1# Publish goq.sh with a Cloudflare Worker23The `website/` directory is a complete static site. GitHub Actions validates it4without a package install or framework build, then deploys it as static assets5on the existing `goq-sh` Cloudflare Worker with Wrangler. A push to `main` that6changes the site, its Wrangler configuration, or its workflow is a production7release.89## One-time dashboard setup1011The `goq-sh` Worker must exist in the Cloudflare account used by CI. Attach12`goq.sh` as its custom domain in **Workers & Pages > goq-sh > Settings >13Domains & Routes**.1415GitHub Actions is the sole production publisher. If the Worker was created by16importing this GitHub repository, disable automatic production and preview17deployments under the Worker's **Settings > Build** page so Cloudflare Workers18Builds does not race the repository workflow.1920In the GitHub repository, the `main` environment must contain these environment21secrets:2223- `CLOUDFLARE_ACCOUNT_ID`24- `CLOUDFLARE_API_TOKEN`2526Create the token from Cloudflare's **Edit Cloudflare Workers** template and27scope it to only the account that owns `goq-sh`. The token must be able to edit28Workers Scripts. Never commit the token or account ID.2930The **Website / Static site** job validates JavaScript, required assets,31internal asset references, security headers, the fail-closed installer, and the32assets-only Wrangler configuration. On a push to `main`, the **Website /33Cloudflare Worker** job waits for that check, enters the protected `main`34environment, and runs `wrangler deploy` against `wrangler.jsonc`.3536The configuration deliberately has no Worker script or assets binding. Requests37are served directly from Cloudflare's static-asset layer, and `website/_headers`38supplies the site's security headers and installer content type.3940## Release gate4142Protect `main` in GitHub and require these checks before merge:4344- **CI / Complete demo gate**45- **Website / Static site** when it is present4647The site release path is then:48491. Open a pull request with website or deployment changes.502. Merge only after the repository checks pass.513. The production job deploys the merged `main` commit through the protected52 GitHub environment.534. Cloudflare promotes the immutable Worker version and assets to `goq.sh`.5455This workflow does not publish pull-request previews because environment secrets56are deliberately unavailable to untrusted PR code. Preview versions can be57added later with a separate least-privilege credential and explicit promotion58policy.