From 17d796a9b3f22d496d507f346c1e76a0b61c6233 Mon Sep 17 00:00:00 2001
From: Shehab ElHadidy <shehabelhadidy@hotmail.com>
Date: Mon, 13 Jul 2026 14:32:59 +0800
Subject: [PATCH 1/4] feat: add Cloudflare Pages deployment support

- Add public/_redirects for SPA client-side routing fallback
- Add GitHub Actions workflow to deploy on PR/push using
  cloudflare/wrangler-action@v3

Requires CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID secrets.
---
 .github/workflows/cloudflare-pages.yml | 38 ++++++++++++++++++++++++++
 public/_redirects                      |  1 +
 2 files changed, 39 insertions(+)
 create mode 100644 .github/workflows/cloudflare-pages.yml
 create mode 100644 public/_redirects

diff --git a/.github/workflows/cloudflare-pages.yml b/.github/workflows/cloudflare-pages.yml
new file mode 100644
index 0000000000..e52a50e961
--- /dev/null
+++ b/.github/workflows/cloudflare-pages.yml
@@ -0,0 +1,38 @@
+name: Deploy to Cloudflare Pages
+
+on:
+  pull_request:
+  push:
+    branches:
+      - feat/cloudflare-pages-deploy
+
+concurrency:
+  group: cloudflare-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - run: corepack enable
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm i
+
+      - name: Build the app
+        run: pnpm build
+        env:
+          VITE_VERCEL_GIT_COMMIT_SHA: ${{ github.sha }}
+
+      - name: Deploy to Cloudflare Pages
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy dist/ --project-name=it-tools --branch=${{ github.ref_name }}
diff --git a/public/_redirects b/public/_redirects
new file mode 100644
index 0000000000..bbb3e7a1fb
--- /dev/null
+++ b/public/_redirects
@@ -0,0 +1 @@
+/*  /index.html  200

From 831108cf8058095d10d21a8b8cf0d4fde36b889a Mon Sep 17 00:00:00 2001
From: Shehab ElHadidy <shehabelhadidy@hotmail.com>
Date: Mon, 13 Jul 2026 14:39:37 +0800
Subject: [PATCH 2/4] fix: allow workerd build scripts for Cloudflare Pages
 deploy

---
 pnpm-workspace.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 5ed0b5af0d..02365ef112 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,2 +1,3 @@
 allowBuilds:
   esbuild: true
+  workerd: true

From 3b3a3eecf2d46fd8d0533b0bfd0a79f25d2c79d4 Mon Sep 17 00:00:00 2001
From: Shehab ElHadidy <shehabelhadidy@hotmail.com>
Date: Mon, 13 Jul 2026 15:26:29 +0800
Subject: [PATCH 3/4] ci: deploy Cloudflare Pages on main branch pushes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Trigger on push to main (production) and PRs (preview)
- Add VITE_CLOUDFLARE_GIT_COMMIT_SHA env var
- branch ref is auto-mapped: main→production, others→preview
---
 .github/workflows/cloudflare-pages.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/cloudflare-pages.yml b/.github/workflows/cloudflare-pages.yml
index e52a50e961..c329e67cc6 100644
--- a/.github/workflows/cloudflare-pages.yml
+++ b/.github/workflows/cloudflare-pages.yml
@@ -4,7 +4,7 @@ on:
   pull_request:
   push:
     branches:
-      - feat/cloudflare-pages-deploy
+      - main
 
 concurrency:
   group: cloudflare-${{ github.ref }}
@@ -28,6 +28,7 @@ jobs:
       - name: Build the app
         run: pnpm build
         env:
+          VITE_CLOUDFLARE_GIT_COMMIT_SHA: ${{ github.sha }}
           VITE_VERCEL_GIT_COMMIT_SHA: ${{ github.sha }}
 
       - name: Deploy to Cloudflare Pages

From 20a9e8bc0f3d7f31dc77640f3fe67fafec289a4a Mon Sep 17 00:00:00 2001
From: Shehab El Hadidy <shehabelhadidy@hotmail.com>
Date: Mon, 13 Jul 2026 15:29:54 +0800
Subject: [PATCH 4/4] chore: harden cloudflare-pages workflow

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/cloudflare-pages.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/cloudflare-pages.yml b/.github/workflows/cloudflare-pages.yml
index c329e67cc6..1733db414a 100644
--- a/.github/workflows/cloudflare-pages.yml
+++ b/.github/workflows/cloudflare-pages.yml
@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: cloudflare-${{ github.ref }}
   cancel-in-progress: true