---
title: "Cloudflare deployment"
description: "Use Workers Builds for normal production builds and deploy static or dynamic applications through Cloudflare."
url: "https://architecture.mnppi.org/delivery/cloudflare-deployment/"
status: "Current"
last_updated: "2026-07-23"
---

# Cloudflare deployment

**Standard details**

- Status: Current
- Reviewed: July 23, 2026
- Cadence: Review after a Cloudflare build change

Cloudflare Workers Builds owns the normal production build and deployment.
GitHub Actions must not duplicate that production action.

## Branch contract

- The actual default branch is the production source.
- Pull requests can create preview builds.
- A failed Cloudflare build cannot change production.
- Cloudflare records the deployed commit and build result.
- GitHub keeps merge checks and Cloudflare keeps deployment checks.

## Build commands

### Static reference site

Use `pnpm --dir site build`.
Set the output directory to `site/dist`.
Configure Workers Static Assets for that directory.

### Worker application

Run the production application build.
Then use Wrangler through Workers Builds.
Keep bindings in the Wrangler configuration.

### Database application

Validate migrations before merge.
Apply production migrations in the controlled Cloudflare deployment path.
Stop the deployment when a required migration fails.

## Static delivery

Use Static Assets for files that do not require server code.
Do not invoke a Worker for every asset request.

If a project uses `assets.run_worker_first`, list only the dynamic route patterns.
Verify that document, script, style, image, and font requests bypass Worker code.

## Configuration

Use Cloudflare bindings for D1, R2, KV, Queues, Durable Objects, and other services.
Generate Wrangler binding types when a Worker uses TypeScript.

Keep secret values in the Cloudflare environment.
Keep only secret names and value-free wiring in the repository.

## Build parity

The lockfile must support a frozen, tokenless installation for public packages.
Use `pnpm install --frozen-lockfile` without `--trust-lockfile`.
Do not set `trustLockfile: true` in `pnpm-workspace.yaml`.
These options disable pnpm's lockfile supply-chain verification.

Run a repository-owned `cf:check` command in GitHub CI before merge.
The command must build the deployable output and run `wrangler deploy --dry-run`.

The Cloudflare build must not depend on a developer workstation.
Keep Cloudflare Workers Builds limited to the real post-merge build and deploy.

> **Note — Lightweight release evidence**
>
> The deployed commit, Cloudflare build result, and service health are sufficient for normal projects.
> Add signed artifacts only when a project risk or customer requirement needs them.