chore: migrate hosting from Netlify to Cloudflare Workers (static assets) - #183
Merged
Conversation
✅ Deploy Preview for dev-bayanflow ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughMigrates the project from Netlify to Cloudflare Workers by adding ChangesNetlify → Cloudflare Workers Migration
Sequence Diagram(s)sequenceDiagram
participant PR as Pull Request
participant GH as GitHub Actions
participant CF as Cloudflare Workers
participant Commenter as github-script
rect rgba(100, 149, 237, 0.5)
note over PR,Commenter: PR Preview Flow (develop branch)
PR-->>GH: PR opened/synchronize (target: develop)
GH->>GH: install + lint + test + build
GH->>CF: wrangler versions upload --env staging (pr-N alias)
CF-->>GH: Version Preview Alias URL
GH->>Commenter: parse URL from output
Commenter->>PR: upsert comment with preview URL table
end
rect rgba(144, 238, 144, 0.5)
note over GH,CF: Deploy Flow (main / develop)
GH-->>GH: CI workflow_run completed
GH->>GH: install + vite build (branch env vars)
GH->>CF: wrangler deploy --env production OR staging
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
.github/workflows/deploy-cloudflare.yml (1)
61-69: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPass
head_branchvia an env var instead of inline expansion.
${{ github.event.workflow_run.head_branch }}is expanded directly into therunshell block. Thebranches/iffilters constrain this tomain/developtoday, so it isn't currently exploitable, but inlining GitHub context into shell is the classic template-injection pattern. Bind it toenvand reference"$HEAD_BRANCH"for defense-in-depth.🛡️ Proposed fix
- name: Output deployment URL + env: + HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} run: | - if [[ "${{ github.event.workflow_run.head_branch }}" == "main" ]]; then + if [[ "$HEAD_BRANCH" == "main" ]]; then echo "Production worker: https://bayan-flow.workers.dev" echo "Custom domain (after DNS cutover): https://bayanflow.com" else echo "Staging worker: https://bayan-flow-staging.workers.dev" echo "Custom domain (after DNS cutover): https://dev.bayanflow.com" fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/deploy-cloudflare.yml around lines 61 - 69, The "Output deployment URL" step is directly expanding the GitHub context variable `${{ github.event.workflow_run.head_branch }}` into the shell script, which creates a potential template injection vulnerability. To fix this, add an `env` section to the step that binds the GitHub context to an environment variable (e.g., `HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}`), then replace the direct context expansion in the shell script with a reference to the environment variable using `"$HEAD_BRANCH"`. This ensures the GitHub context is safely bound at the workflow level rather than being directly expanded into the shell.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy-cloudflare.yml:
- Around line 26-29: The checkout action in the deploy workflow is using the
default credential persistence setting, which leaves a git token in the
repository config during the build process and increases the attack surface. Add
the `persist-credentials: false` option to the actions/checkout@v6 step to
disable credential persistence, since this workflow only needs to read source
code for building and deploying without any git push operations.
In @.github/workflows/preview-cloudflare.yml:
- Around line 22-25: Add `persist-credentials: false` to the checkout action to
disable token persistence for better security. Additionally, replace all
floating action version tags with specific commit SHAs across the workflow at
lines 23, 28, 33, 60, and 72 (actions like checkout, setup-node,
actions-gh-pages, etc.) to pin exact action versions and prevent supply-chain
attacks. Finally, update the listComments call around lines 95-99 to include the
`per_page` parameter for proper pagination to ensure all comments are searched
even on PRs with many existing comments, preventing duplicate preview comments
from being created.
- Around line 95-102: The github.rest.issues.listComments call only fetches the
first page of comments (default 30 items per page), so the marker lookup in the
find() method can miss older bot comments on threads with many comments,
resulting in duplicate preview comments. Implement pagination to fetch all
comments from all pages before searching for the existing comment with the
marker. Use GitHub's paginate utility or add a loop to iterate through all pages
until no more comments are returned, accumulating all comments into a single
array before performing the find() operation.
In `@public/_headers`:
- Around line 9-10: The URL pattern on line 9 with
`https://:version.:subdomain.workers.dev/*` expects two labels before
workers.dev (e.g., label1.label2.workers.dev), but all actual deployment URLs
use only a single label (pr-{number}-bayan-flow-staging.workers.dev,
bayan-flow-staging.workers.dev, bayan-flow.workers.dev). Modify the pattern to
match the actual single-label deployment URLs by updating the pattern structure
to correctly capture these single-label subdomains before workers.dev instead of
expecting two separate labels.
In `@src/constants/siteSeo.test.js`:
- Line 34: The test line with the isNoIndexHostname function call exceeds
Prettier's line length limit and is causing formatting check failures. Break
this long line into multiple lines by extracting the hostname string into a
separate variable declared before the expect statement, or split the expect call
across multiple lines to meet the configured line length requirement.
---
Nitpick comments:
In @.github/workflows/deploy-cloudflare.yml:
- Around line 61-69: The "Output deployment URL" step is directly expanding the
GitHub context variable `${{ github.event.workflow_run.head_branch }}` into the
shell script, which creates a potential template injection vulnerability. To fix
this, add an `env` section to the step that binds the GitHub context to an
environment variable (e.g., `HEAD_BRANCH: ${{
github.event.workflow_run.head_branch }}`), then replace the direct context
expansion in the shell script with a reference to the environment variable using
`"$HEAD_BRANCH"`. This ensures the GitHub context is safely bound at the
workflow level rather than being directly expanded into the shell.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d40a2f3a-36d2-4d46-8a09-ddd8b703bdeb
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (13)
.github/labeler.yml.github/workflows/ci.yml.github/workflows/deploy-cloudflare.yml.github/workflows/preview-cloudflare.yml.gitignoreindex.htmlnetlify.tomlpackage.jsonpublic/_headerssrc/constants/siteSeo.jssrc/constants/siteSeo.test.jssrc/utils/deployContext.jswrangler.jsonc
ayoub3bidi
force-pushed
the
chore/cloudflare-workers-migration
branch
from
June 23, 2026 19:32
99bbe89 to
0b20f4b
Compare
✅ Cloudflare Workers preview for bayan-flow-staging ready!
Preview alias |
25 tasks
24 tasks
This was referenced Jun 23, 2026
This was referenced Jun 27, 2026
Merged
28 tasks
35 tasks
This was referenced Jul 16, 2026
42 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contribution workflow
develop: This PR targetsdevelop, notmain.Description
Adds Cloudflare Workers static-asset hosting for Bayan Flow, replacing Netlify in CI/CD. The Vite SPA is served from
dist/with SPA fallback (not_found_handling: single-page-application), security headers ported topublic/_headers, and GitHub Actions deploy/preview workflows. Netlify config is retained for rollback during the migration observation window.Type of Change
Related Issues
Fixes #
Changes Made
wrangler.jsonc— static assets on./dist, SPA routing,staging/productionenvironments (bayan-flow-staging,bayan-flow)public/_headers— CSP, HSTS, frame/options headers (ported fromnetlify.toml); includes Product Huntimg-src;noindexon*.workers.dev.github/workflows/deploy-cloudflare.yml— deploy after CI passes on push tomain/develop.github/workflows/preview-cloudflare.yml— PR previews todevelopviawrangler versions upload --preview-alias pr-<N>ci.yml(Netlify projects kept alive for rollback;netlify.tomlretained)wranglerdevDependency anddeploy:cf:*/preview:cf:uploadscripts*.workers.devas noindex insiteSeo.js,index.html, and testsdeployContext.jscomment to reference CI / wrangler (not Netlify)Algorithm Details (if applicable)
N/A
Testing
pnpm vitest run src/constants/siteSeo.test.js src/utils/deployContext.test.js)pnpm test:run) — CI will run full suitebayan-flow-staging.workers.dev(see migration guide in PR notes)Test Results
Screenshots/GIFs
N/A (infrastructure only)
Code Quality
pnpm lint) — CIpnpm format) — CIPerformance Impact
Accessibility
Breaking Changes
CF_API_TOKEN,CF_ACCOUNT_IDChecklist
netlify.tomlkept intentionally for rollback (remove in follow-up after Netlify deletion)Additional Notes
Why keep
netlify.toml?Do not delete it in this PR. It documents the last-known Netlify config if you need to redeploy to Netlify during rollback. Remove it in a small follow-up PR after you delete the Netlify projects (~2 weeks post cutover).
Post-merge operator steps (summary)
CF_API_TOKEN+CF_ACCOUNT_IDin GitHub → Settings → Secretsdevelop→ smoke-testhttps://bayan-flow-staging.workers.devdevelop→mainPR → smoke-testhttps://bayan-flow.workers.devwrangler.jsonc, redeploydev.bayanflow.comandbayanflow.comin Cloudflare dashboardnetlify.toml, clean Netlify secrets from GitHubReviewer Guidelines:
CF_API_TOKEN,CF_ACCOUNT_ID)_headersCSP matches priornetlify.tomlintentnot_found_handling, not only_redirectsSummary by CodeRabbit
*.workers.devhostnames are treated as non-production (noindex).