chore: migrate production to the internal Cloudflare account - #138
Merged
Conversation
Point the production deployment configuration at the isolated Sentry Internal account, its WNAM D1 database, and the temporary workers.dev origin. Update the deployment guard and generated bindings so CI fails closed against accidental deployment to the former production account.
Add a fail-closed operator utility that inventories, copies, resumes, and verifies both Hackweek R2 buckets through the existing Wrangler OAuth login. Pin both account and database IDs, require explicit destination confirmation, preserve supported HTTP metadata, record custom metadata privately, and validate attachment checksums against source D1.
Allow operators to verify a unique cryptographically shuffled subset of migrated objects so large buckets can be checked quickly while retaining the existing full-verification mode.
Point the internal-account deployment at hackweek.sentry.new now that the custom domain has been cut over. Restore the matching Google OAuth callback while retaining the workers.dev deployment for pre-cutover validation history.
Remove the one-off cross-account copy and verification command now that all production attachments have been migrated and reconciled. Keep the permanent internal-account deployment configuration in the pull request.
Run the existing verified deployment pipeline automatically after changes land on master while retaining a master-only manual retry path. Document the required Cloudflare credentials and production deployment sequence so repository setup remains reproducible.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
hackweek.sentry.newas the production application origin and Google OAuth callbackmaster, with a master-only manual retry pathMigration status
Verification
actionlint .github/workflows/deploy.yml .github/workflows/test.ymlnpm testnpm run typechecknpm run lintnpm run format:checknpm run buildnpm run deploy:dry-run