From 06e7859632e2f0be0cda6d3886b1bb9137092ac9 Mon Sep 17 00:00:00 2001 From: Lionello Lunesu Date: Tue, 14 Apr 2026 12:24:54 -0700 Subject: [PATCH 1/4] fix: pass Origin CA Key to Pulumi for OriginCaCertificate creation The Cloudflare Origin CA API requires the dedicated Origin CA Key (CLOUDFLARE_API_USER_SERVICE_KEY), not a regular API token. Without it, Pulumi fails with error 1016 "User is not authorized to perform this action". Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/deploy-reusable.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/deploy-reusable.yml b/.github/workflows/deploy-reusable.yml index 027aeb9ec..f7bab6875 100644 --- a/.github/workflows/deploy-reusable.yml +++ b/.github/workflows/deploy-reusable.yml @@ -43,6 +43,7 @@ jobs: HAS_GH_APP_ID: ${{ secrets.GH_APP_ID != '' }} HAS_GH_APP_PRIVATE_KEY: ${{ secrets.GH_APP_PRIVATE_KEY != '' }} HAS_GH_APP_SLUG: ${{ secrets.GH_APP_SLUG != '' }} + HAS_CF_ORIGIN_CA_KEY: ${{ secrets.CF_ORIGIN_CA_KEY != '' }} run: | MISSING="" @@ -82,6 +83,9 @@ jobs: if [ "$HAS_GH_APP_SLUG" != "true" ]; then MISSING="$MISSING\n - secrets.GH_APP_SLUG" fi + if [ "$HAS_CF_ORIGIN_CA_KEY" != "true" ]; then + MISSING="$MISSING\n - secrets.CF_ORIGIN_CA_KEY (Cloudflare Origin CA Key — required for Origin CA certificates)" + fi if [ -n "$MISSING" ]; then echo "::error::Missing required configuration in GitHub Environment '${{ inputs.environment }}':$MISSING" @@ -207,6 +211,7 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }} CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} + CLOUDFLARE_API_USER_SERVICE_KEY: ${{ secrets.CF_ORIGIN_CA_KEY }} - name: Pulumi Up if: ${{ inputs.dry_run != true }} @@ -217,6 +222,7 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }} CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} + CLOUDFLARE_API_USER_SERVICE_KEY: ${{ secrets.CF_ORIGIN_CA_KEY }} # ======================================== # Phase 2: Configuration From e40253e13d0c7497390d7800280a6f3e7a53581a Mon Sep 17 00:00:00 2001 From: Lionello Lunesu Date: Tue, 14 Apr 2026 14:02:23 -0700 Subject: [PATCH 2/4] fix: use new_sqlite_classes for all DOs (free plan compatibility) Cloudflare free plan requires all Durable Objects to use new_sqlite_classes. Collapsed 6 migrations into one since this is a fresh deployment with no existing DO data. Co-Authored-By: Claude Opus 4.6 (1M context) --- apps/api/wrangler.toml | 22 +--------------------- 1 file changed, 1 insertion(+), 21 deletions(-) diff --git a/apps/api/wrangler.toml b/apps/api/wrangler.toml index 33a5c0937..429e86a5e 100644 --- a/apps/api/wrangler.toml +++ b/apps/api/wrangler.toml @@ -95,27 +95,7 @@ class_name = "CodexRefreshLock" [[migrations]] tag = "v1" -new_sqlite_classes = ["ProjectData"] - -[[migrations]] -tag = "v2" -new_classes = ["NodeLifecycle"] - -[[migrations]] -tag = "v3" -new_classes = ["AdminLogs"] - -[[migrations]] -tag = "v4" -new_classes = ["TaskRunner"] - -[[migrations]] -tag = "v5" -new_sqlite_classes = ["NotificationService"] - -[[migrations]] -tag = "v6" -new_classes = ["CodexRefreshLock"] # Intentionally stateless: uses D1 for credential storage, no per-instance SQLite needed +new_sqlite_classes = ["ProjectData", "NodeLifecycle", "AdminLogs", "TaskRunner", "NotificationService", "CodexRefreshLock"] # Analytics Engine for usage tracking (Phase 1 — server-side analytics) [[analytics_engine_datasets]] From 828103ca94d38fb0a09d040bbbfc168f8d2584d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Titsworth-Morin?= Date: Mon, 20 Apr 2026 15:45:00 +0000 Subject: [PATCH 3/4] revert bad commits --- apps/api/wrangler.toml | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/apps/api/wrangler.toml b/apps/api/wrangler.toml index 429e86a5e..33a5c0937 100644 --- a/apps/api/wrangler.toml +++ b/apps/api/wrangler.toml @@ -95,7 +95,27 @@ class_name = "CodexRefreshLock" [[migrations]] tag = "v1" -new_sqlite_classes = ["ProjectData", "NodeLifecycle", "AdminLogs", "TaskRunner", "NotificationService", "CodexRefreshLock"] +new_sqlite_classes = ["ProjectData"] + +[[migrations]] +tag = "v2" +new_classes = ["NodeLifecycle"] + +[[migrations]] +tag = "v3" +new_classes = ["AdminLogs"] + +[[migrations]] +tag = "v4" +new_classes = ["TaskRunner"] + +[[migrations]] +tag = "v5" +new_sqlite_classes = ["NotificationService"] + +[[migrations]] +tag = "v6" +new_classes = ["CodexRefreshLock"] # Intentionally stateless: uses D1 for credential storage, no per-instance SQLite needed # Analytics Engine for usage tracking (Phase 1 — server-side analytics) [[analytics_engine_datasets]] From 84707879c7728191b04b1f6080ae666ce5ec080a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 11 May 2026 21:04:28 +0000 Subject: [PATCH 4/4] chore(deps): Bump mermaid from 11.14.0 to 11.15.0 in /apps/web Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.14.0 to 11.15.0. - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.14.0...mermaid@11.15.0) --- updated-dependencies: - dependency-name: mermaid dependency-version: 11.15.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- apps/web/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/web/package.json b/apps/web/package.json index fdca0b8d3..9bdf463e7 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -32,7 +32,7 @@ "dagre": "0.8.5", "dompurify": "3.4.0", "lucide-react": "catalog:", - "mermaid": "11.14.0", + "mermaid": "11.15.0", "prism-react-renderer": "catalog:", "react": "catalog:", "react-dom": "catalog:",