Replace manual fetch() with Result.tryPromise from better-result,
which provides built-in retry with exponential backoff. This handles
the transient 404s that occur immediately after wrangler deploy due
to edge propagation delays.
- Rename workerHealthCheck.cjs -> .mjs for ESM support
- Add better-result as devDependency
- Update deploy.yml to invoke .mjs file
- Retry up to 5 times with 2s exponential backoff
- Replace execSync(`curl`) with native fetch() in workerHealthCheck.cjs
to resolve javascript.lang.security.detect-child-process finding.
- Run npm audit fix to update rollup 4.34.4 -> 4.60.3 and vite 5.4.14 -> 5.4.21,
resolving CVE-2026-27606 and other supply chain vulnerabilities.
The wranglerVersion input only accepted exact versions like '4.81.0'.
Setting it to a major version like '4', a range like '^4.0.0', or a
tag like 'latest' crashed with 'Invalid Version' during secret
uploads. npm installed the right version fine, but subsequent version
comparisons failed because they expected exact X.Y.Z format.
After installing wrangler, the action now runs wrangler --version to
get the concrete installed version and uses that for all version
comparisons. If version detection fails and the user gave an exact
version, the action falls back to using it directly, preserving
existing behavior.
Pre-installed versions that satisfy a range skip reinstallation.
Fixes#390
Relates to #366
Relates to #379
The action now defaults to Wrangler v4 instead of v3. All existing
version-gated logic (secret upload, deploy vs publish) correctly
handles v4. Users can pin to v3 via wranglerVersion input.
Closes BANDA-1664
- Github self hosted runners may not have permissions to write to /opt/
- Also fallsback to trying to extract the deployment-url and deployment-alias-url from stdout when WRANGLER_OUTPUT_DIR is not specified
Updating Semgrep.yml file - Semgrep is a tool that will be used to scan Cloudflare's public repos for Supply chain, code and secrets. This work is part of Application & Product Security team's initiative to onboard Semgrep onto all of Cloudflare's public repos.
In case of any questions, please reach out to "Hrushikesh Deshpande" on cf internal chat.
* (feat): Check for existing wrangler installation
* Add test for pre-installed wrangler
* Add changeset
* Address CR comments - check for an exact wrangler version match
* Tweak the fixture test for the pre-installed-wrangler test
* Simplify if/else logic for checking wrangler versions as per review notes
* fix(test): Fix execution for fake wrangler installation
* fixup! fix(test): Fix execution for fake wrangler installation
* Setup new CI test convention for wrangler-action
* Remove unncessary ts-expect-error comments
---------
Co-authored-by: Peter Bacon Darwin <pbacondarwin@cloudflare.com>
For up to date versions of wrangler, secrets are uploaded via the
'secret:bulk' command, which batches updates in a single API call.
For versions of wrangler without that capability, the action falls back
to the single 'secret put' command for each secret. It races all these
with a Promise.all()
Unfortunately, the single secret API cannot handle concurrency - at
best, these calls have to wait on one another, holding requests open
all the while. Often it times out and errors.
This fixes the legacy secret upload errors by making these calls
serially instead of concurrently.
Currently our release process is kicked off whenever a PR is merged and there are no changesets within the `.changeset` directory. Typically this happens when we intend to publish a release, just after we merge a "Version Packages" PR which removes the changesets and adds the entries to our changelog.
However, this also means that merging any PR without user-facing changes during the period after we've made a release will trigger another release (which luckily fails because the created tag already exists on the remote. See #184).
This change avoids that scenario by fetching tags when checking out the repo. Now when `npx changeset tag` runs, it will see that the tag already exists and skip creating it (`🦋 Skipping tag (already exists): v3.3.2`). The `git push --tags` step will no longer throw an error ("Everything up-to-date"). And lastly, the publish step won't get triggered because the output from `npx changeset tag` doesn't contain the string `"New tag:"`. The action should just finish successfully with nothing to left do.
Fixes#184
If the token isn't specified, wrangler throws this error, indicating the CLOUDFLARE_API_TOKEN should be set, so it's worth being consistent so folks can copy/paste the examples and have it work out of the box:
```
In a non-interactive environment, it's necessary to set a CLOUDFLARE_API_TOKEN environment variable for wrangler to work.
```
Instead of using a mix of `child_process.exec`, `child_process.execSync` and a promisified version of `child_process.exec`, we now (mostly) just use `@actions/exec`. That runs `child_process.spawn` under the hood and handles a lot of character escaping for us. We can also now pass Buffers directly into the subprocess as stdin instead of relying on shell piping.
This ends up fixing a few problems we had where secrets and env var values containing shell metacharacters were being misinterpreted.
Unfortunately, `@actions/exec` doesn't support running with a shell. That means we still have to roll our own wrapper around `child_process.exec` to avoid a breaking change to `preCommands` and `postCommands`, since users might be expecting these to run within a shell.
Also worth noting that we're no longer hiding stdout and stderr from the secret uploading step. We were previously doing this out of an abundance of caution, but it made debugging issues very difficult if secret upload failed for some reason. I feel ok doing this since we're no longer echoing & piping the secret values, wrangler doesn't ever output secret values, and as a last line of defense GitHub masks any secret values that accidentally get logged.
We need to distinguish between when the value is and isn't set in order to perform inference based on lockfile and only fallback to the default of npm if inference fails.
description:"Deploy your Cloudflare projects from GitHub using Wrangler"
runs:
# Possible values: https://github.com/actions/runner/blob/main/src/Runner.Common/Util/NodeUtil.cs#L9
using:"node20"
using:"node24"
main:"dist/index.mjs"
inputs:
apiToken:
@@ -42,6 +42,21 @@ inputs:
description:"A string of environment variable names, separated by newlines. These will be bound to your Worker using the values of matching environment variables declared in `env` of this workflow."
required:false
packageManager:
description:"The package manager you'd like to use to install and run wrangler. If not specified, a value will be inferred based on the presence of a lockfile. Valid values: [npm, pnpm, yarn]"
description:"The package manager you'd like to use to install and run wrangler. If not specified, the preferred package manager will be inferred based on the presence of a lockfile or fallback to using npm if no lockfile is found. Valid values are `npm` | `pnpm` | `yarn` | `bun`."
required:false
default:npm
gitHubToken:
description:"GitHub Token"
required:false
outputs:
command-output:
description:"The output of the Wrangler command (comes from stdout)"
command-stderr:
description:"The error output of the Wrangler command (comes from stderr)"
deployment-url:
description:"If the command was a Workers or Pages deployment, this will be the URL of the deployment"
pages-deployment-alias-url:
description:"If the command was a Pages deployment, this will be the URL of the deployment alias (if it exists) - needs wrangler >= 3.78.0"
pages-deployment-id:
description:"If the command was a Pages deployment, this will be the ID of the deployment - needs wrangler >= 3.81.0"
pages-environment:
description:"If the command was a Pages deployment, this will be the environment of the deployment - needs wrangler >= 3.81.0"
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
github-actions[bot]