code-foundry 1.11.0 → 1.12.0

package/.github/workflows/cloudflare-delivery.yml

@@ -0,0 +1,354 @@
+name: Code Foundry Cloudflare Delivery
+
+on:
+  workflow_call:
+    inputs:
+      runtime-ref:
+        description: 'Immutable 40-character Code Foundry commit SHA containing this workflow and its helper.'
+        required: true
+        type: string
+      worker-name:
+        description: 'Exact effective Worker name, including any Wrangler environment suffix.'
+        required: true
+        type: string
+      artifact-path:
+        description: 'Build output subdirectory relative to working-directory; must cover uploaded code/assets.'
+        required: true
+        type: string
+      verify-command:
+        description: 'Required JSON argv array. Receives BASE_URL and FOUNDRY_DEPLOYMENT_PHASE.'
+        required: true
+        type: string
+      mode:
+        required: false
+        type: string
+        default: preview
+      working-directory:
+        required: false
+        type: string
+        default: '.'
+      install-working-directory:
+        required: false
+        type: string
+        default: '.'
+      build-script:
+        required: false
+        type: string
+        default: build
+      bun-version:
+        required: false
+        type: string
+        default: '1.4.0'
+      wrangler-version:
+        description: 'local uses the locked workspace installation; otherwise specify an exact version.'
+        required: false
+        type: string
+        default: local
+      wrangler-environment:
+        required: false
+        type: string
+        default: ''
+      wrangler-config:
+        required: false
+        type: string
+        default: ''
+      production-url:
+        required: false
+        type: string
+        default: ''
+      canary-verify-command:
+        description: 'Required JSON argv when canary-percentage is below 100; must prove the live request served this version.'
+        required: false
+        type: string
+        default: ''
+      smoke-path:
+        required: false
+        type: string
+        default: '/'
+      binding-policy-file:
+        description: 'Optional reviewed binding policy; undeclared stateful bindings fail closed.'
+        required: false
+        type: string
+        default: ''
+      canary-percentage:
+        description: '100 promotes directly; a lower value verifies a canary before final promotion.'
+        required: false
+        type: number
+        default: 100
+      auto-rollback:
+        description: 'Requires explicit rollbackSafe policy and no stateful bindings. Never restores resource data.'
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      CLOUDFLARE_API_TOKEN:
+        required: true
+      CLOUDFLARE_ACCOUNT_ID:
+        required: true
+    outputs:
+      preview-url:
+        value: ${{ jobs.candidate.outputs.url }}
+      version-id:
+        value: ${{ jobs.candidate.outputs.version-id }}
+      source-sha:
+        value: ${{ jobs.candidate.outputs.source-sha }}
+      artifact-digest:
+        value: ${{ jobs.candidate.outputs.artifact-digest }}
+      cloudflare-deployment-id:
+        value: ${{ jobs.promote.outputs.cloudflare-deployment-id }}
+      github-deployment-id:
+        value: ${{ jobs.promote.outputs.github-deployment-id || jobs.candidate.outputs.github-deployment-id }}
+
+permissions:
+  contents: read
+  deployments: write
+
+# All production deliveries for an application serialize; old commits are checked
+# again after environment approval. Never cancel a deployment mid-promotion.
+concurrency:
+  group: code-foundry-cloudflare-${{ github.repository }}-${{ inputs.worker-name }}-${{ inputs.mode }}
+  cancel-in-progress: false
+
+jobs:
+  candidate:
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      github.event_name != 'pull_request_target' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment:
+      name: Preview
+      url: ${{ steps.upload.outputs.url }}
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+    env:
+      FOUNDRY_MODE: ${{ inputs.mode }}
+      FOUNDRY_WORKER: ${{ inputs.worker-name }}
+      FOUNDRY_PHASE: candidate
+      FOUNDRY_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      ARTIFACT_PATH: ${{ inputs.artifact-path }}
+      VERIFY_COMMAND: ${{ inputs.verify-command }}
+      SMOKE_PATH: ${{ inputs.smoke-path }}
+      WRANGLER_VERSION: ${{ inputs.wrangler-version }}
+      WRANGLER_ENVIRONMENT: ${{ inputs.wrangler-environment }}
+      WRANGLER_CONFIG: ${{ inputs.wrangler-config }}
+      BINDING_POLICY_FILE: ${{ inputs.binding-policy-file }}
+      DEPLOYMENT_ENVIRONMENT: Preview
+    outputs:
+      url: ${{ steps.upload.outputs.url }}
+      version-id: ${{ steps.upload.outputs.version-id }}
+      artifact-digest: ${{ steps.upload.outputs.artifact-digest }}
+      source-sha: ${{ steps.upload.outputs.source-sha }}
+      verified: ${{ steps.verify.outputs.verified }}
+      github-deployment-id: ${{ steps.start.outputs.github-deployment-id }}
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Validate inputs
+        env:
+          RUNTIME_REF: ${{ inputs.runtime-ref }}
+          CANARY_PERCENTAGE: ${{ inputs.canary-percentage }}
+          CANARY_VERIFY_COMMAND: ${{ inputs.canary-verify-command }}
+          PRODUCTION_URL: ${{ inputs.production-url }}
+        run: |
+          set -euo pipefail
+          [[ "$RUNTIME_REF" =~ ^[0-9a-fA-F]{40}$ ]]
+          [[ "$FOUNDRY_MODE" == preview || "$FOUNDRY_MODE" == production ]]
+          node --input-type=module <<'NODE'
+          const percentage = Number(process.env.CANARY_PERCENTAGE)
+          if (!Number.isFinite(percentage) || percentage < 0.01 || percentage > 100 || (percentage < 100 && percentage > 99.99)) process.exit(1)
+          if (process.env.FOUNDRY_MODE === 'production' && percentage < 100) {
+            let argv
+            try { argv = JSON.parse(process.env.CANARY_VERIFY_COMMAND ?? '') } catch { process.exit(1) }
+            if (!Array.isArray(argv) || !argv.length || argv.some((arg) => typeof arg !== 'string' || !arg.length || arg.includes('\0'))) process.exit(1)
+          }
+          NODE
+          if [[ "$FOUNDRY_MODE" == production ]]; then
+            [[ "$GITHUB_REF" == "refs/heads/$FOUNDRY_DEFAULT_BRANCH" ]]
+            [[ "$PRODUCTION_URL" == https://* ]]
+          fi
+      - name: Checkout delivery runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: 0xPlayerOne/code-foundry
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry-delivery
+          persist-credentials: false
+          sparse-checkout: src
+      - name: Prepare delivery state
+        run: |
+          echo "FOUNDRY_EXECUTOR=$GITHUB_WORKSPACE/.github/.code-foundry-delivery/src/commands/cloudflare-delivery.mjs" >> "$GITHUB_ENV"
+          echo "FOUNDRY_STATE_FILE=$RUNNER_TEMP/cloudflare-candidate.json" >> "$GITHUB_ENV"
+      - name: Record pending application deployment
+        id: start
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node "$FOUNDRY_EXECUTOR" record-start
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+      - name: Install locked dependencies
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile
+      - name: Build candidate
+        if: inputs.build-script != ''
+        env:
+          BUILD_SCRIPT: ${{ inputs.build-script }}
+        run: bun run "$BUILD_SCRIPT"
+      - name: Reject stale production source
+        if: inputs.mode == 'production'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node "$FOUNDRY_EXECUTOR" assert-current
+      - name: Upload candidate without changing traffic
+        id: upload
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: node "$FOUNDRY_EXECUTOR" upload
+      - name: Inspect actual candidate bindings
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: node "$FOUNDRY_EXECUTOR" inspect
+      - name: Verify candidate
+        id: verify
+        run: node "$FOUNDRY_EXECUTOR" verify
+      - name: Complete application deployment status
+        if: always() && steps.start.outputs.github-deployment-id != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          DEPLOYMENT_STATUS: ${{ job.status }}
+        run: node "$FOUNDRY_EXECUTOR" record-finish
+      - name: Preserve candidate evidence
+        if: always() && steps.start.outputs.github-deployment-id != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: cloudflare-candidate-${{ inputs.worker-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/cloudflare-candidate.json
+          if-no-files-found: error
+          retention-days: 14
+
+  promote:
+    needs: candidate
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      inputs.mode == 'production' && needs.candidate.outputs.verified == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment:
+      name: Production
+      url: ${{ inputs.production-url }}
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+    env:
+      FOUNDRY_MODE: production
+      FOUNDRY_PHASE: production
+      FOUNDRY_WORKER: ${{ inputs.worker-name }}
+      FOUNDRY_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      VERIFY_COMMAND: ${{ inputs.verify-command }}
+      SMOKE_PATH: ${{ inputs.smoke-path }}
+      PRODUCTION_URL: ${{ inputs.production-url }}
+      BINDING_POLICY_FILE: ${{ inputs.binding-policy-file }}
+      DEPLOYMENT_ENVIRONMENT: Production
+      AUTO_ROLLBACK: ${{ inputs.auto-rollback }}
+    outputs:
+      cloudflare-deployment-id: ${{ steps.promote.outputs.cloudflare-deployment-id || steps.canary.outputs.cloudflare-deployment-id }}
+      github-deployment-id: ${{ steps.start.outputs.github-deployment-id }}
+    steps:
+      - name: Checkout verified source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ needs.candidate.outputs.source-sha }}
+          persist-credentials: false
+      - name: Checkout delivery runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: 0xPlayerOne/code-foundry
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry-delivery
+          persist-credentials: false
+          sparse-checkout: src
+      - name: Prepare production state
+        run: |
+          echo "FOUNDRY_EXECUTOR=$GITHUB_WORKSPACE/.github/.code-foundry-delivery/src/commands/cloudflare-delivery.mjs" >> "$GITHUB_ENV"
+          echo "FOUNDRY_STATE_FILE=$RUNNER_TEMP/cloudflare-production.json" >> "$GITHUB_ENV"
+      - name: Bind promotion to verified candidate
+        env:
+          CANDIDATE_VERIFIED: ${{ needs.candidate.outputs.verified }}
+          CANDIDATE_SOURCE_SHA: ${{ needs.candidate.outputs.source-sha }}
+          CANDIDATE_VERSION_ID: ${{ needs.candidate.outputs.version-id }}
+          CANDIDATE_URL: ${{ needs.candidate.outputs.url }}
+          CANDIDATE_ARTIFACT_DIGEST: ${{ needs.candidate.outputs.artifact-digest }}
+        run: node "$FOUNDRY_EXECUTOR" init-production
+      - name: Record pending application deployment
+        id: start
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node "$FOUNDRY_EXECUTOR" record-start
+      - name: Set up Bun for verification only
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+      - name: Install verification dependencies without rebuilding
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile --ignore-scripts
+      - name: Reject stale source after approval
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node "$FOUNDRY_EXECUTOR" assert-current
+      - name: Activate canary
+        id: canary
+        if: inputs.canary-percentage < 100
+        env:
+          DEPLOY_PERCENTAGE: ${{ inputs.canary-percentage }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: node "$FOUNDRY_EXECUTOR" activate
+      - name: Verify canary
+        if: inputs.canary-percentage < 100
+        env:
+          FOUNDRY_PHASE: canary
+          VERIFY_COMMAND: ${{ inputs.canary-verify-command }}
+        run: node "$FOUNDRY_EXECUTOR" verify
+      - name: Recheck source before final promotion
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node "$FOUNDRY_EXECUTOR" assert-current
+      - name: Promote the verified version to 100 percent
+        id: promote
+        env:
+          DEPLOY_PERCENTAGE: '100'
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: node "$FOUNDRY_EXECUTOR" activate
+      - name: Verify production
+        run: node "$FOUNDRY_EXECUTOR" verify
+      - name: Optional stateless rollback
+        if: >-
+          failure() && inputs.auto-rollback &&
+          (steps.canary.outcome == 'success' || steps.promote.outcome == 'success')
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: node "$FOUNDRY_EXECUTOR" rollback
+      - name: Complete application deployment status
+        if: always() && steps.start.outputs.github-deployment-id != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          DEPLOYMENT_STATUS: ${{ job.status }}
+        run: node "$FOUNDRY_EXECUTOR" record-finish
+      - name: Preserve promotion and recovery evidence
+        if: always() && steps.start.outputs.github-deployment-id != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: cloudflare-production-${{ inputs.worker-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/cloudflare-production.json
+          if-no-files-found: error
+          retention-days: 30

package/.github/workflows/cloudflare-deploy.yml

@@ -4,27 +4,23 @@ on:
   workflow_call:
     inputs:
       mode:
-        description: 'Deploy mode: preview (wrangler versions upload) or production (wrangler deploy).'
+        description: 'Legacy direct deployment. Prefer cloudflare-delivery.yml for verified promotion.'
         required: false
         type: string
         default: preview
       working-directory:
-        description: 'Directory containing the wrangler configuration.'
         required: false
         type: string
         default: '.'
       install-working-directory:
-        description: 'Directory containing bun.lock. Used only when build-script is set.'
         required: false
         type: string
         default: '.'
       build-script:
-        description: 'Optional Bun package script to run before Wrangler deploys.'
         required: false
         type: string
         default: ''
       bun-version:
-        description: 'Bun version used for dependency installation and the optional build.'
         required: false
         type: string
         default: '1.4.0'
@@ -33,11 +29,16 @@ on:
         type: string
         default: ubuntu-latest
       wrangler-version:
+        description: 'local uses installed Wrangler; latest preserves legacy behavior; exact versions are recommended.'
         required: false
         type: string
-        default: 'latest'
+        default: latest
       environment:
-        description: 'GitHub deployment environment. Defaults to Preview/Production based on the mode.'
+        required: false
+        type: string
+        default: ''
+      deployment-url:
+        description: 'Optional HTTPS production URL when Wrangler targets are route patterns.'
         required: false
         type: string
         default: ''
@@ -46,41 +47,81 @@ on:
         required: true
       CLOUDFLARE_ACCOUNT_ID:
         required: true
+    outputs:
+      url:
+        value: ${{ jobs.deploy.outputs.url }}
+      version-id:
+        value: ${{ jobs.deploy.outputs.version-id }}
+      github-deployment-id:
+        value: ${{ jobs.deploy.outputs.github-deployment-id }}
 
 permissions:
   contents: read
   deployments: write
 
+concurrency:
+  group: code-foundry-cloudflare-legacy-${{ github.repository }}-${{ inputs.working-directory }}-${{ inputs.environment || inputs.mode }}
+  cancel-in-progress: false
+
 jobs:
   deploy:
     name: Cloudflare Deploy / ${{ inputs.mode }}
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      github.event_name != 'pull_request_target' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 20
+    environment:
+      name: ${{ inputs.environment || (inputs.mode == 'production' && 'Production' || 'Preview') }}
+      url: ${{ steps.deploy.outputs.url }}
+    outputs:
+      url: ${{ steps.deploy.outputs.url }}
+      version-id: ${{ steps.deploy.outputs.version-id }}
+      github-deployment-id: ${{ steps.start.outputs.id }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-
+      - name: Validate deployment inputs
+        env:
+          MODE: ${{ inputs.mode }}
+          WRANGLER_VERSION: ${{ inputs.wrangler-version }}
+        run: |
+          set -euo pipefail
+          [[ "$MODE" == preview || "$MODE" == production ]]
+          [[ "$WRANGLER_VERSION" == local || "$WRANGLER_VERSION" == latest || "$WRANGLER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]
+      - name: Record pending deployment
+        id: start
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MODE: ${{ inputs.mode }}
+          ENVIRONMENT: ${{ inputs.environment || (inputs.mode == 'production' && 'Production' || 'Preview') }}
+        run: |
+          set -euo pipefail
+          body=$(jq -n --arg ref "$GITHUB_SHA" --arg environment "$ENVIRONMENT" \
+            --argjson production "$([ "$MODE" = production ] && echo true || echo false)" \
+            '{ref: $ref, environment: $environment, auto_merge: false, production_environment: $production, required_contexts: []}')
+          id=$(gh api "repos/$GITHUB_REPOSITORY/deployments" --input - <<< "$body" --jq .id)
+          [[ "$id" =~ ^[0-9]+$ ]]
+          echo "id=$id" >> "$GITHUB_OUTPUT"
+          gh api -X POST "repos/$GITHUB_REPOSITORY/deployments/$id/statuses" -f state=in_progress -F auto_inactive=false --silent
       - name: Set up Bun
         if: inputs.build-script != ''
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: ${{ inputs.bun-version }}
-
       - name: Install dependencies
         if: inputs.build-script != ''
         working-directory: ${{ inputs.install-working-directory }}
         run: bun install --frozen-lockfile
-
       - name: Build Worker
         if: inputs.build-script != ''
         working-directory: ${{ inputs.working-directory }}
         env:
           BUILD_SCRIPT: ${{ inputs.build-script }}
         run: bun run "$BUILD_SCRIPT"
-
       - name: Deploy to Cloudflare
         id: deploy
         working-directory: ${{ inputs.working-directory }}
@@ -90,52 +131,54 @@ jobs:
           BUILD_SCRIPT: ${{ inputs.build-script }}
           WRANGLER_VERSION: ${{ inputs.wrangler-version }}
           MODE: ${{ inputs.mode }}
+          DEPLOYMENT_URL: ${{ inputs.deployment-url }}
         run: |
           set -euo pipefail
-          # Bun callers install workspace dependencies with Bun. Keep that
-          # package-manager context for Wrangler's OpenNext auto-delegation;
-          # Wrangler otherwise selects npm/npx and cannot resolve the local
-          # opennextjs-cloudflare binary from a Bun workspace.
-          if [ -n "$BUILD_SCRIPT" ]; then
+          if [ "$WRANGLER_VERSION" = local ]; then
+            if [ -n "$BUILD_SCRIPT" ]; then
+              wrangler=(bunx --bun --no-install wrangler)
+            else
+              wrangler=(npx --no-install wrangler)
+            fi
+          elif [ -n "$BUILD_SCRIPT" ]; then
             wrangler=(bunx --bun "wrangler@$WRANGLER_VERSION")
           else
             wrangler=(npx -y "wrangler@$WRANGLER_VERSION")
           fi
+          export WRANGLER_OUTPUT_FILE_PATH="$RUNNER_TEMP/cloudflare-legacy.ndjson"
+          : > "$WRANGLER_OUTPUT_FILE_PATH"
           "${wrangler[@]}" --version
-          if [ "$MODE" = "production" ]; then
-            "${wrangler[@]}" deploy 2>&1 | tee deploy-output.txt
-          elif [ "$MODE" = "preview" ]; then
-            "${wrangler[@]}" versions upload --message "preview ${GITHUB_SHA::7}" 2>&1 | tee deploy-output.txt
+          if [ "$MODE" = production ]; then
+            "${wrangler[@]}" deploy
           else
-            echo "Unsupported mode: $MODE (use preview or production)" >&2
-            exit 1
+            "${wrangler[@]}" versions upload --message "preview ${GITHUB_SHA::7}"
           fi
-          # Prefer version preview URLs; fall back to the first workers.dev URL.
-          url=$(grep -Eo 'https://[a-zA-Z0-9][a-zA-Z0-9.-]*\.workers\.dev' deploy-output.txt | tail -1 || true)
-          echo "url=$url" >> "$GITHUB_OUTPUT"
-
-      - name: Record GitHub deployment
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from 'node:fs'
+          const records = readFileSync(process.env.WRANGLER_OUTPUT_FILE_PATH, 'utf8').split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line))
+          if (records.some(record => record.type === 'command-failed')) throw new Error('Wrangler command failed')
+          const type = process.env.MODE === 'production' ? 'deploy' : 'version-upload'
+          const matches = records.filter(record => record.type === type)
+          if (matches.length !== 1 || matches[0].version !== 1) throw new Error('Expected one supported structured deployment record')
+          const record = matches[0]
+          if (!/^[0-9a-f-]{36}$/i.test(record.version_id ?? '')) throw new Error('Missing Worker version ID')
+          const value = process.env.MODE === 'preview' ? record.preview_url : (process.env.DEPLOYMENT_URL || record.targets?.find(target => target.startsWith('https://')))
+          if (!value) throw new Error('Missing deployment URL; enable previews or configure deployment-url')
+          const url = new URL(value)
+          if (url.protocol !== 'https:' || url.username || url.password || url.hash) throw new Error('Invalid deployment URL')
+          appendFileSync(process.env.GITHUB_OUTPUT, `url=${url.href}\nversion-id=${record.version_id}\n`)
+          NODE
+      - name: Complete deployment status
+        if: always() && steps.start.outputs.id != ''
         env:
           GH_TOKEN: ${{ github.token }}
-          MODE: ${{ inputs.mode }}
-          ENVIRONMENT_OVERRIDE: ${{ inputs.environment }}
+          DEPLOYMENT_ID: ${{ steps.start.outputs.id }}
           DEPLOY_URL: ${{ steps.deploy.outputs.url }}
+          JOB_STATUS: ${{ job.status }}
         run: |
           set -euo pipefail
-          if [ "$MODE" != "production" ] && [ "$MODE" != "preview" ]; then
-            echo "Unsupported mode: $MODE" >&2
-            exit 1
-          fi
-          environment="${ENVIRONMENT_OVERRIDE:-$([ "$MODE" = "production" ] && echo Production || echo Preview)}"
-          body=$(jq -n \
-            --arg ref "$GITHUB_SHA" \
-            --arg environment "$environment" \
-            --argjson production "$([ "$MODE" = "production" ] && echo true || echo false)" \
-            '{ref: $ref, environment: $environment, auto_merge: false, production_environment: $production, required_contexts: []}')
-          deployment=$(gh api "repos/$GITHUB_REPOSITORY/deployments" --input - <<< "$body" --jq .id)
-          status_args=(-f state=success -f description="Cloudflare $MODE deploy (${GITHUB_SHA::7})")
-          if [ -n "$DEPLOY_URL" ]; then
-            status_args+=(-f environment_url="$DEPLOY_URL" -f log_url="$DEPLOY_URL")
-          fi
-          gh api -X POST "repos/$GITHUB_REPOSITORY/deployments/$deployment/statuses" "${status_args[@]}" --jq .state
-          echo "Recorded $environment deployment for ${GITHUB_SHA::7}"
+          state=failure
+          if [ "$JOB_STATUS" = success ]; then state=success; fi
+          args=(-f "state=$state" -F auto_inactive=false)
+          if [ -n "$DEPLOY_URL" ]; then args+=(-f "environment_url=$DEPLOY_URL"); fi
+          gh api -X POST "repos/$GITHUB_REPOSITORY/deployments/$DEPLOYMENT_ID/statuses" "${args[@]}" --silent

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.12.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.11.0...v1.12.0) (2026-09-09)
+
+
+### Features
+
+* **cloudflare:** verify candidates before protected version promotion ([#535](https://github.com/0xPlayerOne/code-foundry/issues/535)) ([5dd9afa](https://github.com/0xPlayerOne/code-foundry/commit/5dd9afa8418718823844875b0aedce926b887184))
+
 ## [1.11.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.10.1...v1.11.0) (2026-09-09)
 
 

package/docs/CONFIGURATION.md

@@ -179,15 +179,23 @@ shards. Do not split a single crate by arbitrary non-Rust directories: use
 ## Cloudflare Workers deployments
 
 Repositories that deploy to Cloudflare Workers can opt into GitHub-native
-deployments (Preview/Production environments with deployment statuses, like
-Vercel's integration) by adding a small caller for the runtime's reusable
-`cloudflare-deploy.yml` workflow. The workflow runs `wrangler versions upload`
-for pull-request previews and `wrangler deploy` for production, records a
-GitHub deployment plus status with the workers.dev URL, and respects
-`CI_BILLING_PAUSED`. It requires the `CLOUDFLARE_API_TOKEN` and
-`CLOUDFLARE_ACCOUNT_ID` secrets in the consumer repository. Bun consumers may
-also pass `build-script`, `install-working-directory`, and `bun-version`; the
-runtime installs the frozen lockfile and builds the Worker before invoking
+verified delivery (fixed `Preview`/`Production` environments, candidate
+verification, and version-identity promotion) by adding a caller for the
+runtime's reusable `cloudflare-delivery.yml` workflow. Use the same immutable
+40-character Code Foundry commit SHA for both the reusable workflow ref and
+`runtime-ref`; configure required reviewers and branch restrictions on the
+`Production` environment. The workflow requires the
+`CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID` secrets in the consumer
+repository. See [Verified Cloudflare delivery](./cloudflare-delivery.md) for
+binding policy, canary, rollback, and evidence requirements.
+
+The legacy `cloudflare-deploy.yml` workflow remains available for direct
+(unverified) deployments. It runs `wrangler versions upload` for previews and
+`wrangler deploy` for production, records a GitHub deployment plus status, and
+respects `CI_BILLING_PAUSED`. Its legacy-compatible Wrangler default is `latest`;
+callers should prefer `local` or provide an exact `wrangler-version` for
+reproducibility. Bun consumers may pass `build-script`, `install-working-directory`, and `bun-version`;
+the runtime installs the frozen lockfile and builds the Worker before invoking
 Wrangler. Bun-backed callers invoke Wrangler through `bunx` so OpenNext's
 production delegation resolves the workspace-local `opennextjs-cloudflare`
 binary; callers without `build-script` retain the npm/npx path.