feat(worker): audit-trail pause for auth_tokens #47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Worker | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'worker/**' | |
| - '.github/workflows/deploy-worker.yml' | |
| workflow_dispatch: | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| name: Deploy mails-worker | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| - name: Install dependencies | |
| run: cd worker && bun install | |
| - name: Inject D1 database ID | |
| env: | |
| D1_ID: ${{ secrets.D1_DATABASE_ID }} | |
| run: sed -i "s/YOUR_D1_DATABASE_ID/${D1_ID}/" worker/wrangler.toml | |
| - name: Ensure Vectorize index exists | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| run: | | |
| cd worker | |
| npx wrangler vectorize create mails-embeddings --dimensions 768 --metric cosine 2>&1 || echo "Vectorize index already exists or creation skipped" | |
| - name: Apply D1 schema migrations | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| run: | | |
| set -o pipefail | |
| cd worker | |
| # Normalize legacy hosted DBs first. CREATE TABLE IF NOT EXISTS does | |
| # not add columns to existing tables, so old auth_tokens/domains/emails | |
| # tables must be brought up to shape before schema indexes are applied. | |
| bash scripts/ensure-schema-compat.sh mails | |
| # Run base schema (CREATE TABLE IF NOT EXISTS is idempotent) | |
| npx wrangler d1 execute mails --file=schema.sql --remote | |
| # Run each migration with error tolerance (ALTER TABLE is not idempotent | |
| # in D1, so "duplicate column" errors are expected on existing DBs) | |
| for migration in migrations/*.sql; do | |
| if [ -f "$migration" ]; then | |
| echo "Applying $migration..." | |
| npx wrangler d1 execute mails --file="$migration" --remote 2>&1 | tee /tmp/migration.log || { | |
| if grep -q "duplicate column name" /tmp/migration.log; then | |
| echo " Column already exists — skipping (expected for existing DB)" | |
| else | |
| echo " Migration failed with unexpected error" | |
| cat /tmp/migration.log | |
| exit 1 | |
| fi | |
| } | |
| fi | |
| done | |
| - name: Deploy to Cloudflare Workers | |
| uses: cloudflare/wrangler-action@v3 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| workingDirectory: worker | |
| - name: Post-deploy smoke test | |
| # Wait briefly for the new Worker version to propagate, then run the | |
| # integration smoke test. This catches deploy-breaking config issues | |
| # that unit tests can't (e.g. missing secrets, schema drift, routing bugs). | |
| # If this fails, the whole deploy is marked failed so you notice. | |
| run: | | |
| sleep 10 | |
| chmod +x test/integration/api-smoke.sh | |
| WORKER_URL=https://api.mails0.com \ | |
| CLAIM_URL=https://mails0.com \ | |
| ./test/integration/api-smoke.sh |