ci(site): drop Cloudflare purge, unblocking the deploy workflow - #1114
Open
xiaolai wants to merge 1 commit into
Open
ci(site): drop Cloudflare purge, unblocking the deploy workflow#1114xiaolai wants to merge 1 commit into
xiaolai wants to merge 1 commit into
Conversation
The purge step has failed on every run since the Cloudflare credentials went stale, returning HTTP 401 from the API. Build and deploy both succeed, so the site content stayed current while the workflow reported failure on all of the last five runs. The step is also about to become meaningless. nlpm.com is moving to a DNS-only record with no Cloudflare proxy in front, because proxying is what broke HTTPS: Cloudflare intercepted GitHub's ACME HTTP-01 challenge, so the Let's Encrypt certificate could not renew, it expired 2026-08-17, and Cloudflare Full (Strict) has been returning 526 to every visitor since. With no proxy there is no edge cache to purge. Removes the 75-second CDN wait along with it. That sleep existed only to keep the purge from re-caching stale content, as its own comment stated, so without the purge it is pure dead time on every deploy. Leaves a header note recording the interaction, so the proxy and the purge do not get re-introduced together later.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
deploy-sitehas failed on all five most recent runs. Build and deploy succeed every time; the only failing step is Purge Cloudflare cache, which gets HTTP 401 because the Cloudflare API credentials went stale. That is why the site content stayed current while the workflow stayed red.What this changes
Removes the purge step, and the 75-second CDN wait that existed only to sequence before it. The wait's own comment said its sole purpose was to stop the purge re-caching stale content, so with the purge gone it is dead time on every deploy.
Adds a header note recording why there is no purge, so the proxy and the purge do not get quietly re-introduced together later.
Context: this is half of the nlpm.com outage fix
The site has been returning 526 to every visitor for roughly three weeks. The cause is the Cloudflare proxy, not the build:
104.21.78.50,172.67.216.239, both Cloudflare proxy IPs526invalid origin certificatebad_authz, ACME authorization needs restartingCloudflare intercepts
/.well-known/acme-challenge/, so GitHub's Let's Encrypt renewal cannot complete. The certificate expired on 2026-08-17 and Cloudflare Full (Strict) has rejected the origin ever since.The remaining half is a DNS change: point nlpm.com at GitHub's four Pages addresses as a DNS-only record, then restart the ACME authorization and enable Enforce HTTPS. Once that lands, Cloudflare is out of the serving path entirely and this purge step would have nothing to purge.
Merging this is safe independently. The step it removes has been a no-op since the credentials expired.