breakaway 1.3.2 → 1.4.0-main.18

package/template/pipeline/promote.yml

@@ -0,0 +1,203 @@
+# {{header}}
+#
+# Promote: puts the staging build the owner chose live on production, the Worker {{productionName}}. It deploys the
+# files Deploy built and kept for that commit, and builds nothing. The board's Promote button starts it, or Actions,
+# Run workflow, with the commit staging runs. Agents never run this workflow.
+name: Promote
+
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: The full commit of the staging build to put live
+        required: true
+        type: string
+      destructive_ok:
+        description: I've read the destructive migrations it carries, and they may run
+        required: false
+        default: false
+        type: boolean
+
+permissions: {}
+
+# Production deploys one at a time, and a rollback waits for a promote (and the other way round).
+concurrency:
+  group: deploy-production
+  cancel-in-progress: false
+
+env:
+  STAGING: {{staging}}
+  PRODUCTION: {{production}}
+  BRANCH: {{branch}}
+  HEALTH_URL: {{healthProduction}}
+
+jobs:
+  production:
+    name: production
+    if: github.ref == 'refs/heads/{{branchName}}'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    # CLOUDFLARE_API_TOKEN is a secret of this environment, which only {{branchName}} may use: a token for the
+    # production Worker only.
+    environment: production
+    permissions:
+      contents: write
+      deployments: write
+      actions: read
+      pull-requests: read
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      GH_TOKEN: ${{ github.token }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      DEPLOYS_PAUSED: ${{ vars.DEPLOYS_PAUSED }}
+      SHA: ${{ inputs.sha }}
+      DESTRUCTIVE_OK: ${{ inputs.destructive_ok }}
+      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      BREAKAWAY_ENV: production
+      WORKER: {{production}}
+    steps:
+      # The helpers run from {{branchName}}; the build comes from the artifact Deploy kept.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Fetch the staging build
+        id: artifact
+        run: |
+          set -euo pipefail
+          if ! [[ "$SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error title=Not a commit::Give the full commit of the staging build to promote (40 characters)."
+            exit 1
+          fi
+          id=$(gh api "repos/$GITHUB_REPOSITORY/actions/artifacts?name=release-$SHA&per_page=1" --jq '[.artifacts[] | select(.expired | not)][0].id // empty')
+          if [ -z "$id" ]; then
+            echo "::error title=No stored build::Deploy kept no build of ${SHA:0:7}, or it expired after 90 days, so there is nothing to promote. Merge to $BRANCH to make a new candidate."
+            exit 1
+          fi
+          mkdir -p "$RUNNER_TEMP/release"
+          gh api "repos/$GITHUB_REPOSITORY/actions/artifacts/$id/zip" > "$RUNNER_TEMP/release.zip"
+          unzip -q "$RUNNER_TEMP/release.zip" -d "$RUNNER_TEMP/release"
+          echo "digest=$(node scripts/release-artifact.mjs digest "$RUNNER_TEMP/release")" >> "$GITHUB_OUTPUT"
+
+      # The same refusals as the board's Promote button, checked again here: not paused, the latest successful staging
+      # build, on {{branchName}}, not live already, and the stored build is the one staging ran.
+      - name: Check the candidate
+        id: check
+        env:
+          DIGEST: ${{ steps.artifact.outputs.digest }}
+        run: node scripts/promote-check.mjs --staging "$STAGING" --production "$PRODUCTION" --sha "$SHA" --artifact-digest "$DIGEST" --branch "$BRANCH"
+
+      - name: Check its migrations
+        id: migrations
+        run: |
+          set -euo pipefail
+          live=$(node scripts/deploy-plan.mjs live --environment "$PRODUCTION" | sed 's/^sha=//')
+          echo "live=$live" >> "$GITHUB_OUTPUT"
+          if [ -n "$live" ]; then
+            added=$(git diff --name-only --diff-filter=A "$live" "$SHA" -- migrations | grep '\.sql$' || true)
+          else
+            added=$(git ls-tree -r --name-only "$SHA" -- migrations | grep '\.sql$' || true)
+          fi
+          echo "migrations=$(echo "$added" | xargs -r -n1 basename | paste -sd, -)" >> "$GITHUB_OUTPUT"
+          # A migration that destroys data carries an owner-approved line, and runs only when the owner ticked it.
+          destructive=""
+          for file in $added; do
+            if git show "$SHA:$file" | grep -qE '^[[:space:]]*--[[:space:]]*owner-approved:[[:space:]]*[^[:space:]]'; then destructive="$destructive $(basename "$file")"; fi
+          done
+          if [ -n "$destructive" ] && [ "$DESTRUCTIVE_OK" != true ]; then
+            echo "::error title=Destructive migration::${SHA:0:7} carries a migration that destroys data:$destructive. Read it, then promote again with destructive_ok."
+            exit 1
+          fi
+
+      - name: Record the start
+        id: record
+        run: |
+          node scripts/record-deployment.mjs --environment "$PRODUCTION" --sha "$SHA" --production --state in_progress --description "promoting: starting" --log-url "$RUN_URL"
+
+      - name: Deploy to production
+        id: deploy
+        env:
+          DEPLOYMENT: ${{ steps.record.outputs.deployment }}
+        run: |
+          set -euo pipefail
+          helpers="$GITHUB_WORKSPACE/scripts"
+          step() { node "$helpers/record-deployment.mjs" --deployment "$DEPLOYMENT" --state in_progress --description "promoting: $1" > /dev/null; }
+          mkdir -p "$RUNNER_TEMP/app"
+          tar -xzf "$RUNNER_TEMP/release/tree.tgz" -C "$RUNNER_TEMP/app"
+          cd "$RUNNER_TEMP/app"
+          wrangler() { npx --yes wrangler "$@" --name "$WORKER"{{productionEnvFlag}}; }
+          previous=""
+          if wrangler deployments list --json > "$RUNNER_TEMP/deployments.json" 2> "$RUNNER_TEMP/list-error.txt"; then
+            previous=$(node "$helpers/deploy-plan.mjs" current < "$RUNNER_TEMP/deployments.json" | sed 's/^version=//')
+          else
+            cat "$RUNNER_TEMP/deployments.json" "$RUNNER_TEMP/list-error.txt" | node "$helpers/deploy-plan.mjs" missing > /dev/null
+          fi
+          step migrating
+          {{@beforeDeploy}}
+          step deploying
+          export WRANGLER_OUTPUT_FILE_PATH="$RUNNER_TEMP/wrangler-output.ndjson"
+          if [ -z "$previous" ]; then
+            wrangler deploy --message "${SHA:0:7}"
+            version=$(node "$helpers/deploy-plan.mjs" uploaded < "$WRANGLER_OUTPUT_FILE_PATH" | sed 's/^version=//')
+          else
+            wrangler versions upload --message "${SHA:0:7}"
+            version=$(node "$helpers/deploy-plan.mjs" uploaded < "$WRANGLER_OUTPUT_FILE_PATH" | sed 's/^version=//')
+            wrangler versions deploy "$version@100%" --message "${SHA:0:7}" --yes
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          step checking
+          if [ -z "$HEALTH_URL" ]; then
+            echo "::notice title=Not checked::Production runs ${SHA:0:7} as version $version. Set healthCheck.production in .github/breakaway-pipeline.json and the next promote checks it, and goes back if it doesn't answer."
+            exit 0
+          fi
+          for attempt in $(seq 1 18); do
+            if curl -fsS --max-time 10 -o /dev/null "$HEALTH_URL"; then
+              echo "Production runs ${SHA:0:7} as version $version, and $HEALTH_URL answers."
+              exit 0
+            fi
+            sleep 5
+          done
+          if [ -n "$previous" ] && wrangler rollback "$previous" --message "${SHA:0:7} failed its check" --yes; then
+            echo "rolled_back=true" >> "$GITHUB_OUTPUT"
+            echo "::error title=Rolled back::${SHA:0:7} didn't answer $HEALTH_URL within 90 seconds, so production went back to version $previous. Read the Worker's logs on Cloudflare."
+          else
+            echo "::error title=Failed its check::${SHA:0:7} didn't answer $HEALTH_URL within 90 seconds, and production had no version to go back to. Read the Worker's logs on Cloudflare."
+          fi
+          exit 1
+
+      - name: Record the end
+        if: always() && steps.record.outputs.deployment
+        env:
+          DEPLOYMENT: ${{ steps.record.outputs.deployment }}
+          OUTCOME: ${{ job.status }}
+          VERSION: ${{ steps.deploy.outputs.version }}
+          DIGEST: ${{ steps.artifact.outputs.digest }}
+          MIGRATIONS: ${{ steps.migrations.outputs.migrations }}
+          ROLLED_BACK: ${{ steps.deploy.outputs.rolled_back }}
+        run: |
+          set -euo pipefail
+          record() { node scripts/record-deployment.mjs --deployment "$DEPLOYMENT" --log-url "$RUN_URL" "$@" > /dev/null; }
+          if [ "$OUTCOME" = success ]; then
+            record --state success --version "$VERSION" --artifact "$DIGEST" --migrations "$MIGRATIONS" ${HEALTH_URL:+--environment-url "$HEALTH_URL"}
+          elif [ "$ROLLED_BACK" = true ]; then
+            record --state failure --description "rolled back: version $VERSION failed its check"
+          else
+            record --state failure --description "failed: the run says why"
+          fi
+
+      # Production only: a tag and a GitHub release with every pull request since what production ran before.
+      - name: Tag and release
+        env:
+          LIVE: ${{ steps.migrations.outputs.live }}
+          VERSION: ${{ steps.deploy.outputs.version }}
+        run: |
+          set -euo pipefail
+          tag="v$(date -u +%Y%m%d)-${SHA:0:7}"
+          from=${LIVE:-$(git rev-list --max-parents=0 "$SHA" | tail -1)}
+          node scripts/release-notes.mjs --title "${GITHUB_REPOSITORY#*/}" --version "$tag" --from "$from" --to "$SHA" > "$RUNNER_TEMP/notes.md"
+          gh release create "$tag" --repo "$GITHUB_REPOSITORY" --target "$SHA" --title "$tag" --notes-file "$RUNNER_TEMP/notes.md" --latest

package/template/pipeline/release.yml

@@ -0,0 +1,212 @@
+# {{header}}
+#
+# Release: the npm package {{packageName}}. Every merge to {{branchName}} that passes its checks stages a pre-release,
+# X.Y.Z-main.N, on next; the owner releases one as the stable X.Y.Z, on latest, from the same commit. Nothing is
+# published by itself: each version waits, staged on npm, until the owner approves it with 2FA (npm stage approve, or
+# Staged Packages on npmjs.com). The version comes from {{packageDirectory}}/package.json. Keep this file's name: npm's
+# trusted publisher names it, with the npm environment. Agents never run this workflow.
+name: Release
+
+on:
+  workflow_run:
+    workflows: {{checks}}
+    types: [completed]
+    branches: [{{branch}}]
+  # The owner releases a pre-release as stable: the board's Release button, or Actions, Run workflow.
+  workflow_dispatch:
+    inputs:
+      prerelease:
+        description: The pre-release to release as stable, like {{prefixName}}1.4.0-main.5
+        required: true
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+env:
+  PACKAGE: {{package}}
+  DIRECTORY: {{directory}}
+  ACCESS: {{access}}
+  # The tags that count the versions: <prefix>X.Y.Z-main.N for each pre-release, <prefix>X.Y.Z for each stable.
+  PREFIX: {{prefix}}
+  CHECKS: {{checksEnv}}
+
+jobs:
+  prerelease:
+    name: pre-release
+    if: github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    # The npm environment, which only {{branchName}} may use, is where npm's trusted publisher points, and holds
+    # NPM_TOKEN until that applies.
+    environment: npm
+    permissions:
+      contents: write
+      id-token: write
+      actions: read
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      GH_TOKEN: ${{ github.token }}
+      SHA: ${{ github.event.workflow_run.head_sha }}
+      DEPLOYS_PAUSED: ${{ vars.DEPLOYS_PAUSED }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - name: Check it should release
+        id: plan
+        run: |
+          set -euo pipefail
+          if [ "$DEPLOYS_PAUSED" = true ]; then
+            echo "::notice title=Paused::Releases are paused (DEPLOYS_PAUSED is true), so ${SHA:0:7} staged nothing."
+            echo "ready=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          node scripts/deploy-plan.mjs checks --sha "$SHA" --checks "$CHECKS" >> "$GITHUB_OUTPUT"
+
+      - name: Pick the version
+        id: version
+        if: steps.plan.outputs.ready == 'true'
+        run: node scripts/package-release.mjs prerelease --dir "$DIRECTORY" --prefix "$PREFIX" --sha "$SHA" >> "$GITHUB_OUTPUT"
+
+      - name: Install and build
+        if: steps.plan.outputs.ready == 'true' && steps.version.outputs.exists == 'false'
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          set -euo pipefail
+          if grep -q '"packageManager"' package.json 2>/dev/null; then corepack enable; fi
+          {{@install}}
+          {{@build}}
+          node -e "const f=require('path').join(process.env.DIRECTORY,'package.json'),p=JSON.parse(require('fs').readFileSync(f));p.version=process.env.VERSION;require('fs').writeFileSync(f,JSON.stringify(p,null,2)+'\n')"
+
+      # Staged, never published: it goes live on next once the owner approves it with 2FA. npm tries trusted publishing
+      # first; NPM_TOKEN stands in until it applies, a token that can't bypass 2FA, so it never publishes by itself.
+      - name: Stage it on npm
+        if: steps.plan.outputs.ready == 'true' && steps.version.outputs.exists == 'false'
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+          DIST_TAG: next
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # npm refuses provenance from a private repository.
+          PROVENANCE: ${{ github.event.repository.private && 'no' || 'yes' }}
+        run: |
+          set -euo pipefail
+          cd "$DIRECTORY"
+          npm install -g npm@^11.15.0
+          provenance=""
+          if [ "$PROVENANCE" = yes ]; then provenance=--provenance; fi
+          # npm says why trusted publishing didn't apply only in its verbose log. Keep that log to the runner and show
+          # npm's usual lines, and on a failure its oidc lines: never the whole verbose log.
+          if npm stage publish $provenance --access "$ACCESS" --tag "$DIST_TAG" --loglevel verbose > "$RUNNER_TEMP/npm.log" 2>&1; then
+            grep -vE '^npm (verbose|http|timing|silly)' "$RUNNER_TEMP/npm.log" || true
+            echo "::notice title=Staged on npm::$PACKAGE@$VERSION goes live on $DIST_TAG once the owner approves it with 2FA: npm stage approve <id>, or Staged Packages on npmjs.com."
+          else
+            grep -vE '^npm (verbose|http|timing|silly)' "$RUNNER_TEMP/npm.log" || true
+            if grep -qiE 'previously published|cannot publish over' "$RUNNER_TEMP/npm.log"; then
+              echo "::error title=Already on npm::$PACKAGE@$VERSION is already on npm, and npm takes a version once. Nothing was staged."
+              exit 1
+            fi
+            echo "npm's trusted publishing (OIDC):"
+            oidc=$(grep -i 'oidc' "$RUNNER_TEMP/npm.log" | grep -v 'eyJ' | cut -c1-300 || true)
+            echo "${oidc:-npm logged nothing about it.}"
+            echo "::error title=npm refused to stage it::npm's trusted publisher for $PACKAGE must name exactly: GitHub Actions, user ${GITHUB_REPOSITORY%%/*}, repository ${GITHUB_REPOSITORY#*/}, workflow release.yml, environment npm. Until it applies, the npm environment needs NPM_TOKEN: a granular token with read and write access to $PACKAGE that doesn't bypass 2FA."
+            exit 1
+          fi
+
+      - name: Tag it
+        if: steps.plan.outputs.ready == 'true' && steps.version.outputs.exists == 'false'
+        env:
+          TAG: ${{ steps.version.outputs.tag }}
+        run: gh api -X POST "repos/$GITHUB_REPOSITORY/git/refs" -f "ref=refs/tags/$TAG" -f "sha=$SHA" > /dev/null
+
+  stable:
+    name: stable
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/{{branchName}}'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    environment: npm
+    permissions:
+      contents: write
+      id-token: write
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      GH_TOKEN: ${{ github.token }}
+      PRERELEASE: ${{ inputs.prerelease }}
+      DEPLOYS_PAUSED: ${{ vars.DEPLOYS_PAUSED }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - name: Pick the stable
+        id: version
+        run: |
+          set -euo pipefail
+          if [ "$DEPLOYS_PAUSED" = true ]; then
+            echo "::error title=Paused::Releases are paused (DEPLOYS_PAUSED is true). Release again when the pause is over."
+            exit 1
+          fi
+          node scripts/package-release.mjs stable "$PRERELEASE" --prefix "$PREFIX" >> "$GITHUB_OUTPUT"
+
+      # The pre-release's own commit, under the stable version: nothing from a later commit.
+      - name: Install and build the pre-release's commit
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+          COMMIT: ${{ steps.version.outputs.commit }}
+        run: |
+          set -euo pipefail
+          git checkout --detach "$COMMIT"
+          if grep -q '"packageManager"' package.json 2>/dev/null; then corepack enable; fi
+          {{@install}}
+          {{@build}}
+          node -e "const f=require('path').join(process.env.DIRECTORY,'package.json'),p=JSON.parse(require('fs').readFileSync(f));p.version=process.env.VERSION;require('fs').writeFileSync(f,JSON.stringify(p,null,2)+'\n')"
+
+      - name: Stage it on npm
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+          DIST_TAG: latest
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          PROVENANCE: ${{ github.event.repository.private && 'no' || 'yes' }}
+        run: |
+          set -euo pipefail
+          cd "$DIRECTORY"
+          npm install -g npm@^11.15.0
+          provenance=""
+          if [ "$PROVENANCE" = yes ]; then provenance=--provenance; fi
+          if npm stage publish $provenance --access "$ACCESS" --tag "$DIST_TAG" --loglevel verbose > "$RUNNER_TEMP/npm.log" 2>&1; then
+            grep -vE '^npm (verbose|http|timing|silly)' "$RUNNER_TEMP/npm.log" || true
+            echo "::notice title=Staged on npm::$PACKAGE@$VERSION goes live on $DIST_TAG once the owner approves it with 2FA: npm stage approve <id>, or Staged Packages on npmjs.com."
+          else
+            grep -vE '^npm (verbose|http|timing|silly)' "$RUNNER_TEMP/npm.log" || true
+            if grep -qiE 'previously published|cannot publish over' "$RUNNER_TEMP/npm.log"; then
+              echo "::error title=Already on npm::$PACKAGE@$VERSION is already on npm, and npm takes a version once. Nothing was staged."
+              exit 1
+            fi
+            echo "npm's trusted publishing (OIDC):"
+            oidc=$(grep -i 'oidc' "$RUNNER_TEMP/npm.log" | grep -v 'eyJ' | cut -c1-300 || true)
+            echo "${oidc:-npm logged nothing about it.}"
+            echo "::error title=npm refused to stage it::npm's trusted publisher for $PACKAGE must name exactly: GitHub Actions, user ${GITHUB_REPOSITORY%%/*}, repository ${GITHUB_REPOSITORY#*/}, workflow release.yml, environment npm. Until it applies, the npm environment needs NPM_TOKEN: a granular token with read and write access to $PACKAGE that doesn't bypass 2FA."
+            exit 1
+          fi
+
+      - name: Tag it
+        env:
+          TAG: ${{ steps.version.outputs.tag }}
+          COMMIT: ${{ steps.version.outputs.commit }}
+        run: gh api -X POST "repos/$GITHUB_REPOSITORY/git/refs" -f "ref=refs/tags/$TAG" -f "sha=$COMMIT" > /dev/null

package/template/pipeline/rollback.yml

@@ -0,0 +1,98 @@
+# {{header}}
+#
+# Roll back: puts production, the Worker {{productionName}}, back on a version it ran before. The board's Roll back
+# button starts it, or Actions, Run workflow (the GitHub mobile app too). It is never paused. Staging goes back by
+# deploying again. Agents never run this workflow.
+name: Roll back
+
+on:
+  workflow_dispatch:
+    inputs:
+      worker:
+        description: The Worker to roll back (production's)
+        required: true
+        default: {{production}}
+        type: string
+      version:
+        description: The version to go back to (blank for the one before)
+        required: false
+        type: string
+      reason:
+        description: What broke
+        required: true
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: deploy-production
+  cancel-in-progress: false
+
+env:
+  PRODUCTION: {{production}}
+  HEALTH_URL: {{healthProduction}}
+
+jobs:
+  rollback:
+    name: roll back
+    if: github.ref == 'refs/heads/{{branchName}}'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: production
+    permissions:
+      contents: read
+      deployments: write
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      TARGET: ${{ inputs.worker }}
+      VERSION: ${{ inputs.version }}
+      REASON: ${{ inputs.reason }}
+      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Roll back
+        run: |
+          set -euo pipefail
+          if [ "$TARGET" != "$PRODUCTION" ]; then
+            echo "::error title=Production only::Roll back runs on production, $PRODUCTION, not $TARGET. Staging goes back by deploying again."
+            exit 1
+          fi
+          if [ -n "$VERSION" ] && ! [[ "$VERSION" =~ ^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$ ]]; then
+            echo "::error title=Not a version::$VERSION isn't a Worker version ID. Leave it blank to go back to the one before."
+            exit 1
+          fi
+          helpers="$GITHUB_WORKSPACE/scripts"
+          # Outside the checkout, so wrangler reads no config: the Worker is named, and only its versions change.
+          cd "$RUNNER_TEMP"
+          wrangler() { npx --yes wrangler@4 "$@" --name "$PRODUCTION"; }
+          wrangler rollback ${VERSION:+"$VERSION"} --message "$REASON" --yes
+          wrangler deployments list --json > deployments.json
+          now=$(node "$helpers/deploy-plan.mjs" current < deployments.json | sed 's/^version=//')
+          sha=$(node "$helpers/deploy-plan.mjs" sha-of --environment "$PRODUCTION" --version "$now" | sed 's/^sha=//')
+          if [ -z "$sha" ]; then
+            echo "::warning title=Commit unknown::No Deployment recorded version $now, so the rollback is recorded on $GITHUB_SHA."
+            sha=$GITHUB_SHA
+          fi
+          deployment=$(node "$helpers/record-deployment.mjs" --environment "$PRODUCTION" --sha "$sha" --task rollback --production --state in_progress --description "rolling back" --log-url "$RUN_URL")
+          state=success
+          if [ -n "$HEALTH_URL" ]; then
+            state=failure
+            for attempt in $(seq 1 18); do
+              if curl -fsS --max-time 10 -o /dev/null "$HEALTH_URL"; then state=success; break; fi
+              sleep 5
+            done
+          fi
+          node "$helpers/record-deployment.mjs" --deployment "$deployment" --state "$state" --note "rolled back: $REASON" --version "$now" --log-url "$RUN_URL" > /dev/null
+          if [ "$state" != success ]; then
+            echo "::error title=Still failing::Production went back to version $now, but $HEALTH_URL doesn't answer. Read the Worker's logs on Cloudflare."
+            exit 1
+          fi
+          echo "Production runs version $now again (${sha:0:7})."