# Cloudflare setup

One-time configuration after the repo is pushed to GitHub. Two steps:

1. Register a `workers.dev` subdomain (account-level, one time per account).
2. Connect the repo for auto-deploy on every push to `main`.

After this, CI (this repo's `.github/workflows/ci.yml`) verifies each push, and Cloudflare deploys when CI passes on `main`.

---

## 1. Register the `workers.dev` subdomain

The first deploy through `wrangler` will warn if no subdomain exists for the account. In the dashboard:

1. Open https://dash.cloudflare.com
2. **Compute** (left sidebar) → **Workers & Pages**
3. Click your Worker (`unicorn-creative-analyzer`).
4. Open the **Domains** tab (top nav, alongside Overview / Metrics / Deployments / Settings).
5. If no subdomain is registered, the page shows a "Set up your workers.dev subdomain" prompt. Pick a slug (lowercase, hyphens allowed) — e.g. `eugene-nak`. Your worker will then be available at `unicorn-creative-analyzer.eugene-nak.workers.dev`.
6. After registering, enable the **workers.dev** toggle for this Worker on the same Domains tab.

That's the only piece the CLI can't do automatically — once the subdomain exists, `wrangler deploy` and the GitHub integration both work without further prompts.

---

## 2. Connect the repo for auto-deploy

Cloudflare Workers Builds builds + deploys on every push, replacing the need for a CLI deploy.

1. From the Worker page → **Settings** tab.
2. Scroll to **Build** → **Git repository**.
3. Click **GitHub**, authorise the Cloudflare GitHub App for your account if prompted.
4. Pick the `unicorn-creative-analyzer` repo, branch `main`.
5. Configure the build:
   - **Install command:** `npm ci`
   - **Build command:** `npm run build` (this runs `cd web && vite build` and outputs to `dist/`)
   - **Root directory:** _leave blank_ (repo root)
   - **Deploy command:** _leave blank_ (Cloudflare runs `wrangler deploy` automatically when the build succeeds)
6. **Save**.

The first build kicks off immediately. Subsequent pushes to `main` trigger a build via the GitHub App webhook.

### Why CI doesn't deploy

The repo's `.github/workflows/ci.yml` only runs format, lint, type-check, test, and build. It does **not** deploy. The reason: deploying from two places (GitHub Actions and Cloudflare Builds) creates race conditions and double-counts builds. We let Cloudflare own deployment and let GitHub Actions own verification.

If CI fails on `main`, Cloudflare will still try to build (and likely fail at the same step). To prevent that, add a branch-protection rule in GitHub: require the **Verify** check to pass before merging into `main`.

### Why we still keep `wrangler deploy` available

`npm run deploy` (= `npm run build && wrangler deploy`) is left in `package.json` so contributors can deploy manually from a feature branch for hotfixes or when Cloudflare's GitHub integration is unavailable. Production deploys should go through the `main` branch + auto-deploy.

---

## Production secret

`GEMINI_API_KEY` must be set as a Wrangler secret (not in `wrangler.toml` or `.dev.vars`):

```bash
npx wrangler secret put GEMINI_API_KEY
# paste your key when prompted (stdin)
```

The secret is encrypted by Cloudflare and only available to the Worker at runtime via `env.GEMINI_API_KEY`. Cloudflare Builds (step 2 above) does not need this — secrets are independent of the build pipeline.

To rotate: re-run `wrangler secret put GEMINI_API_KEY` with the new value. The next deploy picks it up; no rebuild required.

---

## Verifying the deploy

1. Find the deployed URL on the Worker's **Overview** tab — it'll be `unicorn-creative-analyzer.<your-subdomain>.workers.dev`.
2. `curl https://<deployed-url>/api/health` should return `{"status":"ok"}`.
3. Open the URL in a browser — the React SPA loads.
4. Paste one of the six reference Drive URLs (see `.planning/phases/01-analyze-pipeline/01-03-FIXTURES.md`) and click **Analyze**. You should get a populated `{ person, transcript }` response within ~5–30 s (depending on file size).

Logs are visible via `npx wrangler tail` while requests are flowing.