security(deploy-pages): enforce explicit caller contract

[seonghobae]

Root cause

The reusable Cloudflare Pages workflow predated the current least-privilege boundary: it declared no named secret interface, instructed callers to use secrets: inherit, and interpolated caller-controlled project, path, and domain strings into Wrangler, Cloudflare URLs, and the shell summary before validation.

The historical #901 implementation was source-valid but DIRTY, duplicated an unrelated CHANGELOG entry, omitted the root README from its contract test, and accepted uppercase or 59-character project names that Cloudflare Pages rejects.

Change

• require exactly CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID at workflow_call
• replace every central deploy-pages example with explicit two-name mappings
• fail closed on project, build-directory, symlink, and domain inputs before command, URL, or summary use
• enforce the observed Cloudflare Pages project-name boundary: 1-58 lowercase alphanumeric/hyphen characters, no leading/trailing hyphen
• keep checkout pinned, contents: read, caller-repository checkout, and Cloudflare deployment semantics
• document migration, rollback, current live consumer search, and APA 7th references

Consumer evidence

A live gh search code deploy-pages.yml@ --owner ContextualWisdomLab on 2026-08-24 returned only this central workflow plus the central root and infrastructure README examples. No product caller migration is currently required.

Verification

• TDD RED: adding root README to the contract reproduced its remaining secrets: inherit example
• TDD RED: production validation accepted both Uppercase and 59-character project names
• focused production-validator contracts: 32 passed
• uv run --with pip coverage run -m pytest -q: 1,425 passed, 1 skipped, 16 subtests
• coverage: 8,346 statements and 3,214 branches at 100%
• interrogate: 100%
• compileall, actionlint with ShellCheck 0.11.0, git diff check, and healthy synchronized CodeGraph

The explicit --with pip isolates the current-main fresh-uv bootstrap gap tracked separately by #1265.

Supersedes #901.
Closes #900.

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 8e656a37-a4cf-4d39-aa25-4d3ea3311fc8

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/pr901-current-main-replacement-20260824

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for b544d9c4433603a022df925809f3128ecefd5651.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32715898702/job/97396930356)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32715898702/job/97396930356)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: deploy-pages.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: deploy-pages.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (3 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (3 files)"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: deploy-pages-secret-contract.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: deploy-pages-secret-contract.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["Test: test_deploy_pages_secret_contract.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_deploy_pages_secret_contract.py"]
  R4 --> V4["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: b544d9c4433603a022df925809f3128ecefd5651
• Workflow run: 32745373145
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for b544d9c4433603a022df925809f3128ecefd5651.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32715898702/job/97396930356)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32715898702/job/97396930356)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: deploy-pages.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: deploy-pages.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (3 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (3 files)"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: deploy-pages-secret-contract.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: deploy-pages-secret-contract.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["Test: test_deploy_pages_secret_contract.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_deploy_pages_secret_contract.py"]
  R4 --> V4["targeted test run"]

Loading

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for b544d9c4433603a022df925809f3128ecefd5651.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32715898702/job/97396930356)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32715898702/job/97396930356)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: deploy-pages.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: deploy-pages.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (3 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (3 files)"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: deploy-pages-secret-contract.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: deploy-pages-secret-contract.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["Test: test_deploy_pages_secret_contract.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_deploy_pages_secret_contract.py"]
  R4 --> V4["targeted test run"]

Loading