Uh oh!
There was an error while loading. Please reload this page.
ci(embed): deploy the embed player from main - #14573
Conversation
The embed had no deploy path. CircleCI used to ship it via `embed-deploy-production-cloudflare`, and #14504 deleted .circleci without porting that job, so packages/embed has not been deployed since 2026-06-23 - long enough that #14571 sat merged for four days with the old bundle still live. The package README still claims "Deployed via CI". Port the job into web.yml. Differences from the CircleCI original: - Triggers on main rather than release* branches, so a merged embed change ships without a release cut. - Not behind the production gate that web and desktop share. The embed is a self-contained player with no desktop/S3 half to coordinate with, and gating it would mean the deploy that just rotted for two months needs a human every time. - Runs `wrangler deploy` pinned to 4.54.0, matching the web deploy, instead of `npm run deploy:prod` - `wrangler publish` no longer exists in wrangler 4. Also adds packages/embed to the workflow's path filters. Without that an embed-only change doesn't trigger the workflow at all, which is why #14571 ran no CI beyond the security scanners. Two fixes the port depends on: - wrangler.toml was still wrangler-1.x era. `type = "webpack"` is silently ignored and `[site] entry-point` is deprecated; replaced with a top-level `main`. Verified with `--dry-run` on both the pinned 3.30.1 and 4.54.0 - clean on both, warnings on neither. - `deploy:prod` called `wrangler publish`, removed in wrangler 4, so the documented manual deploy was already broken on any current wrangler. The build/deploy split stays as it was: `build:prod` renames build/ to build-production/ and the deploy job renames it back, because wrangler.toml's [site] bucket points at ./build. That's why `build:prod && deploy:prod` on its own deploys nothing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Dependency limit exceeded — report not shown. This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report. Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard. Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account. |
The embed player has had no deploy path since 2026-06-23. CircleCI shipped it via
embed-deploy-production-cloudflare; #14504 deleted.circleciwithout porting that job, and nothing in.github/has referencedpackages/embedsince. The package README still says "Deployed via CI".Caught because #14571 sat merged for four days with the old bundle still serving on
audius.co/embed.The port
Adds an
embed-deployjob toweb.yml. Three deliberate differences from the CircleCI original:release*branchesmainnpm run deploy:prodnpx wrangler@4.54.0 deploy, matching the web deployNot behind the
productiongate that web and desktop share. The embed is a self-contained player with no desktop/S3 half to coordinate with, and gating it would mean the deploy that just rotted for two months needs a human every time. Easy to addneeds: [production-gate]if you'd rather it wait.Also adds
packages/embed/**to the workflow path filters — without it an embed-only change doesn't trigger this workflow at all, which is why #14571 ran no CI beyond the security scanners.Two fixes it depends on
wrangler.tomlwas wrangler-1.x era.type = "webpack"is silently ignored and[site] entry-pointis deprecated; both replaced with a top-levelmain. Verified with--dry-runon the pinned 3.30.1 and 4.54.0 — clean on both, warnings on neither.deploy:prodcalledwrangler publish, which no longer exists in wrangler 4. So the manual deploy documented in the README was already broken on any current wrangler. Nowwrangler deploy --env production.The odd-looking build/deploy split is preserved, not fixed:
build:prodrenamesbuild/→build-production/and the deploy job renames it back, because[site] bucketpoints at./build. That split across repo and CI is whybuild:prod && deploy:proddeploys nothing on its own. Worth collapsing someday; left alone here to keep this a port.Verification
Ran the job's exact step sequence locally:
npm run build:prod→workers-site npm i→mv build-production build→npx wrangler@4.54.0 deploy --env production --dry-run. Uploads 57.95 KiB, zero warnings. Confirmed the built bundle contains #14571's strings, so this would ship the fix that's currently stuck.Only thing not verifiable without merging: that
secrets.CLOUDFLARE_API_TOKEN(already used by the web deploy in this same workflow) has access to theembedworker.🤖 Generated with Claude Code