Fix the retention deploy, and make legal/ edits deploy - #70
Merged
Conversation
…ed nothing Two faults, both mine, both from the same PR. The retention job was missing the `Install the 1Password CLI` step the site job has. fnox resolves every secret through `op`; without the binary the resolver warns once per secret and returns nothing, and wrangler then fails on a missing CLOUDFLARE_API_TOKEN -- an error that names the symptom and not the cause. The Worker did not deploy on the merge to primary, so the cron was never registered. CI could not have caught it. A pull request runs `deploy --dry-run`, which never authenticates, so the credential path was only exercised for the first time on primary. That is a real gap in the check and the reason it merged green; the fix is the missing step rather than a louder dry run, because a dry run that authenticated would be a deploy. Second: `legal/**` was in neither site's path filter. Both sites render the shared privacy policy, so an edit touching only that directory would have rebuilt nothing and left the published policy stale while the repository said otherwise. It has not bitten yet only because every policy change so far arrived alongside a file that did match. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J53xszP5CdZLXfhRJWsSyv
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two faults from #69, both mine.
The retention Worker never deployed
The
deploy-retentionjob was missing theInstall the 1Password CLIstep that the site job has. fnox resolves every secret throughop; with no binary it warns once per secret and returns nothing, and wrangler then fails on a missingCLOUDFLARE_API_TOKEN— naming the symptom, not the cause.Consequence: the cron was never registered. Nothing would have fired at 09:17 UTC, and the policy's deletions would have gone unperformed with no sign of it beyond a red run.
CI could not have caught this. A pull request runs
deploy --dry-run, which never authenticates, so the credential path was exercised for the first time onprimary. The fix is the missing step, not a louder dry run — a dry run that authenticated would be a deploy.legal/**deployed nothingBoth sites render
legal/privacy-policy.ts, and it was in neither path filter. An edit touching only that directory would rebuild nothing and leave the published policy stale while the repository said otherwise. It hasn't bitten because every policy change so far arrived alongside a file that did match — the clause edit rode in onsites/**andpackage.json.After merge
The Worker deploys and the cron registers. Worth confirming
retention_runshas rows the morning after; migration 0004 is already applied to remote D1.🤖 Generated with Claude Code
https://claude.ai/code/session_01J53xszP5CdZLXfhRJWsSyv