From 29855964480c75c830d082bb3ec328da3c3b3f82 Mon Sep 17 00:00:00 2001 From: chappie-daemon Date: Thu, 15 Oct 2026 21:36:06 -0400 Subject: [PATCH 1/4] fix(website): deploy main, not the tag ref MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two fixes to the release-triggered deploy observed in run 38835604913: 1. The website environment's custom branch policy does not admit tag refs, and the release event's ref IS a tag — the deploy can never pass environment protection. Checkout refs/heads/main instead: the release commit is main's tip by construction (changesets opens the release PR from main), so the deployed build is the released content. 2. Restore job-level concurrency (lost when the workflow landed on main without it): a relay release must fail the job's tag filter before it enters the deploy queue, not after, or it can replace a queued website deploy. --- .github/workflows/deploy-website.yml | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml index f4eda817..523e37f3 100644 --- a/.github/workflows/deploy-website.yml +++ b/.github/workflows/deploy-website.yml @@ -12,12 +12,14 @@ on: - published workflow_dispatch: -concurrency: - group: deploy-website - cancel-in-progress: false - jobs: deploy: + # Concurrency lives on the job, not the workflow: a relay release + # (v* tag) fails the if below and must not enter this deploy queue, + # where it could replace a queued website deploy. + concurrency: + group: deploy-website + cancel-in-progress: false if: >- ${{ startsWith(github.event.release.tag_name, 'nostream-website@') || github.event_name == 'workflow_dispatch' }} @@ -29,8 +31,15 @@ jobs: permissions: contents: read steps: + # The release event's ref is the tag (refs/tags/nostream-website@X.Y.Z), + # and the website environment's custom branch policy does not admit tag + # refs — a tag checkout can never deploy. The release commit is main's + # tip by construction (changesets opens the release PR from main), so + # check out the branch the policy protects instead. - name: Checkout uses: actions/checkout@v3 + with: + ref: refs/heads/main - uses: pnpm/action-setup@v4 From 2181728b1901dc19bf6245dc4b820cd0daa3713a Mon Sep 17 00:00:00 2001 From: chappie-daemon Date: Fri, 16 Oct 2026 17:39:51 -0400 Subject: [PATCH 2/4] chore(website): add the changeset for the deploy fix --- .changeset/deploy-main-on-release.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/deploy-main-on-release.md diff --git a/.changeset/deploy-main-on-release.md b/.changeset/deploy-main-on-release.md new file mode 100644 index 00000000..88630fb1 --- /dev/null +++ b/.changeset/deploy-main-on-release.md @@ -0,0 +1,5 @@ +--- +"nostream-website": patch +--- + +Website deploy workflow fix: a `nostream-website@` release deploys main's tip (the released content) instead of the tag ref, which the `website` environment's branch policy never admits; and the deploy queue is job-scoped so relay releases can't displace a pending website deploy. From 3f42e2205ea7f2e996223f51f05475a6abb109da Mon Sep 17 00:00:00 2001 From: chappie-daemon Date: Fri, 16 Oct 2026 17:56:17 -0400 Subject: [PATCH 3/4] fix(website): check out the release tag, not main MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The environment's branch policy admits nostream-website@* (every release deploy since 1.1.1 has run on the tag ref), so the refs/heads/main pin was never needed for admission — and it was wrong for correctness: main can advance between the release publish and the job starting, and the pin would build and deploy unreleased content. Keep the default tag checkout so the deployed build is exactly the released commit. Also restore the router-worker deploy line the branch predates. --- .github/workflows/deploy-website.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml index 523e37f3..0c04a892 100644 --- a/.github/workflows/deploy-website.yml +++ b/.github/workflows/deploy-website.yml @@ -31,15 +31,13 @@ jobs: permissions: contents: read steps: - # The release event's ref is the tag (refs/tags/nostream-website@X.Y.Z), - # and the website environment's custom branch policy does not admit tag - # refs — a tag checkout can never deploy. The release commit is main's - # tip by construction (changesets opens the release PR from main), so - # check out the branch the policy protects instead. + # Checkout gets the release event's default: the tag that triggered the + # run (refs/tags/nostream-website@X.Y.Z). The website environment's + # branch policy admits nostream-website@* — every release deploy since + # 1.1.1 has run on the tag ref — so the build is exactly the released + # commit, even if main has advanced by the time the job starts. - name: Checkout uses: actions/checkout@v3 - with: - ref: refs/heads/main - uses: pnpm/action-setup@v4 @@ -62,4 +60,6 @@ jobs: env: CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} - run: pnpm exec wrangler deploy + # The router worker: serves the production assets itself and proxies + # /preview/ to per-PR preview workers (deploy-website-preview.yml). + run: pnpm exec wrangler deploy --config wrangler.router.jsonc From e8878e4fc80d4d448c8a44f091c9295a9a630edb Mon Sep 17 00:00:00 2001 From: chappie-daemon Date: Fri, 16 Oct 2026 19:11:48 -0400 Subject: [PATCH 4/4] docs(website): correct the changeset's checkout description The changeset still claimed releases deploy main because the environment rejects tag refs; the fix actually keeps the triggering tag (which the policy admits) and the real change is the job-scoped deploy queue. Rewritten before it becomes release notes. --- .changeset/deploy-main-on-release.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/deploy-main-on-release.md b/.changeset/deploy-main-on-release.md index 88630fb1..7cdb26c8 100644 --- a/.changeset/deploy-main-on-release.md +++ b/.changeset/deploy-main-on-release.md @@ -2,4 +2,4 @@ "nostream-website": patch --- -Website deploy workflow fix: a `nostream-website@` release deploys main's tip (the released content) instead of the tag ref, which the `website` environment's branch policy never admits; and the deploy queue is job-scoped so relay releases can't displace a pending website deploy. +Website deploy workflow fix: the deploy queue is job-scoped so relay releases can't displace a pending website deploy (measured: the nostream@3.5.1 release run was cancelled with zero jobs at the workflow-level concurrency group, before its job-level `if` could skip it). The checkout stays on the triggering `nostream-website@` tag, which the `website` environment's branch policy admits — the deployed build is exactly the released commit.