-
Notifications
You must be signed in to change notification settings - Fork 4
Migrate to Cloudflare Workers & Add Advanced Linux Programming Blog Posts #75
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weβll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
aeee40d
20c5eff
f551851
b7c22c7
15f7098
15b1179
73fb11c
e09a163
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,147 @@ | ||
| # GitHub Actions Workflows | ||
|
|
||
| This directory contains automated workflows for the Support Tools website. | ||
|
|
||
| ## Workflows | ||
|
|
||
| ### 1. cloudflare-workers.yml - Cloudflare Workers Deployment | ||
|
|
||
| **Purpose**: Deploy the Hugo static site to Cloudflare Workers | ||
|
|
||
| **Triggers**: | ||
| - **Push to main**: Deploys to staging, then production | ||
| - **Pull Request**: Deploys to development for preview | ||
| - **Manual dispatch**: Deploy to any specific environment | ||
| - **Schedule**: Daily at midnight UTC (content refresh) | ||
|
|
||
| **Deployment Flow**: | ||
|
|
||
| ```mermaid | ||
| graph TD | ||
| A[Trigger] --> B[Test/Build Hugo] | ||
| B --> C{Branch?} | ||
| C -->|PR| D[Deploy to Dev] | ||
| C -->|main| E[Deploy to Staging] | ||
| E --> F[Deploy to Production] | ||
| C -->|manual| G[Deploy to Selected Env] | ||
| ``` | ||
|
|
||
| **Environments**: | ||
| - `development` - https://dev.support.tools | ||
| - `mst` - https://mst.support.tools | ||
| - `qas` - https://qas.support.tools | ||
| - `tst` - https://tst.support.tools | ||
| - `staging` - https://stg.support.tools | ||
| - `production` - https://support.tools | ||
|
|
||
| **Environment Protection**: | ||
| - Production requires manual approval | ||
| - Staging auto-deploys from main branch | ||
| - Development auto-deploys for PRs | ||
|
|
||
| ### 2. pipeline.yml - Legacy Kubernetes Deployment (Deprecated) | ||
|
|
||
| **Status**: DEPRECATED - Use cloudflare-workers.yml instead | ||
|
|
||
| **Purpose**: Previously deployed to Kubernetes clusters via ArgoCD | ||
|
|
||
| ## Required Secrets | ||
|
|
||
| Configure these in Settings β Secrets β Actions: | ||
|
|
||
| - `CLOUDFLARE_API_TOKEN` - API token with Workers:Edit permissions | ||
|
|
||
| ## Usage Examples | ||
|
|
||
| ### Manual Deployment | ||
|
|
||
| 1. Go to Actions tab | ||
| 2. Select "Deploy to Cloudflare Workers" | ||
| 3. Click "Run workflow" | ||
| 4. Select environment | ||
| 5. Click "Run workflow" | ||
|
|
||
| ### Automatic Deployments | ||
|
|
||
| - **Production**: Push to `main` branch | ||
| - **Development**: Create a pull request | ||
| - **Daily refresh**: Automatic at midnight UTC | ||
|
|
||
| ## Monitoring Deployments | ||
|
|
||
| ### View Logs | ||
| ```bash | ||
| # Real-time logs | ||
| wrangler tail --env production | ||
|
|
||
| # GitHub Actions logs | ||
| gh run list --workflow=cloudflare-workers.yml | ||
| gh run view <run-id> | ||
| ``` | ||
|
|
||
| ### Check Status | ||
| ```bash | ||
| # Check all environments | ||
| for env in dev mst qas tst stg ""; do | ||
| url="https://${env}${env:+.}support.tools" | ||
| echo -n "$url: " | ||
| curl -s -o /dev/null -w "%{http_code}\n" $url | ||
| done | ||
| ``` | ||
|
|
||
| ## Rollback Procedure | ||
|
|
||
| 1. **Via GitHub**: | ||
| ```bash | ||
| # List recent deployments | ||
| gh run list --workflow=cloudflare-workers.yml --limit 10 | ||
|
|
||
| # Re-run a previous successful deployment | ||
| gh run rerun <run-id> | ||
| ``` | ||
|
|
||
| 2. **Via Wrangler**: | ||
| ```bash | ||
| # List versions | ||
| wrangler deployments list | ||
|
|
||
| # Rollback to previous version | ||
| wrangler rollback --env production | ||
| ``` | ||
|
|
||
| ## Troubleshooting | ||
|
|
||
| ### Deployment Fails | ||
|
|
||
| 1. Check GitHub Actions logs | ||
| 2. Verify CLOUDFLARE_API_TOKEN is set | ||
| 3. Check Hugo build output | ||
| 4. Verify DNS is pointing to Cloudflare | ||
|
|
||
| ### Site Not Updating | ||
|
|
||
| 1. Clear Cloudflare cache | ||
| 2. Check if deployment completed | ||
| 3. Verify correct environment deployed | ||
| 4. Check Workers logs: `wrangler tail` | ||
|
|
||
| ### Performance Issues | ||
|
|
||
| 1. Check Workers analytics in Cloudflare Dashboard | ||
| 2. Monitor request duration in logs | ||
| 3. Verify static assets are cached | ||
| 4. Check for large unoptimized images | ||
|
|
||
| ## Migration from Kubernetes | ||
|
|
||
| The site has been migrated from Kubernetes to Cloudflare Workers: | ||
|
|
||
| - **Old**: Docker β Kubernetes β ArgoCD β Nginx | ||
| - **New**: Hugo β Cloudflare Workers β Global CDN | ||
|
|
||
| Benefits: | ||
| - β Free hosting for static assets | ||
| - β Global edge deployment | ||
| - β No infrastructure to manage | ||
| - β Faster deployment times | ||
| - β Better performance |
| Original file line number | Diff line number | Diff line change | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,97 @@ | |||||||||||||||||||||||
| name: Deployment Notifications | |||||||||||||||||||||||
|
|
|||||||||||||||||||||||
| on: | |||||||||||||||||||||||
| workflow_run: | |||||||||||||||||||||||
| workflows: ["Deploy to Cloudflare Workers"] | |||||||||||||||||||||||
| types: | |||||||||||||||||||||||
| - completed | |||||||||||||||||||||||
|
|
|||||||||||||||||||||||
| jobs: | |||||||||||||||||||||||
| notify: | |||||||||||||||||||||||
| runs-on: ubuntu-latest | |||||||||||||||||||||||
| if: ${{ github.event.workflow_run.conclusion == 'success' || github.event.workflow_run.conclusion == 'failure' }} | |||||||||||||||||||||||
|
|
|||||||||||||||||||||||
| steps: | |||||||||||||||||||||||
| - name: Get workflow details | |||||||||||||||||||||||
| id: workflow-details | |||||||||||||||||||||||
| run: | | |||||||||||||||||||||||
| echo "status=${{ github.event.workflow_run.conclusion }}" >> $GITHUB_OUTPUT | |||||||||||||||||||||||
| echo "run_id=${{ github.event.workflow_run.id }}" >> $GITHUB_OUTPUT | |||||||||||||||||||||||
| echo "actor=${{ github.event.workflow_run.actor.login }}" >> $GITHUB_OUTPUT | |||||||||||||||||||||||
| echo "branch=${{ github.event.workflow_run.head_branch }}" >> $GITHUB_OUTPUT | |||||||||||||||||||||||
|
|
|||||||||||||||||||||||
| # Uncomment and configure for Slack notifications | |||||||||||||||||||||||
| # - name: Slack Notification | |||||||||||||||||||||||
| # if: ${{ vars.SLACK_WEBHOOK_URL != '' }} | |||||||||||||||||||||||
| # uses: 8398a7/action-slack@v3 | |||||||||||||||||||||||
| # with: | |||||||||||||||||||||||
| # status: ${{ github.event.workflow_run.conclusion }} | |||||||||||||||||||||||
| # webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }} | |||||||||||||||||||||||
| # text: | | |||||||||||||||||||||||
| # Deployment ${{ github.event.workflow_run.conclusion == 'success' && 'β succeeded' || 'β failed' }} | |||||||||||||||||||||||
| # Branch: ${{ steps.workflow-details.outputs.branch }} | |||||||||||||||||||||||
| # Actor: ${{ steps.workflow-details.outputs.actor }} | |||||||||||||||||||||||
| # Run: https://github.com/${{ github.repository }}/actions/runs/${{ steps.workflow-details.outputs.run_id }} | |||||||||||||||||||||||
|
|
|||||||||||||||||||||||
| # Uncomment and configure for Discord notifications | |||||||||||||||||||||||
| # - name: Discord Notification | |||||||||||||||||||||||
| # if: ${{ vars.DISCORD_WEBHOOK_URL != '' }} | |||||||||||||||||||||||
| # uses: sarisia/actions-status-discord@v1 | |||||||||||||||||||||||
| # with: | |||||||||||||||||||||||
| # webhook: ${{ secrets.DISCORD_WEBHOOK_URL }} | |||||||||||||||||||||||
| # status: ${{ github.event.workflow_run.conclusion }} | |||||||||||||||||||||||
| # title: "Support Tools Deployment" | |||||||||||||||||||||||
| # description: | | |||||||||||||||||||||||
| # **Status**: ${{ github.event.workflow_run.conclusion == 'success' && 'β Success' || 'β Failed' }} | |||||||||||||||||||||||
| # **Branch**: ${{ steps.workflow-details.outputs.branch }} | |||||||||||||||||||||||
| # **Triggered by**: ${{ steps.workflow-details.outputs.actor }} | |||||||||||||||||||||||
| # url: "https://github.com/${{ github.repository }}/actions/runs/${{ steps.workflow-details.outputs.run_id }}" | |||||||||||||||||||||||
|
|
|||||||||||||||||||||||
| # Uncomment and configure for email notifications | |||||||||||||||||||||||
| # - name: Send email notification | |||||||||||||||||||||||
| # if: ${{ github.event.workflow_run.conclusion == 'failure' }} | |||||||||||||||||||||||
| # uses: dawidd6/action-send-mail@v3 | |||||||||||||||||||||||
| # with: | |||||||||||||||||||||||
| # server_address: smtp.gmail.com | |||||||||||||||||||||||
| # server_port: 587 | |||||||||||||||||||||||
| # username: ${{ secrets.MAIL_USERNAME }} | |||||||||||||||||||||||
| # password: ${{ secrets.MAIL_PASSWORD }} | |||||||||||||||||||||||
| # subject: "β Support Tools Deployment Failed" | |||||||||||||||||||||||
| # to: [email protected] | |||||||||||||||||||||||
| # from: GitHub Actions | |||||||||||||||||||||||
| # body: | | |||||||||||||||||||||||
| # Deployment to Cloudflare Workers has failed. | |||||||||||||||||||||||
| # | |||||||||||||||||||||||
| # Branch: ${{ steps.workflow-details.outputs.branch }} | |||||||||||||||||||||||
| # Actor: ${{ steps.workflow-details.outputs.actor }} | |||||||||||||||||||||||
| # | |||||||||||||||||||||||
| # View details: https://github.com/${{ github.repository }}/actions/runs/${{ steps.workflow-details.outputs.run_id }} | |||||||||||||||||||||||
|
|
|||||||||||||||||||||||
| - name: Create GitHub Issue on Failure | |||||||||||||||||||||||
| if: ${{ github.event.workflow_run.conclusion == 'failure' }} | |||||||||||||||||||||||
| uses: actions/github-script@v7 | |||||||||||||||||||||||
| with: | |||||||||||||||||||||||
| script: | | |||||||||||||||||||||||
| const issue = await github.rest.issues.create({ | |||||||||||||||||||||||
| owner: context.repo.owner, | |||||||||||||||||||||||
| repo: context.repo.repo, | |||||||||||||||||||||||
| title: `π¨ Deployment Failed - ${new Date().toISOString().split('T')[0]}`, | |||||||||||||||||||||||
| body: `## Deployment Failure | |||||||||||||||||||||||
|
|
|||||||||||||||||||||||
| The Cloudflare Workers deployment has failed. | |||||||||||||||||||||||
|
|
|||||||||||||||||||||||
| **Details:** | |||||||||||||||||||||||
| - Branch: \`${{ steps.workflow-details.outputs.branch }}\` | |||||||||||||||||||||||
| - Triggered by: @${{ steps.workflow-details.outputs.actor }} | |||||||||||||||||||||||
| - Workflow Run: [View Details](https://github.com/${{ github.repository }}/actions/runs/${{ steps.workflow-details.outputs.run_id }}) | |||||||||||||||||||||||
|
|
|||||||||||||||||||||||
| **Action Required:** | |||||||||||||||||||||||
| 1. Check the workflow logs | |||||||||||||||||||||||
| 2. Fix the issue | |||||||||||||||||||||||
| 3. Re-run the deployment | |||||||||||||||||||||||
|
|
|||||||||||||||||||||||
| cc: @${{ steps.workflow-details.outputs.actor }}`, | |||||||||||||||||||||||
| labels: ['deployment-failure', 'urgent'] | |||||||||||||||||||||||
| }); | |||||||||||||||||||||||
|
|
|||||||||||||||||||||||
| console.log(`Created issue #${issue.data.number}`); | |||||||||||||||||||||||
|
Comment on lines
+11
to
+97
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
Copilot AutofixAI 6 months ago To address the issue, we will add a
Suggested changeset
1
.github/workflows/cloudflare-workers-notifications.yml
Copilot is powered by AI and may make mistakes. Always verify output.
Refresh and try again.
|
|||||||||||||||||||||||
Check failure
Code scanning / CodeQL
Code injection Critical
Copilot Autofix
AI 6 months ago
To fix the issue, the untrusted input (
${{ github.event.workflow_run.head_branch }}) should be safely passed through an intermediate environment variable, and the shell should use its native syntax to access the variable. This approach avoids direct interpolation and eliminates the risk of code injection. Specifically:${{ github.event.workflow_run.head_branch }}in theechocommand with the environment variable syntax ($BRANCH).BRANCHusing${{ github.event.workflow_run.head_branch }}.