infra: Add Workers Previews config blocks to all four workers - #683
Merged
Zach Dunn (zachdunn) merged 8 commits intoAug 17, 2026
Merged
Conversation
Workers Previews (branch environments via `wrangler preview`) is now enabled on the account. A Preview starts from a copy of the production config, so each app's wrangler.jsonc gains a `previews` block that re-points stateful bindings at preview-tier resources: - web: vars-only (stateless; previews serve branch UI against prod api/auth) - api: isolated REGISTRY KV, D1, default R2 bucket, webhook queue, and Analytics Engine dataset; GITHUB_CACHE deliberately shared - mcp: mirrors api's preview registry/database/buckets - auth: isolated D1; documented BETTER_AUTH_URL / OAuth-callback limits Preview KV/D1 ids are TODO placeholders until the one-time resource creation commands (in the api/auth config comments) are run. Also adds a short Previews note to CONTRIBUTING's Deployment section.
|
|
Important Review skippedAuto reviews are limited based on label configuration. 🏷️ Required labels (at least one) (2)
🚫 Excluded labels (none allowed) (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
UPLOADS_REGISTRY_PREVIEW KV and the uploads-preview D1 now exist; paste their ids into api and mcp. `wrangler d1 migrations` cannot resolve a database declared inside the `previews` block, so each app with a preview D1 gets a minimal wrangler.preview.jsonc used only for migrations (api's already applied cleanly; auth's carries a TODO id until uploads-auth-preview is created).
All preview-tier resources now exist; auth migrations applied.
First live preview deploy showed bindings do NOT inherit from the production config — a preview gets only what the previews block lists (wrangler warns "configuration has diverged" otherwise). Repeat the stateless/shared-safe bindings verbatim in every block and correct the comments that claimed inheritance. Also pin an explicit preview-only SESSION KV namespace for uploads-web: the Astro Cloudflare adapter's generated config injects an id-less SESSION binding and relies on deploy-time auto-provisioning, which the Previews deployment API does not support (error 10021). Verified end-to-end: uploads-web preview "previews-adoption-test" deploys warning-free and serves the site.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
uploads-auth | fb97782 | Commit Preview URL Branch Preview URL |
Aug 17 2026, 03:59 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
uploads-api | fb97782 | Commit Preview URL Branch Preview URL |
Aug 17 2026, 04:00 PM |
Zach Dunn (zachdunn)
changed the title
docs/previews.md holds the model (shared preview tier vs per-branch overrides), the which-app-to-preview table, and the migration/seeding/ secrets recipes; CONTRIBUTING and AGENTS.md slim to pointers.
wrangler preview auto-creates KV/D1/R2 when the identifier is omitted and writes the id back to the config — the scratch-database recipe now uses that instead of manual creation. Corrects the SESSION comment: the Astro-generated config fails because write-back has no user config to target, not because previews lack provisioning.
The bindings reference (previews docs, raw .md) shows previews declare rate limiters via a dedicated ratelimits field (name/namespace_id/simple) rather than production's unsafe wrapper. Same values, correct field. Dry-run validates on all three apps.
Zach Dunn (zachdunn)
deleted the
claude/cloudflare-workers-previews-8e9af2
branch
August 17, 2026 16:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adopts Cloudflare Workers Previews (branch environments via
npx wrangler preview), just enabled on our account. Each app'swrangler.jsoncgets apreviewsblock; CONTRIBUTING's Deployment section gets a short note.Two facts drive the shape of the blocks, both confirmed against a live deploy:
previewsblock lists — wrangler warns "configuration has diverged" for anything at top level that's missing from it. So every block spells out its full binding set: stateful bindings re-pointed at preview-tier resources, stateless/shared-safe ones repeated verbatim.uploads-webuploads-apiuploads-preview, migrations applied), default R2 bucket, webhook queue (producer-only), AE dataset;GITHUB_CACHEdeliberately shared (TTL'd public-data cache)uploads-mcpuploads-authuploads-auth-preview, migrations applied);BETTER_AUTH_URLneeds a per-preview override, GitHub social login can't work on preview originsShared on purpose (repeated verbatim, documented in config comments): BROWSER/MEDIA, FLAGS, EMAIL, rate limiters, and service bindings — service bindings always call the bound Worker's production deployment. Cron triggers and queue consumers never run in Previews. Preview secrets start unset and every secret-gated path fails closed.
Gotchas found while verifying
wrangler d1 migrationscannot resolve a database declared insidepreviews— api and auth each get a minimalwrangler.preview.jsoncused only for applying migrations to the preview D1.SESSIONKV binding and relies on deploy-time auto-provisioning, which the Previews deployment API does not support (error 10021) — web's block pins an explicit preview-only namespace.Setup status — complete
All resources created and ids wired in:
UPLOADS_REGISTRY_PREVIEW+UPLOADS_WEB_SESSION_PREVIEWKV,uploads-preview+uploads-auth-previewD1 (all migrations applied),uploads-preview-defaultR2,uploads-github-webhook-previewqueue. Nothing left to run.Verification
npx wrangler preview --name previews-adoption-testfromapps/webdeploys warning-free and serves the site athttps://previews-adoption-test-uploads-web.buildinternet.workers.dev (delete with
wrangler preview delete previews-adoption-testwhen done).wrangler deploy --dry-runpasses for all four apps.Decision: previews stay on workers.dev URLs
Custom preview domains were considered and deliberately rejected for now. Our session cookies are
.uploads.sh-scoped by design (crossSubDomainCookiesinapps/auth/src/auth.ts— the only cookie shape that covers bothuploads.shandauth.uploads.sh), so any preview hostname underuploads.shwould receive real production session cookies from signed-in visitors — meaning unreviewed branch code sees live sessions. workers.dev URLs sit outside the cookie scope, so previews are cleanly logged-out. Revisiting (dedicated preview zone, orpreviews_enabled+ Cloudflare Access with the cookie exposure accepted) is tracked in a follow-up issue.Also deliberately out of scope
preview_urls: trueflags — keep during transition. Note the Workers Builds bot comment below: its "Branch Preview URL" is this legacy mechanism (an aliased version URL running against production bindings), not a Workers Preview — onlynpx wrangler previewgets the isolated preview-tier resources from this PR.