Deploy releases via wrangler instead of a watched branch

[TheMeinerLP]

Summary

Follow-up to #124 (merged). #124 added promote-release.yml, which fast-forwarded a release branch on every v* tag and relied on Cloudflare Workers Builds' Git integration to deploy that branch. That only works if Workers Builds watches release — but production needs to ship via an explicit deploy command instead.

This PR swaps promote-release.yml for deploy-release.yml: on every v* tag (the tags release-please cuts when its release PR is merged), build with the cloudflare_module preset and deploy with wrangler deploy.

The release-please setup from #124 is untouched — only the deploy mechanism changes.

What changes

	Before (#124)	After (this PR)
Trigger	v* tag	v* tag (unchanged)
Mechanism	fast-forward release branch, Workers Builds deploys it	GitHub Actions builds + wrangler deploy
Cloudflare Workers Builds	watches release	should be paused/disabled for auto-deploy
Secrets	none	CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID
Build location	Cloudflare infra	GitHub runner (~5–10 min/release)

Pipeline after merge

push to main ─→ (Workers Builds preview, if still enabled) + release-please updates the Release PR
merge Release PR ─→ release-please tags vX.Y.Z ─→ deploy-release.yml
                                                     pnpm build (cloudflare_module)
                                                     wrangler deploy from .output/
                                                     → Cloudflare Workers production

Nitro's cloudflare_module preset with deployConfig: true emits wrangler.json plus the worker entry into .output/, so cloudflare/wrangler-action runs deploy from that directory with no extra flags. The D1 binding (DB → launchpad) and vars come straight from the generated config.

⚠️ One-time setup required (cannot be done in code)

1. Cloudflare → Workers & Pages → (worker) → Settings → Build: pause or disable the Workers Builds Git integration so it does not also deploy on every push to main. (Optional: keep it enabled for non-production preview builds if you want PR previews — just make sure it does not target production.)
2. GitHub → Settings → Secrets and variables → Actions: add
   • CLOUDFLARE_API_TOKEN — a token with Workers Scripts:Edit + the account's D1:Edit scope
   • CLOUDFLARE_ACCOUNT_ID
3. If promote-release.yml already created a release branch from Adopt release-please + tag-gated production deploys #124, it can be deleted — nothing references it anymore.

Until step 2 is done, the workflow runs on a tag but the deploy step fails (missing secrets); the build step still validates.

Test plan

• Repo secrets CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID added
• Workers Builds no longer auto-deploys production from main
• Cut a release via the release-please PR → v* tag is pushed
• deploy-release.yml runs: pnpm build succeeds, wrangler deploy publishes from .output/
• Production Worker serves the new version (appConfig.version matches the tag)
• A normal push to main does not deploy production

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	launchpad	040bfb9	Commit Preview URL Branch Preview URL	May 15 2026, 10:35 PM