Skip to content
MNPPI on GitHub

Cloudflare deployment

Status
Current
Reviewed
July 23, 2026
Cadence
Review after a Cloudflare build change

Cloudflare Workers Builds owns the normal production build and deployment. GitHub Actions must not duplicate that production action.

  • The actual default branch is the production source.
  • Pull requests can create preview builds.
  • A failed Cloudflare build cannot change production.
  • Cloudflare records the deployed commit and build result.
  • GitHub keeps merge checks and Cloudflare keeps deployment checks.

Use pnpm --dir site build. Set the output directory to site/dist. Configure Workers Static Assets for that directory.

Use Static Assets for files that do not require server code. Do not invoke a Worker for every asset request.

If a project uses assets.run_worker_first, list only the dynamic route patterns. Verify that document, script, style, image, and font requests bypass Worker code.

Use Cloudflare bindings for D1, R2, KV, Queues, Durable Objects, and other services. Generate Wrangler binding types when a Worker uses TypeScript.

Keep secret values in the Cloudflare environment. Keep only secret names and value-free wiring in the repository.

The lockfile must support a frozen, tokenless installation for public packages. Use pnpm install --frozen-lockfile without --trust-lockfile. Do not set trustLockfile: true in pnpm-workspace.yaml. These options disable pnpm’s lockfile supply-chain verification.

Run a repository-owned cf:check command in GitHub CI before merge. The command must build the deployable output and run wrangler deploy --dry-run.

The Cloudflare build must not depend on a developer workstation. Keep Cloudflare Workers Builds limited to the real post-merge build and deploy.