feat: Cloudflare deployment pipeline — wrangler.toml + GitHub Actions (#674)

Adds Cloudflare Workers deployment pipeline:\n\n- wrangler.toml with dev/production environments (non-inheritable bindings declared in both)\n- GitHub Actions workflow: push to dev → wrangler deploy, push to main → wrangler deploy --env production\n- astro.config.mjs reads SANITY_DATASET from env var (dev vs production)\n- .dev.vars.example for local development secrets\n- Replaces wrangler.jsonc with wrangler.toml\n\nD1 database IDs are placeholders — Alex creates databases and updates IDs before first successful deploy.\n\nUses pnpm workspace (pnpm/action-setup + pnpm install --frozen-lockfile)."

Author: codercatdev

.github/workflows/deploy.yml

@@ -0,0 +1,54 @@
+name: Deploy CodingCat.dev
+
+on:
+  push:
+    branches: [dev, main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build (dev)
+        if: github.ref == 'refs/heads/dev'
+        run: pnpm --filter @codingcatdev/web build
+        env:
+          SANITY_PROJECT_ID: hfh83o0w
+          SANITY_DATASET: dev
+
+      - name: Build (production)
+        if: github.ref == 'refs/heads/main'
+        run: pnpm --filter @codingcatdev/web build
+        env:
+          SANITY_PROJECT_ID: hfh83o0w
+          SANITY_DATASET: production
+
+      - name: Deploy to dev
+        if: github.ref == 'refs/heads/dev'
+        run: npx wrangler deploy
+        working-directory: apps/web
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+
+      - name: Deploy to production
+        if: github.ref == 'refs/heads/main'
+        run: npx wrangler deploy --env production
+        working-directory: apps/web
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

apps/web/.dev.vars.example

@@ -0,0 +1,14 @@
+# Local development secrets — NOT committed to git
+# Copy to .dev.vars and fill in values
+
+# better-auth
+BETTER_AUTH_SECRET=your-dev-secret-here
+BETTER_AUTH_URL=http://localhost:4321
+
+# Google OAuth (for better-auth social login)
+GOOGLE_CLIENT_ID=your-google-client-id
+GOOGLE_CLIENT_SECRET=your-google-client-secret
+
+# Sanity (for preview/draft mode — read queries use public API)
+SANITY_API_TOKEN=your-sanity-api-token
+SANITY_PREVIEW_SECRET=your-preview-secret

apps/web/astro.config.mjs

@@ -4,6 +4,11 @@ import react from "@astrojs/react";
 import sanity from "@sanity/astro";
 import tailwindcss from "@tailwindcss/vite";
 
+// Sanity config — dataset comes from env var (set by wrangler vars or .env)
+// In astro.config.mjs, .env files are NOT loaded — use process.env
+const sanityProjectId = process.env.SANITY_PROJECT_ID || "hfh83o0w";
+const sanityDataset = process.env.SANITY_DATASET || "production";
+
 export default defineConfig({
   output: "server",
   adapter: cloudflare({
@@ -13,8 +18,8 @@ export default defineConfig({
   }),
   integrations: [
     sanity({
-      projectId: "hfh83o0w",
-      dataset: "production",
+      projectId: sanityProjectId,
+      dataset: sanityDataset,
       useCdn: false,
       apiVersion: "2024-01-01",
     }),

apps/web/wrangler.jsonc

@@ -0,0 +1,53 @@
+# ============================================================
+# CodingCat.dev — Astro on Cloudflare Workers
+# ============================================================
+# Top-level = dev environment (deployed from `dev` branch)
+# [env.production] = production (deployed from `main` branch)
+#
+# IMPORTANT: Bindings are NON-INHERITABLE in Cloudflare.
+# Every binding must be declared in BOTH top-level AND [env.production].
+# ============================================================
+
+name = "codingcatdev"
+compatibility_date = "2025-03-01"
+compatibility_flags = ["nodejs_compat", "global_fetch_strictly_public"]
+
+[observability]
+enabled = true
+
+# --- Dev Environment (top-level = default) ---
+
+[vars]
+ENVIRONMENT = "dev"
+SANITY_DATASET = "dev"
+SANITY_PROJECT_ID = "hfh83o0w"
+SITE_URL = "https://codingcatdev.workers.dev"
+
+[assets]
+binding = "ASSETS"
+directory = "./dist/client"
+
+[[d1_databases]]
+binding = "DB"
+database_name = "codingcat-auth-dev"
+database_id = "placeholder-dev-create-via-wrangler"
+
+# --- Production Environment ---
+
+[env.production]
+name = "codingcatdev-production"
+
+[env.production.vars]
+ENVIRONMENT = "production"
+SANITY_DATASET = "production"
+SANITY_PROJECT_ID = "hfh83o0w"
+SITE_URL = "https://codingcat.dev"
+
+[env.production.assets]
+binding = "ASSETS"
+directory = "./dist/client"
+
+[[env.production.d1_databases]]
+binding = "DB"
+database_name = "codingcat-auth"
+database_id = "placeholder-prod-create-via-wrangler"