From 6757b495929b537f10174e5c0788c8c4e798f223 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 18 Apr 2026 13:36:48 +0000 Subject: [PATCH 1/4] Remove unused preview workflow secret Co-authored-by: Kent C. Dodds --- .github/workflows/preview.yml | 30 +++++++++-------------------- docs/contributing/setup-manifest.md | 11 +++++++++++ 2 files changed, 20 insertions(+), 21 deletions(-) diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index d26db25dd4..8ea4510098 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -54,8 +54,7 @@ jobs: name: 🔎 Deploy Preview Resources timeout-minutes: 4 environment: - name: - preview-${{ github.event.pull_request.number || inputs.pr_number || + name: preview-${{ github.event.pull_request.number || inputs.pr_number || github.run_id }} url: ${{ steps.deploy_preview.outputs.url }} if: >- @@ -143,8 +142,7 @@ jobs: CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} CLOUDFLARE_ENV: preview WRANGLER_CONFIG: ${{ steps.resources.outputs.wrangler_config }} - run: - node ./wrangler-env.ts d1 migrations apply APP_DB --remote --config + run: node ./wrangler-env.ts d1 migrations apply APP_DB --remote --config "$WRANGLER_CONFIG" - name: 🧪 Deploy preview mock Workers @@ -344,8 +342,7 @@ jobs: if: steps.deploy_preview.outputs.url != '' env: PREVIEW_URL: ${{ steps.deploy_preview.outputs.url }} - PREVIEW_VERSION_URL: - '${{ steps.deploy_preview.outputs.version_preview_url }}' + PREVIEW_VERSION_URL: "${{ steps.deploy_preview.outputs.version_preview_url }}" WORKER_NAME: ${{ steps.deploy_preview.outputs.worker_name }} MOCK_SUMMARY: ${{ steps.deploy_mocks.outputs.mock_summary }} D1_DATABASE_NAME: ${{ steps.resources.outputs.d1_database_name }} @@ -380,8 +377,7 @@ jobs: uses: actions/github-script@v8.0.0 env: PREVIEW_URL: ${{ steps.deploy_preview.outputs.url }} - PREVIEW_VERSION_URL: - '${{ steps.deploy_preview.outputs.version_preview_url }}' + PREVIEW_VERSION_URL: "${{ steps.deploy_preview.outputs.version_preview_url }}" WORKER_NAME: ${{ steps.deploy_preview.outputs.worker_name }} MOCK_SUMMARY: ${{ steps.deploy_mocks.outputs.mock_comment_summary }} D1_DATABASE_NAME: ${{ steps.resources.outputs.d1_database_name }} @@ -445,15 +441,15 @@ jobs: runs-on: ubuntu-latest name: 🧹 Cleanup Preview Resources timeout-minutes: 4 + permissions: + contents: read + deployments: write if: >- (github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.head.repo.fork == false) || (github.event_name == 'workflow_dispatch' && inputs.action == 'cleanup') - env: - PREVIEW_ENVIRONMENT_GITHUB_TOKEN: - ${{ secrets.PREVIEW_ENVIRONMENT_GITHUB_TOKEN }} steps: - name: 📦 Checkout uses: actions/checkout@v6.0.2 @@ -568,16 +564,8 @@ jobs: set -euo pipefail node tools/ci/preview-resources.ts cleanup --worker-name "$APP_WORKER_NAME" - - name: ℹ️ Skip GitHub preview environment delete - if: >- - always() && env.PREVIEW_ENVIRONMENT_GITHUB_TOKEN == '' - run: > - echo "Skipping GitHub preview environment delete; - PREVIEW_ENVIRONMENT_GITHUB_TOKEN is not configured." - - name: 🏷️ Delete GitHub preview environment - if: >- - always() && env.PREVIEW_ENVIRONMENT_GITHUB_TOKEN != '' + if: always() uses: actions/github-script@v8.0.0 env: EVENT_NAME: ${{ github.event_name }} @@ -585,7 +573,7 @@ jobs: INPUT_TARGET: ${{ inputs.target }} INPUT_PR_NUMBER: ${{ inputs.pr_number }} with: - github-token: ${{ env.PREVIEW_ENVIRONMENT_GITHUB_TOKEN }} + github-token: ${{ github.token }} script: | const eventName = process.env.EVENT_NAME; let envName; diff --git a/docs/contributing/setup-manifest.md b/docs/contributing/setup-manifest.md index 95b0c903c4..88b15f1043 100644 --- a/docs/contributing/setup-manifest.md +++ b/docs/contributing/setup-manifest.md @@ -104,6 +104,10 @@ secrets from `packages/worker/.env`. Configure these GitHub Actions secrets and variables for workflows: +- No dedicated GitHub secret is required for preview-environment cleanup. The + preview workflow deletes GitHub preview environments with the built-in + `GITHUB_TOKEN` and job-scoped `deployments: write` permission. + - `CLOUDFLARE_API_TOKEN` (Workers deploy + D1 edit access on the correct account; also reused for remote AI and Cloudflare API workflows that run with account secrets + skills) @@ -132,6 +136,10 @@ Configure these GitHub Actions secrets and variables for workflows: organization and project **slugs** for source map upload — same values as in the Sentry wizard’s `--org` / `--project` flags) +The preview cleanup job deletes the matching GitHub deployment environment with +the built-in GitHub Actions token. No separate GitHub repository secret is +required for that step. + How to get/set each value: - `CLOUDFLARE_API_TOKEN` @@ -215,3 +223,6 @@ Preview deploys for pull requests create a separate Worker per PR named `-pr-` (for kody: `kody-pr-123`) plus one Worker per mock service named `-pr--mock-`. The same `CLOUDFLARE_API_TOKEN` must be able to create/update and delete those Workers. +The preview cleanup job also deletes the matching GitHub environment +(`preview-`) with the workflow's built-in `GITHUB_TOKEN`, so no +extra GitHub repository secret is needed for that step. From b95fa09735ccc619ed3f0641b640491fc2fa6482 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 18 Apr 2026 13:45:25 +0000 Subject: [PATCH 2/4] Remove retrospective workflow secret docs Co-authored-by: Kent C. Dodds --- docs/contributing/setup-manifest.md | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/docs/contributing/setup-manifest.md b/docs/contributing/setup-manifest.md index 88b15f1043..95b0c903c4 100644 --- a/docs/contributing/setup-manifest.md +++ b/docs/contributing/setup-manifest.md @@ -104,10 +104,6 @@ secrets from `packages/worker/.env`. Configure these GitHub Actions secrets and variables for workflows: -- No dedicated GitHub secret is required for preview-environment cleanup. The - preview workflow deletes GitHub preview environments with the built-in - `GITHUB_TOKEN` and job-scoped `deployments: write` permission. - - `CLOUDFLARE_API_TOKEN` (Workers deploy + D1 edit access on the correct account; also reused for remote AI and Cloudflare API workflows that run with account secrets + skills) @@ -136,10 +132,6 @@ Configure these GitHub Actions secrets and variables for workflows: organization and project **slugs** for source map upload — same values as in the Sentry wizard’s `--org` / `--project` flags) -The preview cleanup job deletes the matching GitHub deployment environment with -the built-in GitHub Actions token. No separate GitHub repository secret is -required for that step. - How to get/set each value: - `CLOUDFLARE_API_TOKEN` @@ -223,6 +215,3 @@ Preview deploys for pull requests create a separate Worker per PR named `-pr-` (for kody: `kody-pr-123`) plus one Worker per mock service named `-pr--mock-`. The same `CLOUDFLARE_API_TOKEN` must be able to create/update and delete those Workers. -The preview cleanup job also deletes the matching GitHub environment -(`preview-`) with the workflow's built-in `GITHUB_TOKEN`, so no -extra GitHub repository secret is needed for that step. From 010ee2460900a842d8c4466908ef4fde2b94caa7 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 18 Apr 2026 13:53:00 +0000 Subject: [PATCH 3/4] Restore preview environment token Co-authored-by: Kent C. Dodds --- .github/workflows/preview.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index 8ea4510098..cd50f6004e 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -565,7 +565,7 @@ jobs: node tools/ci/preview-resources.ts cleanup --worker-name "$APP_WORKER_NAME" - name: 🏷️ Delete GitHub preview environment - if: always() + if: always() && secrets.PREVIEW_ENVIRONMENT_GITHUB_TOKEN != '' uses: actions/github-script@v8.0.0 env: EVENT_NAME: ${{ github.event_name }} @@ -573,7 +573,7 @@ jobs: INPUT_TARGET: ${{ inputs.target }} INPUT_PR_NUMBER: ${{ inputs.pr_number }} with: - github-token: ${{ github.token }} + github-token: ${{ secrets.PREVIEW_ENVIRONMENT_GITHUB_TOKEN }} script: | const eventName = process.env.EVENT_NAME; let envName; From 3d2e170852347cf7e646e55f00860d9b512d44eb Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 18 Apr 2026 13:55:38 +0000 Subject: [PATCH 4/4] Fix preview environment cleanup token Co-authored-by: Kent C. Dodds --- .github/workflows/preview.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index cd50f6004e..8ea4510098 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -565,7 +565,7 @@ jobs: node tools/ci/preview-resources.ts cleanup --worker-name "$APP_WORKER_NAME" - name: 🏷️ Delete GitHub preview environment - if: always() && secrets.PREVIEW_ENVIRONMENT_GITHUB_TOKEN != '' + if: always() uses: actions/github-script@v8.0.0 env: EVENT_NAME: ${{ github.event_name }} @@ -573,7 +573,7 @@ jobs: INPUT_TARGET: ${{ inputs.target }} INPUT_PR_NUMBER: ${{ inputs.pr_number }} with: - github-token: ${{ secrets.PREVIEW_ENVIRONMENT_GITHUB_TOKEN }} + github-token: ${{ github.token }} script: | const eventName = process.env.EVENT_NAME; let envName;