Deployment

Prerequisites

• Cloudflare account dedicated to graphdb-labs (API token + account ID via GitHub org secrets)
• Reusable workflows from graphdb-labs/ops-ci-workflows
• Never run local wrangler deploy or wrangler secret put against production

Services and deploy targets (v6)

Service	Type	Repo / path	Cloudflare name
core-api	Worker	core	core-api
edge-gateway	Worker	edge-gateway	edge-gateway
ops-control	Worker (cron)	ops-control	ops-control
infra-email	Worker	infra-email	infra-email
web-public	Pages	web-public	web-public
app-dashboard	Pages	app-dashboard	app-dashboard
core-admin	Pages	core/apps/admin-web	core-admin

Cloudflare resources (prod-only)

Resource	Name	Notes
D1	core-d1	Shared by core-api / ops-control
R2	core-r2	Backups / assets (enable R2 on the account first)

Do not create graphdb-labs-*-prod, admin-db, core-admin-api, or non-prod *-dev / *-stg resources.

Resource creation (D1/R2) is an ops action with STOP-AND-ASK for new D1. IDs are pinned in each repo’s wrangler.prod.toml / wrangler.prod.jsonc.

CI/CD via GitHub Actions

Each product repo’s .github/workflows/ci.yml calls ops-ci-workflows with secrets: inherit:

1. Governance + TypeScript CI on PR / push
2. Deploy Workers/Pages on main (or workflow_dispatch) via reusable deploy workflows
3. Preflight (preflight-cloudflare.mjs) before any Cloudflare write

Required GitHub secrets

Secret	Description
CLOUDFLARE_API_TOKEN	Token scoped to the graphdb-labs Cloudflare account
CLOUDFLARE_ACCOUNT_ID	Must match pinned account_id in wrangler configs

See ops-ci-workflows/docs/ORG_SECRETS.md for the full list.

Caution

Prod-only policy: one wrangler.prod.toml (or .jsonc) per deployable. Local: wrangler dev -c wrangler.prod.toml --local.