From cf98e89e8561c72e3fccac04e0f738c823176180 Mon Sep 17 00:00:00 2001
From: Rob Jacques <2531474+robbyrob42@users.noreply.github.com>
Date: Thu, 3 Sep 2026 15:40:32 -0700
Subject: [PATCH] fix(ci): the retention deploy had no 1Password CLI, and
 legal/ deployed nothing

Two faults, both mine, both from the same PR.

The retention job was missing the `Install the 1Password CLI` step the
site job has. fnox resolves every secret through `op`; without the binary
the resolver warns once per secret and returns nothing, and wrangler then
fails on a missing CLOUDFLARE_API_TOKEN -- an error that names the
symptom and not the cause. The Worker did not deploy on the merge to
primary, so the cron was never registered.

CI could not have caught it. A pull request runs `deploy --dry-run`,
which never authenticates, so the credential path was only exercised for
the first time on primary. That is a real gap in the check and the reason
it merged green; the fix is the missing step rather than a louder dry
run, because a dry run that authenticated would be a deploy.

Second: `legal/**` was in neither site's path filter. Both sites render
the shared privacy policy, so an edit touching only that directory would
have rebuilt nothing and left the published policy stale while the
repository said otherwise. It has not bitten yet only because every
policy change so far arrived alongside a file that did match.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J53xszP5CdZLXfhRJWsSyv
---
 .github/workflows/deploy.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index c804079..ca84933 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -34,11 +34,17 @@ jobs:
           filters: |
             www:
               - 'sites/www/**'
+              # Both sites render the shared privacy policy, so an edit that
+              # touches only this directory still has to rebuild both.
+              - 'legal/**'
               - 'package.json'
               - 'yarn.lock'
               - '.github/workflows/deploy.yml'
             forensics:
               - 'sites/forensics/**'
+              # Both sites render the shared privacy policy, so an edit that
+              # touches only this directory still has to rebuild both.
+              - 'legal/**'
               - 'package.json'
               - 'yarn.lock'
               - '.github/workflows/deploy.yml'
@@ -145,6 +151,15 @@ jobs:
           YARN_ENABLE_HARDENED_MODE: ${{ github.event_name == 'pull_request' && '1' || '0' }}
         run: yarn install --immutable
 
+      # fnox resolves every secret through the 1Password CLI. Without this the
+      # resolver falls back to individual `op` calls, finds no binary, and
+      # returns nothing -- wrangler then fails on a missing CLOUDFLARE_API_TOKEN
+      # rather than on anything that names the real cause. The site job has the
+      # same step; this one was missing it, and `deploy --dry-run` on a pull
+      # request never authenticates, so CI could not catch it before merge.
+      - name: Install the 1Password CLI
+        uses: 1password/install-cli-action@v1
+
       - name: Deploy
         working-directory: workers/retention
         env: