chore: add Flue deploy workflow on merge to production (#32772)

* [Flue] Add production deploy workflow on merge to production

* [Flue] List all production secrets in secrets.required

* [Flue] Rename deploy secret to CLOUDFLARE_DOCS_BOT_FLUE_DEPLOY

* [Flue] Use existing CLOUDFLARE_API_TOKEN secret for deploy

* [Flue] Fix review findings: remove redundant build step, add curl failure handling

* [Flue] Fix review findings: restrict workflow_dispatch branch, remove non-secret and unused entries from secrets.required

* [Flue] Fix review findings: correct Google Chat link syntax, remove unused DOCS_FLUE_CF_TOKEN secret

* [Flue] Revert to Google Chat pipe link syntax in failure notification

Author: mvvmm

.flue/wrangler.jsonc

@@ -189,4 +189,15 @@
 			"head_sampling_rate": 1,
 		},
 	},
+	"secrets": {
+		"required": [
+			"DOCS_FLUE_AI_GATEWAY_ID",
+			"DOCS_FLUE_GITHUB_APP_ID",
+			"DOCS_FLUE_GITHUB_APP_PRIVATE_KEY",
+			"DOCS_FLUE_GITHUB_INSTALLATION_ID",
+			"GITHUB_WEBHOOK_SECRET",
+			"GITHUB_ORG_TOKEN",
+			"DOCS_FLUE_INTERNAL_TOKEN",
+		],
+	},
 }

.github/workflows/ci.yml

@@ -7,6 +7,7 @@ on:
     paths-ignore:
       - ".flue/**"
       - ".github/workflows/flue-ci.yml"
+      - ".github/workflows/flue-deploy.yml"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

.github/workflows/flue-deploy.yml

@@ -0,0 +1,59 @@
+name: Flue Deploy
+
+on:
+  push:
+    branches:
+      - production
+    paths:
+      - ".flue/**"
+      - ".github/workflows/flue-deploy.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: flue-deploy-production
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    if: github.repository == 'cloudflare/cloudflare-docs' && (github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/production')
+    name: Deploy
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+        with:
+          version: 11
+
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version: 24.x
+          cache: pnpm
+          cache-dependency-path: .flue/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: .flue
+
+      - name: Deploy
+        run: pnpm run flue:deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+
+      - name: Notify Google Chat on failure
+        if: failure()
+        env:
+          WEBHOOK_URL: ${{ secrets.CED_TEAM_ALERTS_CHANNEL_WEBHOOK }}
+          ACTOR: ${{ github.actor }}
+          REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          MESSAGE="❌ *Flue Deploy* workflow failed.\nActor: $ACTOR\n<https://github.com/$REPO/actions/runs/$RUN_ID|View run>"
+          JSON_PAYLOAD=$(jq -n --arg text "$MESSAGE" '{text: $text}')
+
+          curl --fail --max-time 30 --silent --show-error -X POST "$WEBHOOK_URL" \
+            -H "Content-Type: application/json" \
+            -d "$JSON_PAYLOAD"

package.json

@@ -32,7 +32,7 @@
 		"flue:dev": "NODE_OPTIONS=--max-old-space-size=8192 pnpm --dir .flue exec vite dev",
 		"flue:dev:wrangler": "pnpm --dir .flue exec vite build && cp -f .flue/.env.local .flue/dist/cloudflare_docs_flue/.dev.vars && pnpm --dir .flue exec wrangler dev --config dist/cloudflare_docs_flue/wrangler.json --remote",
 		"flue:build": "pnpm --dir .flue exec vite build",
-		"flue:deploy": "pnpm run flue:build && pnpm --dir .flue exec wrangler deploy --config dist/cloudflare_docs_flue/wrangler.json --secrets-file .env",
+		"flue:deploy": "pnpm run flue:build && pnpm --dir .flue exec wrangler deploy --config dist/cloudflare_docs_flue/wrangler.json",
 		"flue:clear-r2-pr-data:local": "tsx .flue/bin/clear-r2-pr-data.ts --local",
 		"flue:reset:local": "rm -rf .flue/.wrangler/state .flue/.wrangler/tmp .flue/dist/cloudflare_docs_flue/.wrangler/state && echo 'Cleared local flue dev state (Durable Objects + R2). Stop the dev server before running this.'",
 		"flue:evals": "tsx .flue/bin/run-evals.ts",