web-ext work branch (superseded by #109)

.github/ISSUE_TEMPLATE/config.yml

@@ -1 +1,5 @@
 blank_issues_enabled: true
+contact_links:
+  - name: Security
+    url: https://github.com/enrych/toppings/security
+    about: Report sensitive issues through GitHub; do not file public issues for vulnerabilities.

.github/ISSUE_TEMPLATE/issue.md

@@ -0,0 +1,33 @@
+---
+name: Issue
+about: Bug, feature, or docs
+title: ""
+labels: []
+assignees: []
+---
+
+<!--
+  Agent — read AGENTS.md first.
+  Title: [Bug] | [Feature] | [Docs]
+  Parse: Summary → Context → Details → Expected vs actual → Acceptance criteria → Agent brief
+-->
+
+## Summary
+
+One sentence: what is broken, missing, or should change?
+
+## Context
+
+- **Surface:** extension | website | backend | packages | docs
+- **Version:** (if known)
+- **Environment:** browser, OS (if relevant)
+
+## Details
+
+## Expected vs actual
+
+N/A
+
+## Acceptance criteria
+
+## Agent brief

.github/workflows/deploy-backend.yml

@@ -0,0 +1,29 @@
+name: Deploy Backend
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "backend/**"
+  workflow_dispatch:
+
+concurrency:
+  group: "cf-worker-backend"
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install --frozen-lockfile
+        working-directory: backend
+      - run: bun run check
+        working-directory: backend
+      - uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          workingDirectory: backend
+          command: deploy

.github/workflows/deploy-website.yml

@@ -5,22 +5,17 @@ on:
     branches: ["main"]
     paths:
       - "website/**"
-
   workflow_dispatch:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
-# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
-# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
 concurrency:
-  group: "pages"
+  group: "cf-pages-website"
   cancel-in-progress: false
 
 jobs:
-  build:
+  deploy:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -29,42 +24,24 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
 
-      - name: Setup Pages
-        uses: actions/configure-pages@v4
-
-      - name: Restore cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            website/.next/cache
-          # Generate a new cache whenever packages or source files change.
-          key: ${{ runner.os }}-nextjs-${{ hashFiles('**/package-lock.json', '**/yarn.lock', '**/bun.lockb') }}-${{ hashFiles('**.[jt]s', '**.[jt]sx') }}
-          # If source files changed but packages didn't, rebuild from a prior cache.
-          restore-keys: |
-            ${{ runner.os }}-nextjs-${{ hashFiles('**/package-lock.json', '**/yarn.lock', '**/bun.lockb') }}-
-
       - name: Install dependencies
-        run: |
-          source $GITHUB_ENV
-          cd website && bun install
-
-      - name: Build with Next.js
-        run: |
-          source $GITHUB_ENV
-          cd website && bun run build
-
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        run: cd website && bun install
+
+      - name: Build (static export → website/out)
+        run: cd website && bun run build
+
+      # Deploys the static export to Cloudflare Pages.
+      # Required repo secrets:
+      #   CLOUDFLARE_API_TOKEN   — token with "Cloudflare Pages: Edit"
+      #   CLOUDFLARE_ACCOUNT_ID  — your Cloudflare account id
+      # The --project-name MUST match the Pages project bound to
+      # toppings.enry.ch in the Cloudflare dashboard.
+      - name: Deploy to Cloudflare Pages
+        uses: cloudflare/wrangler-action@v3
         with:
-          path: website/out
-
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v4
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: >-
+            pages deploy website/out
+            --project-name=toppings-website
+            --branch=main