Cloudflare deployment
Cloudflare Workers Builds owns the normal production build and deployment. GitHub Actions must not duplicate that production action.
Branch contract
Section titled “Branch contract”- The actual default branch is the production source.
- Pull requests can create preview builds.
- A failed Cloudflare build cannot change production.
- Cloudflare records the deployed commit and build result.
- GitHub keeps merge checks and Cloudflare keeps deployment checks.
Build commands
Section titled “Build commands”Use pnpm --dir site build.
Set the output directory to site/dist.
Configure Workers Static Assets for that directory.
Run the production application build. Then use Wrangler through Workers Builds. Keep bindings in the Wrangler configuration.
Validate migrations before merge. Apply production migrations in the controlled Cloudflare deployment path. Stop the deployment when a required migration fails.
Static delivery
Section titled “Static delivery”Use Static Assets for files that do not require server code. Do not invoke a Worker for every asset request.
If a project uses assets.run_worker_first, list only the dynamic route patterns.
Verify that document, script, style, image, and font requests bypass Worker code.
Configuration
Section titled “Configuration”Use Cloudflare bindings for D1, R2, KV, Queues, Durable Objects, and other services. Generate Wrangler binding types when a Worker uses TypeScript.
Keep secret values in the Cloudflare environment. Keep only secret names and value-free wiring in the repository.
Build parity
Section titled “Build parity”The lockfile must support a frozen, tokenless installation for public packages.
Use pnpm install --frozen-lockfile without --trust-lockfile.
Do not set trustLockfile: true in pnpm-workspace.yaml.
These options disable pnpm’s lockfile supply-chain verification.
Run a repository-owned cf:check command in GitHub CI before merge.
The command must build the deployable output and run wrangler deploy --dry-run.
The Cloudflare build must not depend on a developer workstation. Keep Cloudflare Workers Builds limited to the real post-merge build and deploy.