wikisearch: try browser-like UA against arch abuse filter #886
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Cloudflare Worker | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'index.js' | |
| - 'wrangler.toml' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set Worker Secrets | |
| shell: bash | |
| env: | |
| CF_API_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN_GITHUB }} | |
| # Secret names here MUST match what index.js reads from env. | |
| # index.js uses (grep 'env\.' index.js): | |
| # OPENROUTER_API_KEY / BRAIN_JUICE (alias), CLOUDFLARE_API_TOKEN, | |
| # CLOUDFLARE_ACCOUNT_ID, SECRET_SAUCE, ALERT_SIREN, SCAN_MASTER, | |
| # GUEST_LIST, WATCH_LIST, GROQ_API_KEY, GH_TOKEN, | |
| # RECAPTCHA_API_KEY, RECAPTCHA_SECRET_KEY | |
| OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} | |
| BRAIN_JUICE: ${{ secrets.OPENROUTER_API_KEY }} | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN_GITHUB }} | |
| SECRET_SAUCE: ${{ secrets.ADMIN_KEY }} | |
| ALERT_SIREN: ${{ secrets.DISCORD_WEBHOOK_URL }} | |
| SCAN_MASTER: ${{ secrets.VIRUSTOTAL_API_KEY }} | |
| GUEST_LIST: ${{ secrets.ALLOWED_ORIGINS }} | |
| WATCH_LIST: ${{ secrets.CRED_I }} | |
| GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }} | |
| GH_TOKEN: ${{ secrets.GH_TOKEN }} | |
| RECAPTCHA_API_KEY: ${{ secrets.RECAPTCHA_API_KEY }} | |
| RECAPTCHA_SECRET_KEY: ${{ secrets.RECAPTCHA_SECRET_KEY }} | |
| run: | | |
| set -e | |
| CF_ACCOUNT=$(curl -s -H "Authorization: Bearer $CF_API_TOKEN" \ | |
| "https://api.cloudflare.com/client/v4/accounts" | jq -r '.result[0].id') | |
| if [ -z "$CF_ACCOUNT" ] || [ "$CF_ACCOUNT" = "null" ]; then | |
| CF_ACCOUNT="${{ secrets.CLOUDFLARE_ACCOUNT_ID }}" | |
| fi | |
| echo "Deploying secrets to account $CF_ACCOUNT" | |
| SCRIPT_NAME="acreetionos-worker" | |
| # Core secrets — every deploy refreshes them so a fresh worker never | |
| # ends up without R2/API access (the bug that broke /api/r2/list). | |
| for name in OPENROUTER_API_KEY BRAIN_JUICE CLOUDFLARE_API_TOKEN SECRET_SAUCE ALERT_SIREN SCAN_MASTER GUEST_LIST WATCH_LIST RECAPTCHA_API_KEY RECAPTCHA_SECRET_KEY; do | |
| val="${!name}" | |
| if [ -n "$val" ]; then | |
| curl -s -X PUT "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT/workers/scripts/$SCRIPT_NAME/secrets" \ | |
| -H "Authorization: Bearer $CF_API_TOKEN" \ | |
| -H "Content-Type: application/json" \ | |
| -d "{\"name\":\"$name\",\"text\":\"$val\",\"type\":\"secret_text\"}" | |
| fi | |
| done | |
| # Account ID as its own secret so index.js can read env.CLOUDFLARE_ACCOUNT_ID | |
| if [ -n "$CF_ACCOUNT" ]; then | |
| curl -s -X PUT "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT/workers/scripts/$SCRIPT_NAME/secrets" \ | |
| -H "Authorization: Bearer $CF_API_TOKEN" \ | |
| -H "Content-Type: application/json" \ | |
| -d "{\"name\":\"CLOUDFLARE_ACCOUNT_ID\",\"text\":\"$CF_ACCOUNT\",\"type\":\"secret_text\"}" | |
| fi | |
| # Optional secrets — skip if not set | |
| for name in GROQ_API_KEY GH_TOKEN; do | |
| val="${!name}" | |
| if [ -n "$val" ]; then | |
| curl -s -X PUT "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT/workers/scripts/$SCRIPT_NAME/secrets" \ | |
| -H "Authorization: Bearer $CF_API_TOKEN" \ | |
| -H "Content-Type: application/json" \ | |
| -d "{\"name\":\"$name\",\"text\":\"$val\",\"type\":\"secret_text\"}" | |
| fi | |
| done | |
| - name: Deploy Worker | |
| uses: cloudflare/wrangler-action@v3 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_TOKEN_GITHUB }} |