CI/CD: Deployment Pipelines for Cloudflare Workers

Previously in this course, we covered CI/CD: Automated Testing, where we ensured our Worker logic was sound before deployment. Now, we're taking the final step: automating the deployment process itself so that every push to your repository results in an updated, live application.

In the world of DevOps, relying on local machine deployments is a recipe for "it works on my machine" syndrome. By moving to a CI/CD pipeline, you ensure that every deployment follows the exact same process in a clean, isolated environment.

The Anatomy of a Deployment Pipeline

A deployment pipeline for Cloudflare Workers consists of three main parts:

1. The Trigger: An event in GitHub (usually a push to the main branch).
2. The Environment: A virtual machine provided by GitHub Actions.
3. The Execution: Running the wrangler deploy command using stored credentials.

To achieve this, we need to move our local authentication credentials into the cloud.

Creating a Cloudflare API Token

Wrangler uses an API Token to authenticate with your Cloudflare account. Because we don't want to hardcode this token in our repository, we use GitHub Secrets.

1. Go to your Cloudflare Dashboard.
2. Navigate to My Profile > API Tokens.
3. Create a Custom Token. Grant it Cloudflare Workers: Edit permissions and restrict it to your specific account/zone if possible.
4. Once created, copy the token. Do not share it!

Configuring GitHub Secrets

Now, we need to store this token securely so our GitHub Action can access it.

1. In your GitHub repository, go to Settings > Secrets and variables > Actions.
2. Click New repository secret.
3. Name it CLOUDFLARE_API_TOKEN and paste your token as the value.
4. Add another secret named CLOUDFLARE_ACCOUNT_ID with your Account ID (found on your dashboard's overview page).

Writing the GitHub Action

Create a file in your project directory at .github/workflows/deploy.yml. This YAML file defines the automated workflow.

YAML
name: Deploy Worker
on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies
        run: npm install
      - name: Deploy to Cloudflare
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

This workflow triggers whenever you push to main. It checks out your code, installs your project dependencies, and uses the official Wrangler Action to deploy your Worker. For more advanced workflows, you can explore Production Deployment: Automating Secure CD Pipelines to handle environment-specific configurations.

Hands-on Exercise

1. Commit your workflow: Add the .github/workflows/deploy.yml file to your repository and push it to main.
2. Observe: Go to the "Actions" tab in your GitHub repository. You should see the job running immediately.
3. Verify: Once the job turns green, visit your Worker URL. You should see your latest code live on the edge.
4. Refine: If your project grows, consider implementing Manual Approval Gates: Controlling Production Deployments to prevent accidental production pushes.

Common Pitfalls

• Expired Tokens: Cloudflare API tokens can expire. If your pipeline suddenly fails with 401 or 403 errors, check the token status in the Cloudflare dashboard.
• Missing Bindings: If your Worker relies on R2 or D1, ensure your wrangler.toml is correctly configured. The wrangler-action respects your wrangler.toml file, so ensure it doesn't contain local-only settings that break in CI.
• Permissions: Ensure the GitHub Action has permission to write to your repo if you are performing tasks like automated version bumping.

FAQ

Q: Can I deploy to a staging environment first? A: Yes. You can define multiple jobs in your workflow or use separate branches. See Staging Environments: Mastering Deployment Targets in CI/CD for a deep dive on managing multiple environments.

Q: Should I store my API Token in the code? A: Never. Always use GitHub Secrets. If you accidentally commit a token, revoke it in the Cloudflare dashboard immediately and rotate your keys.

Q: Does this work for Pages as well as Workers? A: Yes, the process is nearly identical, though you might use a different action or command for Cloudflare Pages.

Recap

We've successfully moved from manual deployments to a professional CI/CD flow. By using GitHub Actions, we've ensured that our deployment process is repeatable, secure, and fully automated.

Up next: Performance Auditing — we'll look at how to measure the real-world impact of our code changes and ensure our edge deployment is as fast as possible.