PR #5's deploy lane was unblocked (operator decision, 2026-07-10) by setting the cultureflare operator token as this repo's CLOUDFLARE_API_TOKEN Actions secret. That token is over-scoped for CI: it also carries Zone DNS Edit, Tunnel Edit, and Access Apps/Policies Edit — none of which deploy.yml needs, and all of which widen the blast radius if the secret ever leaks from a workflow run.
Ask
Mint a dedicated token in the Cloudflare dashboard (token creation is operator-driven by design — cultureflare never mints tokens) scoped to exactly what wrangler pages deploy needs:
- Account · Cloudflare Pages · Edit — on this account only
- nothing else
Then rotate:
gh secret set CLOUDFLARE_API_TOKEN --repo agentculture/org --body '<new scoped token>'
CLOUDFLARE_ACCOUNT_ID is not secret-sensitive and stays as is. Verify with a manual workflow_dispatch run of Deploy site — a green deploy step proves the scoped token suffices, after which the operator token should be considered rotated out of CI.
Reference: docs/deploy-runbook.md (CI deploy section), cultureflare docs/SETUP.md (token-scope tables).
PR #5's deploy lane was unblocked (operator decision, 2026-07-10) by setting the cultureflare operator token as this repo's
CLOUDFLARE_API_TOKENActions secret. That token is over-scoped for CI: it also carries Zone DNS Edit, Tunnel Edit, and Access Apps/Policies Edit — none of whichdeploy.ymlneeds, and all of which widen the blast radius if the secret ever leaks from a workflow run.Ask
Mint a dedicated token in the Cloudflare dashboard (token creation is operator-driven by design — cultureflare never mints tokens) scoped to exactly what
wrangler pages deployneeds:Then rotate:
CLOUDFLARE_ACCOUNT_IDis not secret-sensitive and stays as is. Verify with a manualworkflow_dispatchrun of Deploy site — a green deploy step proves the scoped token suffices, after which the operator token should be considered rotated out of CI.Reference:
docs/deploy-runbook.md(CI deploy section), cultureflaredocs/SETUP.md(token-scope tables).