[chappie-daemon]

What

Two fixes to the website preview deploy, from one measured failure on 2026-10-18.

A comment can no longer prevent a deploy. Run 39134047965 failed at 14:01Z in Mark the preview comment as rendering with GraphQL: Resource not accessible by integration (addComment), and every later step — including Deploy the preview worker — was skipped. The preview therefore kept serving the previous build.

The cause is not a missing issues: write grant alone. Run 39134047965 was triggered by Priyanshubhartistm from the fork Priyanshubhartistm/nostream, and a pull_request run from a fork receives a read-only GITHUB_TOKEN whatever the permissions: block says. Same-repo runs under the identical permissions block have been writing that comment successfully all afternoon (PR #884 at 14:16Z, marked comment 6250682147 as rendering).

• The deploy now runs first; purge, then the comment steps follow.
• Every GitHub-comment step carries continue-on-error: true.
• The job grants issues: write as well — PR conversation comments are issue comments, and pull-requests: write does not cover them; the same-repo runs only worked because the repository's default token already included it.

The CDN cache is purged after deploying. At 14:01:53Z https://ema.tnsor.network/preview/885/ returned production HTML — no x-preview-pr, cache-control: public, max-age=0, must-revalidate — and answered correctly three minutes later. A stale window, not a broken deploy.

• Preview: POST /zones/<id>/purge_cache with {"prefixes":["https://ema.tnsor.network/preview/<n>/"]}, so one PR's purge cannot touch the production site or another preview.
• Production (deploy-website.yml): purge_everything after the router deploy — it is the same domain and the whole build changes.
• Both skip with a ::notice:: when CLOUDFLARE_ZONE_ID is unset for their environment, and both are continue-on-error, so an unconfigured or under-scoped credential costs a purge, never a deploy. This mirrors the existing website-preview environment guard.

A router change now also refreshes previews: deploy-website.yml and website/site/worker/** joined the trigger paths, because the production deploy ships the router that serves /preview/*.

Configuration this needs (not a code change)

CLOUDFLARE_ZONE_ID must exist as an environment variable on both the website-preview and website environments (Settings → Environments → … → Environment variables). It is the ema.tnsor.network zone id. Until it is set, both purge steps skip with a notice and previews deploy exactly as they do now.

The CLOUDFLARE_API_TOKEN in each environment is the one already used for wrangler deploy. A Workers-Scripts-only token cannot purge a zone cache; the purge step reports HTTP <code> with the API's message as a ::warning:: if the scope is missing, so the gap is visible in the run rather than silent.

Verification

• Both workflows parse (js-yaml) and lint clean under actionlint 1.7.12 apart from four pre-existing actions/checkout@v3 / actions/setup-node@v3 runner-age warnings that this PR does not introduce.

• Step order in deploy-website-preview.yml after this change:

   6 Deploy the preview worker
   7 Purge the preview's CDN cache            [continue-on-error]
   8 Mark the preview comment as rendering    [continue-on-error]
   9 Link the preview on the PR               [continue-on-error]
  10 Delete the preview worker
  11 Note the cleanup on the PR               [continue-on-error]
  

• Every run: block was extracted, templated with n=885, and shell-syntax-checked.

• The purge step was executed against the live API on both paths: with no zone id it prints the notice and exits 0; with a zone id and a bad token it prints ::warning::cache purge answered HTTP 401 — {"success":false,"errors":[{"code":10000,"message":"Authentication error"}]} and exits 0.

Not verified here: a real end-to-end run, which needs a preview run to fire on the branch.

Thanks to @Priyanshubhartistm — the fork PR (#885) is what surfaced this.

[changeset-bot]

🦋 Changeset detected

Latest commit: 826d43c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
nostream-website	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

🧹 Site preview for this PR was deleted (PR closed).

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; all previous findings are addressed and no new blocking issues were found.

Summary

The preview workflow deploys before writing comments and purges the preview’s cache afterward.

• Preview comments no longer hold up worker deployments.
• Each preview deploy clears cached responses for that PR's path.
• Production deploys clear the whole website cache.
• Router changes now trigger fresh preview runs.

All three previous findings are addressed. No new actionable issues were found.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[PR event] --> B{Fork or missing environment?}
  B -->|Yes| C[Skip with notice]
  B -->|No| D{PR closed?}
  D -->|No| E[Build and deploy preview]
  E --> F[Purge preview cache]
  F --> G[Write final preview comment]
  D -->|Yes| H[Delete preview worker]
  H --> I[Write cleanup comment]

Loading

_{Reviews (2) · Last reviewed commit: "fix(website): reject fork runs, purge wi..." · Reviewed by Greptile}