implement global CDN cache priming layer

create API that invalidates ISR builds, clears global CDN caches, and warms pages

API has zod schema, openAPI contract and documentation

refactor botconfig to depend on API by default to manage ISR

refactor sitemap to be SSR and record a build time file to track time updates over time with ISR

setup zod runtime validation configs

refactor Cloudflare worker to be primary ISR manager via cronjob API calls

Cloudflare worker no longer manually handle warming behaviors, instead relying on new priming API call to handle them

update and add testing for all the above via vitest and playwright fixtures

update GitHub Actions e2e workflow to run API test

update GitHub Actions deployment workflow to manage initial deployment CDN priming via API call

Author: ritorhymes

.env.example

@@ -1,3 +1,10 @@
+# API Config
+API_DRY_RUN=false
+
+# Sitemap configurations
+## Manages how often the sitemap says its updated from after most recent deployment
+SITEMAP_REVALIDATE_SECONDS=518400
+
 # Performance Redirect Hook for test environments with low-end specs (enabled by default as intended, set "false" to turn it off)
 NEXT_PUBLIC_DISABLE_PERF_REDIRECT=false
 
@@ -21,6 +28,7 @@ ENABLE_CHROME_MOBILE=true
 ENABLE_FIREFOX_DESKTOP=true
 ENABLE_FIREFOX_MOBILE=true
 
-# Testing Cloudflare via Playwright Fixture
+# Cloudflare Worker & Revalidation API (shared secret)
+# Used by both the Cloudflare warm worker and /api/revalidate endpoint
 PRIMER_WORKER_URL=
 PRIMER_AUTH_SECRET=

.github/workflows/deploy-vercel.yml

@@ -23,6 +23,13 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
 
+      - name: Generate build timestamp
+        run: |
+          mkdir -p lib/generated
+          echo "// Auto-generated at build time - do not edit" > lib/generated/buildTime.ts
+          echo "export const BUILD_TIME = '$(date -u +'%Y-%m-%dT%H:%M:%SZ')';" >> lib/generated/buildTime.ts
+          cat lib/generated/buildTime.ts
+
       - name: Deploy to Vercel (prod, cold build) via CLI
         id: vercel
         env:
@@ -69,32 +76,52 @@ jobs:
           # Back-compat output
           echo "preview-name=$DEPLOY_URL" >> "$GITHUB_OUTPUT"
 
-      - name: Warm Next.js pages (Cloudflare Worker)
+      - name: Revalidate + prime all Next.js pages (on-demand ISR + CDN priming)
+        if: ${{ success() }}
+        env:
+          REVALIDATE_URL: https://carolinevreeland.com/api/revalidate
+          REVALIDATE_SECRET: ${{ secrets.PRIMER_AUTH_SECRET }}
+        run: |
+          set -euo pipefail
+          if [ -z "${REVALIDATE_SECRET:-}" ]; then
+            echo "Revalidate + prime step skipped: PRIMER_AUTH_SECRET not set."
+            exit 0
+          fi
+
+          status="$(curl -s -o /dev/null -w "%{http_code}" -X POST "${REVALIDATE_URL}?target=all&warm=true" \
+            -H "X-Auth: ${REVALIDATE_SECRET}" || true)"
+
+          case "$status" in
+            2*) echo "Revalidate + prime OK ($status)";;
+            *)  echo "Revalidate + prime returned HTTP $status. Continuing.";;
+          esac
+
+      - name: Prime Next.js pages (Cloudflare Worker)
         if: ${{ success() }}
         env:
-          WARM_URL:  ${{ secrets.WARM_WEBHOOK_URL }}
-          WARM_AUTH: ${{ secrets.WARM_AUTH_SECRET }}
+          PRIMER_URL:  ${{ secrets.PRIMER_WORKER_URL }}
+          PRIMER_AUTH: ${{ secrets.PRIMER_AUTH_SECRET }}
         run: |
           set -euo pipefail
-          # Make the warm webhook non-blocking: log result and continue even on failure/404/missing secrets
-          if [ -z "${WARM_URL:-}" ] || [ -z "${WARM_AUTH:-}" ]; then
-            echo "Warm step skipped: WARM_URL and/or WARM_AUTH not set."
+          # Make the prime webhook non-blocking: log result and continue even on failure/404/missing secrets
+          if [ -z "${PRIMER_URL:-}" ] || [ -z "${PRIMER_AUTH:-}" ]; then
+            echo "Prime step skipped: PRIMER_URL and/or PRIMER_AUTH not set."
             exit 0
           fi
 
           TS="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
           RUN_ID="${{ github.run_id }}"
           BODY="{\"event\":\"deploy_ready\",\"env\":\"production\",\"timestamp\":\"$TS\",\"run_id\":\"$RUN_ID\"}"
-          BASE="${WARM_URL%/}" # strip trailing slash if present
+          BASE="${PRIMER_URL%/}" # strip trailing slash if present
 
-          status="$(curl -s -o /dev/null -w "%{http_code}" -X POST "${BASE}/warm" \
+          status="$(curl -s -o /dev/null -w "%{http_code}" -X POST "${BASE}/prime" \
             -H "Content-Type: application/json" \
-            -H "X-Auth: ${WARM_AUTH}" \
+            -H "X-Auth: ${PRIMER_AUTH}" \
             --data "${BODY}" || true)"
 
           case "$status" in
-            2*|3*) echo "Warm OK ($status)";;
-            404)   echo "Warm endpoint returned 404 (missing route). Continuing.";;
-            0)     echo "Warm call did not complete (network error). Continuing.";;
-            *)     echo "Warm webhook returned HTTP $status. Continuing.";;
+            2*|3*) echo "Prime OK ($status)";;
+            404)   echo "Prime endpoint returned 404 (missing route). Continuing.";;
+            0)     echo "Prime call did not complete (network error). Continuing.";;
+            *)     echo "Prime webhook returned HTTP $status. Continuing.";;
           esac

.github/workflows/e2e-tests.yml

@@ -34,6 +34,9 @@ jobs:
         run: pnpm exec playwright install --with-deps
 
       - name: Run E2E tests
+        env:
+          RUN_REVALIDATE: '1'
+          PRIMER_AUTH_SECRET: 'test-secret'
         run: pnpm e2e:stable
 
       - name: Upload test results

.gitignore

@@ -43,6 +43,8 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 
+# Generated files
+lib/generated/
 
 # Cloudflare
 Cloudflare/node_modules

Cloudflare/package.json

@@ -7,7 +7,7 @@
     "dev": "wrangler dev --local --persist",
     "deploy": "wrangler deploy",
     "tail": "wrangler tail",
-    "secret:auth": "wrangler secret put AUTH_SECRET",
+    "secret:auth": "wrangler secret put PRIMER_AUTH_SECRET",
     "secret:check": "pnpm exec wrangler secret list",
     "kv:ids": "wrangler kv namespace list",
     "test": "vitest --run",