feat: Cloudflare Access (M5), blob highlighting + image proxy, v0.2 CD, and release automation#1
Merged
Conversation
….2 CD Finish v0.1 hardening and ship the first slice of v0.2. M5 — Privacy via Cloudflare Access: - Worker accessGuard middleware verifies the Cf-Access-Jwt-Assertion JWT (RS256 via WebCrypto + cached JWKS, no jose) and gates /, /r/*, /api/*. No-ops unless ACCESS_AUD is set, so public mirrors stay open. - CLI `gitflare access enable/disable` provisions a self-hosted Access app + allow-list policy and redeploys with the Access vars. v0.1 polish: - Server-side syntax highlighting in the blob viewer (highlight.js core + curated grammars, 512KB cap with <pre> fallback). - README image proxy GET /r/:name/raw/* serving blobs from the Artifacts mirror, so images render for private repos and survive GitHub outages. - Styled empty/error states. v0.2 — Continuous deploy (MVP, self-deploy model): - On push, DeployDO reads/parses .gitflare/deploy.yml and uploads the pre-built worker entry via the Workers Scripts API. History + Deployments UI; CD gated on a CD_ENABLED var. - CLI `gitflare deploy enable/disable` stores a CF_DEPLOY_TOKEN Worker Secret. Caveats (see PLAN.md §12): Access gates the dashboard/API but not git clone; Access + Workers-Scripts API shapes still need live validation. Also adds CI (typecheck/test/build) plus Release Please + npm publish on merge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This was referenced May 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Finishes v0.1 hardening and ships the first slice of v0.2, plus CI + release automation.
M5 — Privacy via Cloudflare Access
accessGuardmiddleware verifies theCf-Access-Jwt-AssertionJWT (RS256 via WebCrypto + cached JWKS — nojose, to protect the bundle) and gates/,/r/*,/api/*. No-ops unlessACCESS_AUDis set, so public mirrors stay open./webhooks/github(HMAC) +/healthstay open.gitflare access enable/disableprovisions a self-hosted Access app + allow-list policy and redeploys with the Access vars.v0.1 polish
<pre>fallback).GET /r/:name/raw/*serving blobs from the Artifacts mirror, so README images render for private repos and survive GitHub outages.v0.2 — Continuous deploy (MVP, self-deploy model)
DeployDOreads/parses.gitflare/deploy.ymland uploads the pre-built worker entry via the Workers Scripts API. History + Deployments UI at/r/:name/deployments; CD gated on aCD_ENABLEDvar.gitflare deploy enable/disablestores aCF_DEPLOY_TOKENWorker Secret.Release automation
CIworkflow: typecheck + test + build on every PR and push to main.Releaseworkflow: Release Please opens/maintains a release PR from Conventional Commits; merging it bumps the version, tags, and publishesgitflareto npm (auth via theNPM_TOKENsecret).Caveats (also in PLAN.md §12)
git clone(clone hits Artifacts directly). Private-clone is a later (v0.4+) item.deploy.ymlfrom the default-branch tip.Tests
47 unit tests pass (Access JWT, highlight, workflow parser, deploy upload, plus existing). All packages typecheck; worker bundles at ~915 KB.
🤖 Generated with Claude Code