chore: Cloudflare migration polish — Netlify cleanup, CSP, Pyodide CDN - #187
Merged
Conversation
✅ Deploy Preview for dev-bayanflow ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
github-actions
Bot
added
documentation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe PR moves deployment and static-hosting references from Netlify to Cloudflare Workers, updates HTTP headers and hostname-based SEO logic, revises the privacy policy wording, and adds configurable Pyodide CDN plumbing with worker wiring. ChangesCloudflare Workers migration and Pyodide flow
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/AGENTS_REFERENCE.md`:
- Around line 206-213: The repository config list uses the wrong labeler path,
which can mislead readers looking for the file. Update the documentation entry
in AGENTS_REFERENCE to reference the actual `.github/labeler.yml` path
consistently with the other GitHub workflow/config references, and keep the
surrounding build/CI config list unchanged.
In `@public/_headers`:
- Line 7: The Content-Security-Policy is still hardcoded to allow Pyodide
fetches only from the current CDN host, so deployments using a custom
VITE_PYODIDE_CDN_BASE will be blocked. Update the CSP in the headers
configuration to include the configurable Pyodide CDN origin in the appropriate
directive, keeping the allowlist aligned with the runtime base used by the
Pyodide loader.
- Around line 21-22: Add an HTTP-level noindex rule for the stable dev host
because `_headers` only applies `X-Robots-Tag` to `*.workers.dev`, leaving
`dev.bayanflow.com` without server-side noindex coverage. Update the `_headers`
configuration to include `dev.bayanflow.com` alongside the existing worker host
rule so crawlers receive `X-Robots-Tag: noindex` without relying on `siteSeo` or
`index.html` behavior.
In `@src/constants/pyodideCdn.test.js`:
- Around line 39-42: The failing assertion in pyodideCdn.test.js needs to be
reformatted to satisfy Prettier, specifically the expectation in the
pyodideScriptUrl test. Update the expect(...).toBe(...) statement so it matches
the project's formatted line-wrapping style without changing the test logic or
the pyodideScriptUrl import/stubEnv setup.
In `@src/content/legal/privacy.en.js`:
- Line 29: The privacy text in the GitHub API disclosure is too absolute because
browser requests to api.github.com still expose network metadata like IP address
and user agent. Update the wording in the privacy content string for the
header/footer GitHub API notice to disclose that GitHub may receive such
metadata, or adjust the implementation to proxy the request server-side if you
want to avoid sharing it.
In `@src/hooks/usePythonExecution.js`:
- Around line 99-103: The worker lifecycle in usePythonExecution is leaving a
failed init cached, so later runCode/runTests calls reuse an uninitialized
worker. Update the init flow around workerRef.current.postMessage in the runtime
startup path and the related runCode/runTests fallback so that a failed
runtime-load/init clears or terminates workerRef.current before returning, or
otherwise marks the worker as init-failed and forces a fresh init on the next
call. Use the existing workerRef, runCode, and runTests logic to ensure bad
cdnBase overrides do not keep a broken worker alive.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 25cd7c97-4533-431b-b3ee-8e2ad468b18a
📒 Files selected for processing (16)
.github/labeler.ymlSECURITY.mddocs/AGENTS_REFERENCE.mddocs/ARCHITECTURE.mddocs/DEVELOPMENT.mdindex.htmlpublic/_headerssrc/constants/pyodideCdn.jssrc/constants/pyodideCdn.test.jssrc/constants/siteSeo.jssrc/constants/siteSeo.test.jssrc/content/legal/privacy.en.jssrc/content/legal/privacy.en.test.jssrc/hooks/usePythonExecution.jssrc/utils/deployContext.jssrc/workers/pyodide.worker.js
💤 Files with no reviewable changes (2)
- .github/labeler.yml
- src/constants/siteSeo.test.js
✅ Cloudflare Workers preview for bayan-flow-staging ready!
Preview alias |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/hooks/usePythonExecution.js`:
- Around line 74-80: The worker error paths in usePythonExecution should also
fail the active test run, not just clear the timeout and dispose the worker.
Update the error-handling logic in runTests/its worker message and onerror
handlers so they set the test status to error and populate the test error state
whenever a worker error occurs, using the existing status/error setters in
usePythonExecution to avoid leaving the run stuck in running.
In `@vite.config.js`:
- Around line 68-69: The CSP origin resolution in the Vite config is reading
VITE_PYODIDE_CDN_BASE directly from process.env during config evaluation, so it
can miss .env.* values. Update the Vite config to call loadEnv() and use the
loaded VITE_PYODIDE_CDN_BASE value when invoking resolvePyodideCspOrigin(),
keeping the generated CSP aligned with the runtime CDN origin.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 48302f31-3fcc-49af-9176-2dafab02022d
📒 Files selected for processing (8)
docs/AGENTS_REFERENCE.mdpublic/_headerssrc/constants/pyodideCdn.jssrc/content/legal/privacy.en.jssrc/content/legal/privacy.en.test.jssrc/hooks/usePythonExecution.jssrc/hooks/usePythonExecution.test.jsvite.config.js
✅ Files skipped from review due to trivial changes (1)
- docs/AGENTS_REFERENCE.md
🚧 Files skipped from review as they are similar to previous changes (4)
- src/content/legal/privacy.en.js
- src/constants/pyodideCdn.js
- src/content/legal/privacy.en.test.js
- public/_headers
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/hooks/usePythonExecution.js`:
- Around line 71-88: Worker error handling in usePythonExecution currently
updates the code-run state unconditionally, which causes test-only runs to
surface a fake code-execution failure. Add an analogous hadActiveCode check (for
example, based on timeoutRef.current) alongside the existing hadActiveTests
guard in the error path, and only call setStatus('error') and setError(message)
when a code run is actually active; keep testStatus/testError updates behind the
test guard. Apply the same conditional handling in worker.onerror so both error
paths only affect the execution panel when runCode is in progress.
In `@src/hooks/usePythonExecution.test.js`:
- Around line 209-217: The pre-ready error path in the usePythonExecution test
only checks status and error text, but it should also verify that the worker is
disposed. Update the test case in usePythonExecution.test.js that drives
mockWorker.onmessage with type: 'error' to assert terminate() is called,
matching the cleanup behavior in usePythonExecution.js for the pre-ready
runTests failure branch.
In `@vite.config.js`:
- Around line 87-90: The Pyodide CSP patch in closeBundle() is skipping updates
when resolvePyodideCspOrigin(pyodideCdnBase) returns null for the default CDN,
which leaves jsDelivr out of the generated policy. Update the CSP handling so
the default Pyodide CDN also contributes the jsDelivr origin to both connect-src
and script-src, and keep the existing logic in closeBundle() and
resolvePyodideCspOrigin() aligned so the worker’s runtime CDN is always covered.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1d532178-1886-4506-aadd-785f321b09eb
📒 Files selected for processing (4)
src/constants/pyodideCdn.jssrc/hooks/usePythonExecution.jssrc/hooks/usePythonExecution.test.jsvite.config.js
🚧 Files skipped from review as they are similar to previous changes (1)
- src/constants/pyodideCdn.js
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/hooks/usePythonExecution.js (1)
154-159: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winFail the sibling operation when a shared-worker timeout disposes the worker.
Both timeout handlers terminate the same
workerRef.current, but only update their own panel state. IfrunCode()andrunTests()overlap, timing out either one leaves the other stuck inrunninguntil its separate timeout fires, even though its worker was already killed on Line 155 / Line 208.Suggested fix
timeoutRef.current = setTimeout(() => { + const hadActiveTests = testTimeoutRef.current != null; + clearTimeout(testTimeoutRef.current); + testTimeoutRef.current = null; disposeWorker(); setStatus('timeout'); setError(`Execution timed out after ${timeout / 1000}s`); + if (hadActiveTests) { + setTestStatus('error'); + setTestError('Worker terminated because code execution timed out'); + } timeoutRef.current = null; }, timeout); ... testTimeoutRef.current = setTimeout(() => { + const hadActiveCode = timeoutRef.current != null; + clearTimeout(timeoutRef.current); + timeoutRef.current = null; disposeWorker(); setTestStatus('error'); setTestError(`Tests timed out after ${timeout / 1000}s`); + if (hadActiveCode) { + setStatus('error'); + setError('Worker terminated because tests timed out'); + } testTimeoutRef.current = null; }, timeout);Also applies to: 207-212
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/hooks/usePythonExecution.js` around lines 154 - 159, The shared-worker timeout path in usePythonExecution is only updating the local operation state, so the sibling run can stay stuck in running after disposeWorker kills workerRef.current. Update the timeout handlers used by runCode() and runTests() to also fail any other active operation when the shared worker is disposed, clearing its running state and setting an appropriate timeout/worker-terminated error. Keep the fix centralized around usePythonExecution, disposeWorker, and the timeout callbacks so both operations are synchronized.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@vite.config.js`:
- Around line 19-23: The CSP override handling in the configured-origin block
should not silently ignore an invalid non-empty VITE_PYODIDE_CDN_BASE while
getPyodideCdnBase still returns it; instead, validate the value up front and
fail the build/configuration when the override is malformed. Update the logic
around configured and origins in vite.config.js so an invalid override throws or
exits with a clear error, keeping the runtime base URL and CSP policy in sync.
---
Outside diff comments:
In `@src/hooks/usePythonExecution.js`:
- Around line 154-159: The shared-worker timeout path in usePythonExecution is
only updating the local operation state, so the sibling run can stay stuck in
running after disposeWorker kills workerRef.current. Update the timeout handlers
used by runCode() and runTests() to also fail any other active operation when
the shared worker is disposed, clearing its running state and setting an
appropriate timeout/worker-terminated error. Keep the fix centralized around
usePythonExecution, disposeWorker, and the timeout callbacks so both operations
are synchronized.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 77a6b88d-4ab1-42cb-90f8-7f3601684d25
📒 Files selected for processing (4)
public/_headerssrc/hooks/usePythonExecution.jssrc/hooks/usePythonExecution.test.jsvite.config.js
🚧 Files skipped from review as they are similar to previous changes (2)
- src/hooks/usePythonExecution.test.js
- public/_headers
This was referenced Jun 27, 2026
Merged
28 tasks
35 tasks
21 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contribution workflow
develop: This PR targetsdevelopfromfeat/cloudflare-infrastructure.Description
Follow-up polish on the Netlify → Cloudflare Workers migration already merged via #183 and #185. Removes stale Netlify hostname handling from runtime code, updates legal/docs for Cloudflare hosting, hardens static asset headers for Workers, and makes the Pyodide CDN base configurable.
This is not a v0.5.0 release PR and does not change production DNS or
wrangler.jsoncroutes.Type of Change
Related Issues
Fixes #
Changes Made
Runtime & SEO
index.html— drop.netlify.appand legacydeploy-previewhostname checks; noindex + Umami routing use production domains,dev.bayanflow.com, and.workers.devonlysrc/constants/siteSeo.js— alignisNoIndexHostname()with the same hostname setPrivacy & legal
src/content/legal/privacy.en.js— hosting processor Netlify → Cloudflare; clarify Umami hostname switching and GitHub API usage; bump last-updated datesrc/content/legal/privacy.en.test.js— assert Cloudflare mentionStatic assets & security (
public/_headers)static.cloudflareinsights.com,cloudflareinsights.com) alongside existing Umami/GitHub/jsDelivr origins/assets/*,no-cachefor/index.html, short TTL for branding assetsworkers.devX-Robots-Tag: noindexrule unchangedPyodide CDN
src/constants/pyodideCdn.js(new) — centralizePYODIDE_VERSIONandgetPyodideCdnBase()with optionalVITE_PYODIDE_CDN_BASEoverridesrc/hooks/usePythonExecution.js— passcdnBaseto the worker on initsrc/workers/pyodide.worker.js— load Pyodide from configurable base URL (defaults to jsDelivr)src/constants/pyodideCdn.test.js(new) — default base, env override, trailing-slash normalization, script URLDocumentation & repo hygiene
docs/ARCHITECTURE.md— Cloudflare deploy/env docs (already on branch); removed stale setup doc linkdocs/DEVELOPMENT.md,docs/AGENTS_REFERENCE.md,SECURITY.md— Netlify → Cloudflare Workers references.github/labeler.yml— CI label paths usewrangler.jsonconlywrangler.jsonc— remove Netlify rollback commentsrc/utils/deployContext.js— comment wording for Workers previewsnetlify.tomlis intentionally unchanged (rollback file; manual removal planned ~2 weeks post cutover).Algorithm Details (if applicable)
N/A
Testing
pnpm vitest run src/constants/siteSeo.test.js src/content/legal/privacy.en.test.js src/constants/pyodideCdn.test.jsTest Results
Screenshots/GIFs
N/A
Code Quality
Performance Impact
index.htmlstays fresh for SPA updatesAccessibility
Breaking Changes
None. Default Pyodide CDN remains jsDelivr; production hostnames unchanged.
Checklist
develop: verifydev.bayanflow.comdeploy unchangedAdditional Notes
CSP / Cloudflare Web Analytics
The CSP additions only permit the Cloudflare Web Analytics beacon if enabled in the dashboard. Umami remains the analytics wired in
index.html. No second analytics processor is documented unless Web Analytics is turned on in Cloudflare.Rollback
Legacy hosting config remains in
netlify.tomluntil manual cleanup after the cutover stabilizes.Reviewer Guidelines:
bayanflow.com/wwwstill indexable)Summary by CodeRabbit