@norskvideo/ctl-dev-kit 0.2.94 → 0.2.95

package/conventions/docs-site.md

@@ -231,10 +231,11 @@ What the repo needs, per site, and none of it to build or review one locally:
 
 1. **A Cloudflare Pages project**, e.g. `norsk-acme-docs`.
 2. **A custom domain** on it — `<product>.norsk.video` — and the DNS record.
-3. **Two repo secrets.** `CLOUDFLARE_API_TOKEN`, a Pages:Edit token — the
-   existing one is deliberately narrow and must cover the new project: widen it
-   to all Pages projects in the account, or issue a second token — and
-   `CLOUDFLARE_ACCOUNT_ID`. The workflow verifies the token at the API (both the
+3. **The Cloudflare credentials reaching the repo.** The secret
+   `CLOUDFLARE_API_TOKEN`, a Pages:Edit token that covers the new project
+   (Pages permissions are account-wide), and the variable
+   `CLOUDFLARE_ACCOUNT_ID`. Both are org-level, shared with selected
+   repositories: add the repo to each. The workflow verifies the token at the API (both the
    user-owned and the account-owned endpoint), never with `wrangler whoami`,
    which a Pages:Edit token cannot answer.
 4. **One repo variable.** `NORSK_DOCS_SITE_PROJECT`, the project name from

package/conventions/publish-docs-site.yml

@@ -26,7 +26,9 @@
 #                                      site publishes the day the variable is
 #                                      set, with no change here.
 #   secret   CLOUDFLARE_API_TOKEN      a Pages:Edit token covering that project
-#   secret   CLOUDFLARE_ACCOUNT_ID     the account the project lives in
+#   variable CLOUDFLARE_ACCOUNT_ID     the account the project lives in: not a
+#                                      secret, and the org already shares it as
+#                                      a variable (norsk-ctl reads it the same way)
 #
 # The site is BUILT whether or not it will be deployed: if the build is only
 # exercised on the day the Pages project appears, that day is when we find out
@@ -209,7 +211,7 @@ jobs:
       - name: Deploy to Cloudflare Pages
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
           NORSK_DOCS_SITE_PROJECT: ${{ vars.NORSK_DOCS_SITE_PROJECT }}
           PAGES_BRANCH: ${{ github.ref_name }}
         run: |
@@ -222,13 +224,13 @@ jobs:
             echo "     1. Create a Cloudflare Pages project for this site (e.g. $(basename "$GITHUB_REPOSITORY")-docs)."
             echo "     2. Add its custom domain${origin:+ (${origin#https://})} and the DNS record."
             echo "     3. Make sure CLOUDFLARE_API_TOKEN (Pages:Edit) covers that project, and that"
-            echo "        CLOUDFLARE_ACCOUNT_ID is set as a repo secret."
+            echo "        the variable CLOUDFLARE_ACCOUNT_ID reaches this repo."
             echo "     4. Set the repo variable NORSK_DOCS_SITE_PROJECT to the project name."
             echo "   Nothing in this workflow changes. See @norskvideo/ctl-dev-kit conventions/docs-site.md, Publishing."
             exit 0
           fi
           if [ -z "${CLOUDFLARE_API_TOKEN:-}" ] || [ -z "${CLOUDFLARE_ACCOUNT_ID:-}" ]; then
-            echo "::error::NORSK_DOCS_SITE_PROJECT=$NORSK_DOCS_SITE_PROJECT is set, but CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID must both be repo secrets"
+            echo "::error::NORSK_DOCS_SITE_PROJECT=$NORSK_DOCS_SITE_PROJECT is set, but this repo needs both the secret CLOUDFLARE_API_TOKEN and the variable CLOUDFLARE_ACCOUNT_ID"
             exit 1
           fi
           cf_verify() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.94",
+  "version": "0.2.95",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",