Repository navigation
Relocate the front-door router into agentrelay.com (Phase 2) #2
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| name: Deploy Router (Cloudflare) | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| paths: | ||
| - router/** | ||
| - .github/workflows/deploy-router.yml | ||
| workflow_dispatch: | ||
|
|
||
| concurrency: | ||
| group: deploy-router-production | ||
| cancel-in-progress: false | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| deploy-router: | ||
| name: Deploy router | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: '22' | ||
| cache: 'npm' | ||
|
|
||
| - name: Install dependencies | ||
| run: npm ci | ||
|
|
||
| - name: Deploy router to Cloudflare | ||
| working-directory: router | ||
| env: | ||
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} | ||
| run: ../node_modules/.bin/wrangler deploy | ||
|
Comment on lines
+33
to
+41
Contributor
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win Add a pre-deploy guard for unresolved config sentinels. A fast validation step should fail the job if Suggested change - name: Install dependencies
run: npm ci
+ - name: Validate router wrangler config
+ run: |
+ if grep -q "REPLACE_ME__" router/wrangler.jsonc; then
+ echo "Unresolved placeholder found in router/wrangler.jsonc"
+ exit 1
+ fi
+
- name: Deploy router to Cloudflare
working-directory: router
env:🤖 Prompt for AI Agents |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| Route precedence: | ||
|
|
||
| - `/cloud*` routes to the Agent Relay Cloud Next.js app. | ||
| - `/observer/file*` routes to the RelayFile observer app, expected to be built with `basePath: "/observer/file"`. | ||
| - `/observer*` routes to the Relaycast observer app. | ||
| - everything else falls back to the legacy proxy target. | ||
|
|
||
| RelayFile observer deployment is wired from the production job in | ||
| `.github/workflows/deploy.yml`. The job runs | ||
| `scripts/deploy-file-observer-pages.sh`, which packs | ||
| `@relayfile/file-observer@latest`, builds it with | ||
| `FILE_OBSERVER_BASE_PATH=/observer/file`, and deploys the detected static output | ||
| to the Cloudflare Pages project `relayfile-file-observer`. The script creates | ||
| that Pages project with the configured production branch when it is missing, so | ||
| the first production deploy does not require manual Cloudflare setup. | ||
|
|
||
| ``` | ||
| ┌────────────────────────────────────┐ | ||
| │ @agentworkforce/agentrelay.com │ | ||
| │ │ | ||
| │ /router (Cloudflare worker) │ | ||
| └────────────────────────────────────┘ | ||
|
|
||
| ┌──────────────────────────────────────┐ | ||
| │ agentrelay.com │ | ||
| └──────────────────────────────────────┘ | ||
| │ | ||
| │ | ||
| │ | ||
| All cloud routes │ Observer Routes | ||
| ┌───(/cloud/*, /cloud/api)───────────┼────(/observer*, /observer/file*)───────┐ | ||
| │ │ │ | ||
| │ │ │ | ||
| │ │ │ | ||
| ▼ │ ▼ | ||
| ┌────────────────────────────────────┐ │ ┌────────────────────────────────────┐ | ||
| │ https://agentrelay.cloud │ │ │ https://relaycast.dev/observer │ | ||
| └────────────────────────────────────┘ │ └────────────────────────────────────┘ | ||
| │ | ||
| │ | ||
| ┌────────────────────────────────────┐ All Other Routes ┌────────────────────────────────────┐ | ||
| │ @agentworkforce/cloud │ (/, /docs, /blog, /openclaw) │ @agentworkforce/relaycast │ | ||
| │ │ │ │ │ | ||
| │ /web (NextJs App) │ │ │ /packages/observer-dashboard │ | ||
| │ │ │ │ /@relayfile/file-observer │ | ||
| └────────────────────────────────────┘ │ └────────────────────────────────────┘ | ||
| │ | ||
| │ | ||
| │ | ||
| │ | ||
| │ | ||
| │ | ||
| │ | ||
| │ | ||
| ▼ | ||
| ┌────────────────────────────────────┐ | ||
| │ https://origin-web.agentrelay.com │ | ||
| └────────────────────────────────────┘ | ||
|
|
||
|
|
||
| ┌────────────────────────────────────┐ | ||
| │ @agentworkforce/agentrelay.com │ | ||
| │ │ | ||
| │ /web (NextJs App) │ | ||
| └────────────────────────────────────┘ | ||
| ``` |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
Repository: AgentWorkforce/agentrelay.com
Length of output: 203
🏁 Script executed:
cat -n .github/workflows/deploy-router.yml | head -40Repository: AgentWorkforce/agentrelay.com
Length of output: 1281
🌐 Web query:
actions/checkout v4 persist-credentials security best practice GitHub Actions💡 Result:
Setting persist-credentials: false in the actions/checkout action is considered a security best practice for most GitHub Actions workflows [1][2][3]. By default (persist-credentials: true), the action configures the Git local configuration with the provided token or SSH key [4][5][6]. This allows subsequent steps in the same job to perform authenticated Git operations automatically, but it also creates a security risk: any process or action executed later in the job can access these credentials from the.git/config file [7][2]. If a workflow step is compromised, or if the working directory is inadvertently uploaded as an artifact, the credentials may be exposed to unauthorized parties [2][3]. Key security considerations: 1. Recommended Practice: Set persist-credentials: false unless your workflow explicitly requires authenticated Git operations (e.g., pushing commits back to the repository) after the checkout step [1][2][3]. 2. Risk Reduction: Disabling credential persistence ensures that credentials are not stored on disk in the runner's working directory, significantly reducing the potential blast radius if a workflow is compromised [1][2]. 3. Manual Credential Management: If you disable persistence but still need to perform authenticated Git operations, you must manually configure the required authentication (e.g., by using an environment variable or explicit configuration) in the steps that require it [2]. 4. Context Matters: While GITHUB_TOKEN has default permissions and is handled by the runner environment, persist-credentials specifically controls whether that token is written to the Git configuration on disk [4][7]. For high-value workflows, such as those performing releases or deployments, it is especially important to follow the principle of least privilege, limit the scope of tokens, and consider using more secure alternatives like OIDC (OpenID Connect) for authentication with cloud providers rather than relying on long-lived or persisted secrets [8][3].
Citations:
persist-credentialsor change the default tofalseactions/checkout#485Disable checkout credential persistence.
Set
persist-credentials: falseon the checkout action to avoid leaving a writable token in the workspace for subsequent steps. This workflow performs no authenticated Git operations after checkout, so credential persistence is unnecessary and increases the attack surface.Suggested change
- name: Checkout code uses: actions/checkout@v4 + with: + persist-credentials: false📝 Committable suggestion
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 24-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Source: Linters/SAST tools