From fb202f37f323deebf96f78d71a7ca936126efe92 Mon Sep 17 00:00:00 2001
From: Drew Hess <src@drewhess.com>
Date: Mon, 27 Apr 2026 03:17:08 +0100
Subject: [PATCH] ci: deploy to Cloudflare on merges to `main`

Signed-off-by: Drew Hess <src@drewhess.com>
---
 .buildkite/dist.yaml                      | 17 +++++++++++++
 flake.nix                                 |  6 ++++-
 nix/pkgs/deploy-to-cloudflare/default.nix | 31 +++++++++++++++++++++++
 wrangler.toml                             |  4 +++
 4 files changed, 57 insertions(+), 1 deletion(-)
 create mode 100644 .buildkite/dist.yaml
 create mode 100644 nix/pkgs/deploy-to-cloudflare/default.nix
 create mode 100644 wrangler.toml

diff --git a/.buildkite/dist.yaml b/.buildkite/dist.yaml
new file mode 100644
index 000000000..1e6a34b72
--- /dev/null
+++ b/.buildkite/dist.yaml
@@ -0,0 +1,17 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/agent-stack-k8s/main/cmd/linter/schema.json
+
+agents:
+  queue: kubernetes
+
+steps:
+  - command: |
+      set -euo pipefail
+
+      nix run --print-build-logs --no-update-lock-file .#deploy-to-cloudflare -- wrangler.toml
+    label: ":kubernetes: :nixos: :cloudflare: Deploy alpha.primer.dev"
+    concurrency: 1
+    concurrency_group: primer-dist/deploy
+    concurrency_method: ordered
+    plugins:
+      - kubernetes:
+          podTemplate: nix-ci-template
diff --git a/flake.nix b/flake.nix
index 6af0d24c7..6e37f435d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -190,6 +190,7 @@
 
           packages = {
             inherit (pkgs)
+              deploy-to-cloudflare
               primer-benchmark
               primer-miso-build-frontend
               primer-miso-dist
@@ -255,7 +256,7 @@
               };
             in
             (pkgs.lib.mapAttrs (name: pkg: mkApp pkg name) {
-              inherit (pkgs) primer-benchmark primer-miso-build-frontend;
+              inherit (pkgs) deploy-to-cloudflare primer-benchmark primer-miso-build-frontend;
             })
             // primerFlake.apps;
 
@@ -520,6 +521,8 @@
                     primer-miso-wasm = primerFlake.packages."wasm32-unknown-wasi:primer-miso:exe:primer-miso";
                   };
 
+                  deploy-to-cloudflare = final.callPackage ./nix/pkgs/deploy-to-cloudflare { };
+
                   # Note: these benchmarks should only be run (in CI) on a
                   # "benchmark" machine. This is enforced for our CI system
                   # via Nix's `requiredSystemFeatures`.
@@ -559,6 +562,7 @@
                   primer-benchmark = primerFlake.packages."primer-benchmark:bench:primer-benchmark";
 
                   inherit
+                    deploy-to-cloudflare
                     primer-miso-build-frontend
                     primer-miso-dist
                     primer-miso-frontend-tools
diff --git a/nix/pkgs/deploy-to-cloudflare/default.nix b/nix/pkgs/deploy-to-cloudflare/default.nix
new file mode 100644
index 000000000..1919d2bc3
--- /dev/null
+++ b/nix/pkgs/deploy-to-cloudflare/default.nix
@@ -0,0 +1,31 @@
+{ nix
+, wrangler
+, writeShellApplication
+,
+}:
+
+writeShellApplication {
+  name = "deploy-to-cloudflare";
+
+  runtimeInputs = [
+    nix
+    wrangler
+  ];
+
+  text = ''
+    if [ "$#" -ne 1 ]; then
+      echo "Usage: deploy-to-cloudflare <wrangler-config>" >&2
+      exit 2
+    fi
+
+    wrangler_config="$1"
+
+    if [ ! -f "$wrangler_config" ]; then
+      echo "Wrangler config not found: $wrangler_config" >&2
+      exit 1
+    fi
+
+    dist_path="$(nix build --print-build-logs --no-update-lock-file --no-link --print-out-paths .#primer-miso-dist)"
+    wrangler deploy --config "$wrangler_config" --assets "$dist_path" --keep-vars
+  '';
+}
diff --git a/wrangler.toml b/wrangler.toml
new file mode 100644
index 000000000..fb6fc9435
--- /dev/null
+++ b/wrangler.toml
@@ -0,0 +1,4 @@
+name = "alpha-primer-dev"
+account_id = "6739145754f7a86d724aa208fdc42422"
+compatibility_date = "2026-04-27"
+workers_dev = false