Skip to content

Security: keep the demo token in an environment and its address in the config - #529

Merged
SandObserver merged 1 commit into
mainfrom
security/demo-environment-and-domain
Oct 20, 2026
Merged

Security: keep the demo token in an environment and its address in the config#529
SandObserver merged 1 commit into
mainfrom
security/demo-environment-and-domain

Conversation

@SandObserver

@SandObserver SandObserver commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Summary

  • Run the upload and promote jobs of the Demo workflow in the demo environment, which allows only main and v* tags, so its Cloudflare secrets are unreadable from other branches.
  • Declare demo.sandobserver.com as a custom domain in scripts/demo/wrangler.jsonc and apply it with wrangler triggers deploy after versions deploy.
  • Check out the Wrangler config from the repository in the promote job, and strip the route from the first-run placeholder config.
  • Add test/repo/demo-workflow.test.js for the environment, the route and the placeholder.

Testing
All green. Added 3 tests, which fail against the previous workflow.

Changelog

Checklist

  • Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
  • Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
  • Docs updated if behavior or configuration changed.

@SandObserver
Keep the demo token in an environment and its address in the config
6612c20 
Run the upload and promote jobs in the demo environment, which only main and
release tags can use. Declare demo.sandobserver.com in the Worker config and
apply it with triggers deploy when a version goes live, and strip the route
from the first-run placeholder so a placeholder never takes the address.
@SandObserver SandObserver added github_actions Pull requests that update GitHub Actions code security Security fix labels Oct 20, 2026
@SandObserver
SandObserver merged commit 2428971 into main Oct 20, 2026
8 checks passed
@SandObserver
SandObserver deleted the security/demo-environment-and-domain branch October 20, 2026 21:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

github_actions Pull requests that update GitHub Actions code security Security fix

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@SandObserver