cf-deploy

GitHub Action to build and deploy deco sites to Cloudflare Workers.

Deploys are proxied through the deco admin API — no Cloudflare secrets needed in your repository.

Usage

Deploy on push + Preview on PR

Add a single workflow to your repo at .github/workflows/deco-deploy.yaml:

name: Deploy
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened, closed]

permissions:
  contents: read
  pull-requests: write

jobs:
  deploy:
    if: github.event.action != 'closed'
    runs-on: ubuntu-latest
    steps:
      - uses: deco-cx/cf-deploy@v0

  cleanup-preview:
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
    steps:
      - uses: deco-cx/cf-deploy/cleanup@v0
        with:
          site: ${{ github.event.repository.name }}
          pr_number: ${{ github.event.pull_request.number }}

Deploy only (no previews)

name: Deploy
on:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: deco-cx/cf-deploy@v0

Inputs

deco-cx/cf-deploy

Input	Description	Default
site	Site name	Repository name
skip_build	Skip the build step	false
build_cmd	Build command	npm run build
node_version	Node.js version	22
checkout	Clone the repository	true
admin_url	Deco admin URL	https://admin.deco.cx

deco-cx/cf-deploy/cleanup

Input	Description	Default
site	Site name	required
pr_number	PR number to clean up	required
admin_url	Deco admin URL	https://admin.deco.cx

How it works

1. The action checks out your code, installs dependencies, and runs npm run build
2. The built dist/worker.js is uploaded to the deco admin API
3. The admin validates your github.token against the GitHub API to verify the repo belongs to the deco-sites org
4. The admin uploads the worker to a Cloudflare Workers for Platforms dispatch namespace
5. Your site is live at {site}-tanstack.deco.site

Preview deployments

On pull requests, the worker is deployed as {site}--pr-{number} and a comment with the preview URL is posted on the PR. When the PR is closed, the cleanup action deletes the preview worker.

Authentication

This action uses the auto-generated github.token — no secrets configuration required. The deco admin validates the token to ensure the repository belongs to the deco-sites organization.

License

MIT