uploads-api main deploy failed silently (CF 524) — no retry/alerting on failed Workers Builds

[zachdunn]

What happened

After merging #95 (21:35 UTC) and #99 (22:10 UTC) on 2026-07-12, the Workers Builds: uploads-api check on both merge commits reported success with zero duration (started_at == completed_at), but no production deployment occurred — wrangler deployments list --name uploads-api showed the newest deploy at 20:59 UTC (the #94 build). Production served pre-#95 code (the Phase 3 /admin-ui/* and /admin/orgs/backfill routes 404'd) until a manual pnpm run deploy:api from main shipped 157e672.

uploads-auth (configured the same day) deployed correctly on the same merges, so this is specific to the uploads-api build project.

Likely suspects

• Watch-path filters on the uploads-api Builds project not matching the changed paths (both merges touched apps/api/src/** plus apps/auth/**)
• A build-skipped state being reported to GitHub as success

To do

• Check the uploads-api project's build history + watch paths in the dash: https://dash.cloudflare.com/?to=/b082600d280d44fd5da3501bc1bffe2f/workers/services/view/uploads-api/production/builds
• Compare its config against the (working) uploads-auth project
• Confirm a subsequent apps/api change auto-deploys

🤖 Generated with Claude Code

[zachdunn]

Root cause found (build logs + config reviewed)

Not a watch-path/skip bug — the config is correct:

• The feat: Better Auth Phase 3 — organizations, membership, invites #95 merge build ran and failed: wrangler deploy got through migrations and upload, then POST /accounts/.../workers/scripts/uploads-api/versions returned a 524 (Cloudflare API gateway timeout — service-side, Ray ID a1a331455a7c1f10-LAX). Transient Cloudflare issue.
• The fix(auth): create orgs via direct insert on /internal/orgs #99 merge correctly skipped uploads-api: watch paths are apps/api/*, packages/storage/*, pnpm-lock.yaml, and fix(auth): create orgs via direct insert on /internal/orgs #99 only touched apps/auth/**.
• Prod was reconciled manually with pnpm run deploy:api from main (157e672) on 2026-07-12.

Remaining problem: failed main deploys are silent

The build failed but the merge commit's GitHub check read success (zero-duration — likely posted by a different build for the SHA), there's no automatic retry, and no alert. Prod ran stale Phase-3-less code for ~1.5h and was only caught by probing routes.

Revised to-dos:

• Add failure visibility for production builds (Workers Builds notifications, or a deploy hook → alert)
• Understand/report the success-check discrepancy on the merge commit (possible Workers Builds ↔ GitHub check attribution issue)
• Optional: add root package.json to watch paths (the deploy:api script lives there)

🤖 Addressed by Claude Code