

github run

ask-bonk · 2026-10-05T13:56:04Z

No new concerns since the last review

github run

ask-bonk · 2026-11-04T13:59:57Z

LGTM

github run

ask-bonk · 2026-11-04T16:13:08Z

LGTM

github run

clanky-the-clanker

Superseded by the review of 1d1c4ca5.

This review, of b3ea6520

💬 Approved with comments — The --force flag is wired in correctly and covered by tests. There are only two INFO notes: abort detection reads process.exitCode, and deploy-helpers comes from a commit-pinned preview build.

Findings: 2 info (2 are inline comments on the diff)

_{The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.}

🔒 Security: 💬 1 info

Low risk. --force is an explicit opt-in that prints a warning. A production dependency now comes from a preview build.

Recommendation: 💬 Optional Nits

[INFO] The production dependency @cloudflare/deploy-helpers now comes from a commit-pinned pkg.pr.new preview build instead of the npm registry. (packages/cli/package.json:87)

View full review

strict: !argv.force keeps deploys strict by default, and a forced real upload warns on stderr. I found no auth bypass or injection.
@cloudflare/deploy-helpers moves from an npm release to a pkg.pr.new tarball. The tarball is pinned to a commit and the lockfile carries its integrity hash, the same approach the repository already uses for Forge. Overrides in pnpm-workspace.yaml keep the sibling packages on their registry releases.

📋 Code Quality: 💬 1 info

The flag is wired in consistently. Strict-abort detection reads process.exitCode, a process-global value, instead of a return value.

Recommendation: 💬 Optional Nits

[INFO] Strict-abort detection depends on deploy-helpers setting process.exitCode = 1 as a side effect. (packages/cli/src/commands/deploy/shared.ts:233)

View full review

Abort detection uses a global (packages/cli/src/commands/deploy/shared.ts:233): the code treats versionId === null && process.exitCode === 1 as a strict-mode abort. If exitCode is already 1 before the upload, a successful upload that returns no version ID would be reported as a failure, and Deploy complete would not be printed.

Checked and found fine:

-f does not clash with any reserved global alias.
force exists only on cf deploy.
The warning is skipped for --dry-run and still printed with --quiet.
The metadata sidecar and the generated catalogs match.

✅ All other checks passed

🚀 Release: ✅ LGTM

Risk: Low. The minor changeset fits a new flag.

📖 AGENTS.md: ✅ LGTM

No issues found.

⚡ Performance: ✅ LGTM

No performance concerns.

📝 Documentation: ✅ LGTM

No documentation issues.

_{Reviewed commit: b3ea6520}

ask-bonk · 2026-11-04T16:24:46Z

LGTM!

github run

clanky-the-clanker

Superseded by the review of a722ab54.

This review, of 1d1c4ca5

✅ Approved — No findings. The --force flag is wired in correctly, and both earlier notes are settled: the exit-code fix in 1d1c4ca resolves the first, and the commit-pinned preview dependency is intentional and documented.

_{The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.}

✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low. The minor changeset fits a new flag.

🔒 Security: ✅ LGTM

Deploys stay strict by default, and turning strict mode off requires an explicit --force. The commit-pinned preview dependency is pinned by commit SHA and lockfile integrity, and its removal is documented.

📖 AGENTS.md: ✅ LGTM

No issues found.

📋 Code Quality: ✅ LGTM

Strict-abort detection now uses only the exit code set during the helper call. The earlier exit code is saved and cleared before the call and restored in finally, and CliExit(1) is thrown after the finally block, so Deploy complete is not printed on an abort.

⚡ Performance: ✅ LGTM

No performance concerns.

📝 Documentation: ✅ LGTM

No documentation issues.

_{Reviewed commit: 1d1c4ca5}

clanky-the-clanker

Superseded by the review of 5141199a.

This review, of a722ab54

✅ Approved — No findings. Since the last approval only the dependency pin changed, and it is pinned by commit SHA and lockfile integrity. The --force behaviour, abort handling and exit-code handling are still correct.

_{The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.}

✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low. A minor changeset is the right level for a new flag.

🔒 Security: ✅ LGTM

--force is opt-in and only applies to cf deploy, and a forced upload prints a warning to stderr. The preview dependency is pinned by commit SHA and lockfile integrity, and the scoped overrides keep the sibling packages on their released npm versions.

📖 AGENTS.md: ✅ LGTM

No issues found.

📋 Code Quality: ✅ LGTM

The deploy-helpers preview is pinned by full commit SHA and lockfile integrity, and the existing patch is still applied to it. Strict-abort detection uses only the exit code set during the helper call, restores any earlier exit code, and throws CliExit(1) without printing Deploy complete. --force is wired through the builder, the metadata, the generated catalogs and deploy-input.ts.

⚡ Performance: ✅ LGTM

No performance concerns.

📝 Documentation: ✅ LGTM

No documentation issues in the changed files. The flag is published in the command metadata and the generated catalogs, and docs/architecture.md records when the temporary overrides will be removed.

_{Reviewed commit: a722ab54}

ask-bonk · 2026-11-04T21:07:12Z

LGTM

github run

clanky-the-clanker

✅ Approved — No findings. Since the last approval, the only change is the switch from the preview build to the released deploy-helpers 0.26.0, and the forced-deploy, abort and exit-code handling are still correct.

_{The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.}

✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low. A minor changeset is the right level for a new flag.

🔒 Security: ✅ LGTM

--force is opt-in, applies only to cf deploy, and a forced upload prints a warning to stderr. The runtime dependency now comes from a released npm version.

📖 AGENTS.md: ✅ LGTM

No issues found.

📋 Code Quality: ✅ LGTM

--force/-f is wired through the builder, the metadata, the generated catalogs and deploy-input.ts. Abort detection clears and then restores the earlier exit code, so an upload that succeeds without a version ID is still a success, and a real abort is still caught when the exit code was already 1. Tests cover these cases.

⚡ Performance: ✅ LGTM

No performance concerns.

📝 Documentation: ✅ LGTM

The flag appears in the command metadata and in the generated catalogs.

_{Reviewed commit: 5141199a}

ask-bonk · 2026-11-05T18:00:15Z

LGTM!

github run

ask-bonk Bot reviewed Oct 1, 2026

View reviewed changes

Comment thread packages/cli/src/commands/deploy/shared.ts Resolved

ask-bonk Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread packages/cli/src/commands/deploy/index.ts Resolved

ask-bonk Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread .changeset/force-deploy-conflicts.md Resolved

petebacondarwin force-pushed the investigate/issue-69 branch from 7eae8ac to 67e9976 Compare October 5, 2026 11:05

petebacondarwin force-pushed the investigate/issue-69 branch from 67e9976 to 7dda200 Compare October 5, 2026 11:20

petebacondarwin force-pushed the investigate/issue-69 branch from 7dda200 to c616bc5 Compare October 5, 2026 13:53

petebacondarwin requested review from a team and edmundhung and removed request for a team October 23, 2026 13:00

petebacondarwin force-pushed the investigate/issue-69 branch from c616bc5 to 0d833f8 Compare November 4, 2026 13:57

petebacondarwin mentioned this pull request Nov 4, 2026

[deploy-helpers] Allow custom strict conflict abort messages cloudflare/workers-sdk#16020

Merged

2 of 5 tasks

petebacondarwin added the blocked label Nov 4, 2026

petebacondarwin force-pushed the investigate/issue-69 branch from 0d833f8 to b3ea652 Compare November 4, 2026 16:11

petebacondarwin marked this pull request as ready for review November 4, 2026 16:11

clanky-the-clanker Bot reviewed Nov 4, 2026

View reviewed changes

Comment thread packages/cli/package.json Resolved

Comment thread packages/cli/src/commands/deploy/shared.ts Resolved

clanky-the-clanker Bot reviewed Nov 4, 2026

View reviewed changes

petebacondarwin approved these changes Nov 4, 2026

View reviewed changes

feat: allow forced deploy over remote conflicts

6d9c6bd

penalosa and others added 5 commits November 4, 2026 21:02

fix: distinguish strict abort from null version deploy

0f1e516

fix: preserve reviewed deploy behavior after rebase

f732bfc

fix: preserve deploy conflict behavior on current main

f0167a8

fix: use cf guidance for strict deploy conflicts

aa14d00

fix: isolate deploy abort exit codes

a722ab5

petebacondarwin force-pushed the investigate/issue-69 branch from 1d1c4ca to a722ab5 Compare November 4, 2026 21:04

clanky-the-clanker Bot reviewed Nov 4, 2026

View reviewed changes

chore: use released deploy dependencies

5141199

clanky-the-clanker Bot reviewed Nov 5, 2026

View reviewed changes

petebacondarwin removed the blocked label Nov 5, 2026

petebacondarwin enabled auto-merge November 5, 2026 18:02

petebacondarwin added this pull request to the merge queue Nov 5, 2026

Merged via the queue into main with commit 4fc2294 Nov 5, 2026
12 checks passed

petebacondarwin deleted the investigate/issue-69 branch November 5, 2026 18:11

edmundhung mentioned this pull request Nov 6, 2026

feat: add --secrets-file to cf previews deploy #537

Draft

Conversation

penalosa commented Oct 1, 2026 • edited by petebacondarwin Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Dependencies

Validation

Uh oh!

pkg-pr-new Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

cf --help startup

Uh oh!

Uh oh!

ask-bonk Bot commented Oct 1, 2026

Uh oh!

Uh oh!

ask-bonk Bot commented Oct 2, 2026

Uh oh!

Uh oh!

ask-bonk Bot commented Oct 2, 2026

Uh oh!

ask-bonk Bot commented Oct 5, 2026

Uh oh!

ask-bonk Bot commented Oct 5, 2026

Uh oh!

ask-bonk Bot commented Oct 5, 2026

Uh oh!

ask-bonk Bot commented Nov 4, 2026

Uh oh!

ask-bonk Bot commented Nov 4, 2026

Uh oh!

clanky-the-clanker Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

🔒 Security: 💬 1 info

📋 Code Quality: 💬 1 info

🚀 Release: ✅ LGTM

📖 AGENTS.md: ✅ LGTM

⚡ Performance: ✅ LGTM

📝 Documentation: ✅ LGTM

Uh oh!

Uh oh!

Uh oh!

ask-bonk Bot commented Nov 4, 2026

Uh oh!

clanky-the-clanker Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

🚀 Release: ✅ LGTM

🔒 Security: ✅ LGTM

📖 AGENTS.md: ✅ LGTM

📋 Code Quality: ✅ LGTM

⚡ Performance: ✅ LGTM

📝 Documentation: ✅ LGTM

Uh oh!

clanky-the-clanker Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

🚀 Release: ✅ LGTM

🔒 Security: ✅ LGTM

📖 AGENTS.md: ✅ LGTM

📋 Code Quality: ✅ LGTM

⚡ Performance: ✅ LGTM

📝 Documentation: ✅ LGTM

Uh oh!

ask-bonk Bot commented Nov 4, 2026

Uh oh!

clanky-the-clanker Bot left a comment

Choose a reason for hiding this comment

🚀 Release: ✅ LGTM

🔒 Security: ✅ LGTM

📖 AGENTS.md: ✅ LGTM

📋 Code Quality: ✅ LGTM

⚡ Performance: ✅ LGTM

📝 Documentation: ✅ LGTM

Uh oh!

ask-bonk Bot commented Nov 5, 2026

Uh oh!

penalosa commented Oct 1, 2026 •

edited by petebacondarwin

Loading

pkg-pr-new Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

`cf --help` startup

clanky-the-clanker Bot left a comment •

edited

Loading

clanky-the-clanker Bot left a comment •

edited

Loading

clanky-the-clanker Bot left a comment •

edited

Loading