Repository navigation
chore(ci): run Cloudflare deploys on Blacksmith runners - #56818
Merged
Merged
Conversation
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Looks good. I checked the diff and searched .github/ for every use of CLOUDFLARE_API_TOKEN. With this change, every job that uses it runs on blacksmith-4vcpu-ubuntu-2404: the six deploy workflows here, plus publish.yml, which already did. No job using the token is left on ubuntu-latest, so restricting the token to the Blacksmith egress IP shouldn't break any deploy. This is a CI-only change, so there was nothing to run locally.
Public API: unchanged.
No concerns.
This was referenced Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue for this PR
Closes #
Type of change
What does this PR do?
Moves every deploy workflow that uses
CLOUDFLARE_API_TOKENfrom GitHub-hostedubuntu-latesttoblacksmith-4vcpu-ubuntu-2404: deploy, deploy-changelog, deploy-files, deploy-posts, deploy-update and deploy-www.deploy.ymlpreviously used Blacksmith only ondev; now it uses Blacksmith on every branch.We're adding a Blacksmith static egress IP so the Cloudflare token can be restricted to that IP. GitHub-hosted runners share thousands of address ranges with all GitHub users, so jobs that use the token have to run on Blacksmith first.
publish.ymlalready does.How did you verify your code works?
The only change is the
runs-onlabel, whichpublish.ymlanddeploy.yml(ondev) already use. The deploy workflows will run on the new runners after merge.Screenshots / recordings
N/A
Checklist
— from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊