ci: add deploy workflow with migration step

GitHub Actions runs D1 migrations before wrangler deploy,
ensuring schema changes land before new worker code goes live.

README documents both GitHub Actions and Workers Builds paths,
with a note that Workers Builds must use 'yarn deploy' to include
the migration step.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: DennisAlund

.github/workflows/deploy.yml

@@ -0,0 +1,35 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Apply database migrations
+        run: yarn db:migrate:remote
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+
+      - name: Deploy worker
+        run: node scripts/resolve-d1-id.js && wrangler deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

README.md

@@ -42,7 +42,16 @@ yarn deploy             # applies migrations and deploys the Worker
 
 ### Continuous deployment
 
-The deploy button sets up [Workers Builds](https://developers.cloudflare.com/workers/ci-cd/builds/) automatically. Cloudflare detects the `deploy` script in `package.json` and uses it as the deploy command. Each push to your production branch applies pending D1 migrations and redeploys the Worker.
+The recommended approach is the included GitHub Actions workflow at `.github/workflows/deploy.yml`. It runs D1 migrations before deploying the Worker, which guarantees schema changes land before new code goes live.
+
+To use it, add two secrets to your GitHub repository under **Settings > Secrets and variables > Actions**:
+
+- `CLOUDFLARE_API_TOKEN`: a Cloudflare API token with Worker and D1 edit permissions
+- `CLOUDFLARE_ACCOUNT_ID`: your Cloudflare account ID
+
+Every push to `main` then applies pending migrations and redeploys automatically.
+
+**If you use Cloudflare Workers Builds (the deploy button):** by default it runs `wrangler deploy` directly, which skips migrations. Change the build command to `yarn deploy` in your Workers Builds configuration to include the migration step. Go to your Worker in the Cloudflare dashboard, open **Settings > Builds**, and set the deploy command to `yarn deploy`.
 
 ## Access Control