test(system-runtime): Deflake the same-sandbox procargs read #53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy docs to Cloudflare Workers | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'docs/**' | |
| - 'cloudflare/**' | |
| - 'package.json' | |
| - 'pnpm-lock.yaml' | |
| - 'wrangler.toml' | |
| - '.github/workflows/deploy-docs-cloudflare.yml' | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: cloudflare-docs | |
| cancel-in-progress: true | |
| jobs: | |
| deploy: | |
| name: Deploy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 | |
| - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: 24 | |
| # NOTE: Unsafe to rely on possibly-poisoned cache within a workflow | |
| # that uses ${{ secrets.X }}, as flagged by zizmor. | |
| # If you really want to use a cache, consider splitting this | |
| # 1 build+publish workflow into 2 separate build and publish workflows. | |
| package-manager-cache: false | |
| #cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm run docs:build | |
| - name: Deploy | |
| uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3 | |
| # NOTE: ignore[secrets-outside-env]: This workflow can only run with | |
| # maintainer-reviewed code on the main branch. Maintainer review | |
| # is considered sufficient protection against the merge of code | |
| # that tries to exfiltrate secrets. See discussion in: | |
| # https://github.com/eugene1g/agent-safehouse/issues/137 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} # zizmor: ignore[secrets-outside-env] | |
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} # zizmor: ignore[secrets-outside-env] | |
| wranglerVersion: "4.65.0" | |
| command: deploy --env production --var GIT_SHA:${{ github.sha }} |