@erclx/canon 4.95.0 → 4.97.0

package/tooling/cloudflare/configs/.github/workflows/deploy.yml

@@ -11,13 +11,19 @@ on:
       # path the build reads when it draws on content living elsewhere.
       - 'src/**'
   workflow_dispatch:
+  # A closed pull request runs only the cleanup job below, which deletes the
+  # preview deployments `canon pr preview` minted for its branch.
+  pull_request:
+    types: [closed]
 
 # Fill in a concurrency group name unique to this project. A second push
 # while a deploy is in flight publishes the newer commit rather than racing
 # it, and the running job is left to finish so a half-uploaded site is never
-# what a reader lands on.
+# what a reader lands on. The group is keyed on the ref, since GitHub cancels
+# a pending run when a newer one queues in the same group, and a branch
+# preview must never displace a production deploy waiting behind another.
 concurrency:
-  group: deploy
+  group: deploy-${{ github.ref_name }}
   cancel-in-progress: false
 
 permissions:
@@ -26,6 +32,7 @@ permissions:
 jobs:
   build:
     name: 📦 Build
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -92,12 +99,67 @@ jobs:
           name: dist
           path: dist
 
+      # `pages-deployment-alias-url` is an output from wrangler 3.78 on, so the
+      # version is pinned rather than left to the action's default.
       - name: Publish
+        id: publish
         if: steps.secrets-check.outputs.skip == 'false'
         uses: cloudflare/wrangler-action@v3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          wranglerVersion: '3.90.0'
           # Fill in this project's Pages project name, set when the
           # deploy-cloudflare skill runs wrangler pages project create.
           command: pages deploy dist --project-name=REPLACE_WITH_PROJECT_NAME --branch=${{ github.ref_name }}
+
+      # `canon pr preview` reads this line out of the run log, so the marker is
+      # a contract rather than decoration. The alias is read off the deploy
+      # rather than computed from the branch name, since Cloudflare flattens
+      # and may truncate a branch into its alias.
+      - name: Report preview alias
+        if: steps.publish.outputs.pages-deployment-alias-url != ''
+        env:
+          ALIAS_URL: ${{ steps.publish.outputs.pages-deployment-alias-url }}
+        run: |
+          echo "canon-preview-alias: $ALIAS_URL"
+          echo "Preview: $ALIAS_URL" >> "$GITHUB_STEP_SUMMARY"
+
+  cleanup-preview:
+    name: 🧹 Delete Branch Previews
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      # Deployments are listed through the REST API rather than wrangler, whose
+      # listing carries no branch filter. `force=true` is what lets a deployment
+      # still holding its branch alias be deleted. An absent secret skips the
+      # job the way the deploy's own guard does.
+      - name: Delete preview deployments
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          # Fill in the same Pages project name the Publish step deploys to.
+          PROJECT_NAME: REPLACE_WITH_PROJECT_NAME
+          BRANCH: ${{ github.head_ref }}
+        run: |
+          if [ -z "$CLOUDFLARE_API_TOKEN" ] || [ -z "$CLOUDFLARE_ACCOUNT_ID" ]; then
+            echo "::notice::CLOUDFLARE_API_TOKEN or CLOUDFLARE_ACCOUNT_ID is not set, skipping preview cleanup."
+            exit 0
+          fi
+          api="https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/pages/projects/$PROJECT_NAME/deployments"
+          auth="Authorization: Bearer $CLOUDFLARE_API_TOKEN"
+          page=1
+          ids=""
+          while :; do
+            listing=$(curl -fsS -H "$auth" "$api?env=preview&per_page=25&page=$page")
+            [ "$(echo "$listing" | jq '.result | length')" -eq 0 ] && break
+            ids="$ids $(echo "$listing" | jq -r --arg branch "$BRANCH" '.result[] | select(.deployment_trigger.metadata.branch == $branch) | .id')"
+            page=$((page + 1))
+          done
+          deleted=0
+          for id in $ids; do
+            curl -fsS -X DELETE -H "$auth" "$api/$id?force=true" >/dev/null
+            echo "Deleted $id"
+            deleted=$((deleted + 1))
+          done
+          echo "Deleted $deleted preview deployments for $BRANCH."

package/tooling/cloudflare/reference.md

@@ -8,7 +8,10 @@ The cloudflare stack ships one parameterized GitHub Actions workflow that deploy
 
 - Separate `build` and `deploy` jobs, connected by an uploaded artifact, converged on the shape already running in the closest prior art rather than invented fresh.
 - The deploy job checks for `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID` before doing anything else, and skips with a `::notice::` rather than failing when either is absent. A first merge lands ahead of the Pages project existing, and this guard is what keeps that push green.
-- `--branch=${{ github.ref_name }}` on every deploy, which gives every branch a Cloudflare preview URL rather than only `main`.
+- `--branch=${{ github.ref_name }}` on every deploy, which gives every branch a Cloudflare preview URL rather than only `main`. A `workflow_dispatch` run from a branch therefore lands on a preview and never on production, which is what makes dispatching the workflow from an unmerged branch safe.
+- The Publish step carries `id: publish` and pins `wranglerVersion`, since the `pages-deployment-alias-url` output it reads first appears in wrangler 3.78. A step after it prints that alias to the job log as `canon-preview-alias: <url>` and to the step summary. `canon pr preview` reads the line out of the run log, so the marker text is a contract with the CLI rather than decoration.
+- The concurrency group carries `${{ github.ref_name }}`. GitHub cancels a pending run when a newer one queues in the same group, so a shared group would let a branch preview displace a production deploy waiting its turn.
+- A `pull_request` trigger on `closed` runs only the `cleanup-preview` job, which deletes every preview deployment Cloudflare holds for that branch. It lists them through the Pages REST API, because the wrangler listing has no branch filter, and deletes each with `force=true` so a deployment still holding the branch alias goes too. It skips with a notice when the secrets are absent, the same as the deploy job.
 - The deploy job checks out the repository and installs Bun even though it builds nothing. `wrangler-action` resolves its package manager from `bun.lock` in the checkout, and dropping that step breaks the deploy on every push once the toolchain it relies on silently goes missing.
 
 ## Parameters a project fills in by hand
@@ -16,8 +19,8 @@ The cloudflare stack ships one parameterized GitHub Actions workflow that deploy
 Three values in the seeded file have no generic default and are set once, right after sync:
 
 - The `paths:` filter under the `push` trigger. The shipped default is a single `src/**` glob. Widen it to cover every path the build reads when the build draws on catalogs or generated content living outside `src/`.
-- The `concurrency.group` name. The shipped default is the bare string `deploy`, which is enough for a single-deploy project. Give it a project-specific name only if the project runs more than one deploy workflow.
-- The `--project-name` flag on the `wrangler pages deploy` command. Set it to the name the `deploy-cloudflare` skill creates the Pages project under.
+- The `concurrency.group` name. The shipped default is `deploy-${{ github.ref_name }}`, which is enough for a single-deploy project. Give the `deploy` prefix a project-specific name only if the project runs more than one deploy workflow, and keep the ref suffix.
+- The Pages project name, written twice as `REPLACE_WITH_PROJECT_NAME`: once in the `--project-name` flag on the `wrangler pages deploy` command and once as `PROJECT_NAME` in the cleanup job. Set both to the name the `deploy-cloudflare` skill creates the Pages project under.
 
 ## Re-sync
 

package/tooling/nextjs/configs/playwright.config.ts

@@ -12,7 +12,9 @@ export default defineConfig({
     trace: 'on-first-retry',
     baseURL,
     // Nothing to wait out unless a test asserts motion. Opt back in per test with page.emulateMedia({ reducedMotion: 'no-preference' }).
-    reducedMotion: 'reduce',
+    // It is a context option rather than a top-level one, so written beside
+    // `baseURL` it type-checks nowhere and reaches no page.
+    contextOptions: { reducedMotion: 'reduce' },
   },
   projects: [
     { name: 'chromium', use: { ...devices['Desktop Chrome'] } },

package/tooling/vite-react/configs/playwright.config.ts

@@ -14,7 +14,9 @@ export default defineConfig({
     trace: 'on-first-retry',
     baseURL,
     // Nothing to wait out unless a test asserts motion. Opt back in per test with page.emulateMedia({ reducedMotion: 'no-preference' }).
-    reducedMotion: 'reduce',
+    // It is a context option rather than a top-level one, so written beside
+    // `baseURL` it type-checks nowhere and reaches no page.
+    contextOptions: { reducedMotion: 'reduce' },
   },
   projects: [
     { name: 'chromium', use: { ...devices['Desktop Chrome'] } },

package/tooling/web/configs/e2e/home.spec.ts

@@ -4,3 +4,11 @@ test('home page loads', async ({ page }) => {
   await page.goto('/')
   await expect(page).toHaveTitle(/.+/)
 })
+
+test('reduced motion reaches the page', async ({ page }) => {
+  await page.goto('/')
+  const isReduced = await page.evaluate(
+    () => window.matchMedia('(prefers-reduced-motion: reduce)').matches,
+  )
+  expect(isReduced).toBe(true)
+})