Set up CI deploy: Cloudflare secrets + prod config

The deploy workflow (.github/workflows/deploy.yml) runs wrangler deploy on every push to main. Before the first deploy works, complete the setup below.

1. Add GitHub Actions secrets

Settings → Secrets and variables → Actions → New repository secret:

• CLOUDFLARE_API_TOKEN — Cloudflare → My Profile → API Tokens → use the "Edit Cloudflare Workers" template, scoped to this account.
• CLOUDFLARE_ACCOUNT_ID — from the Cloudflare dashboard URL or Workers overview. (Optional if the token has one account, but safer to set.)

2. Set the Worker runtime secrets in Cloudflare

wrangler deploy ships code + assets but not runtime secrets. Set these once per environment (cd web-dec && wrangler secret put <NAME>, or via the dashboard). They persist across deploys.

• DATABASE_URL — Neon Postgres connection string
• OPENROUTER_API_KEY — LLM (router, recommendations, /research, etc.)
• HONCHO_API_KEY — conversational memory (optional; features degrade without it)
• BETTER_AUTH_SECRET — generate with openssl rand -base64 32
• BETTER_AUTH_URL — public origin / OAuth issuer (e.g. the prod host)

3. Apply database migrations to prod

The workflow does not run migrations — deploying code won't create the waitlist / Better Auth tables. Apply the Drizzle migrations against the prod DB once (and after any new migration):

• cd web-dec && pnpm db:migrate (with prod DATABASE_URL)

Decide whether to automate this as a CI step before deploy, or keep it manual. Automating mutates prod on every push, so gate it carefully.

4. Confirm the trigger branch

• The workflow deploys on push to main only. Current dev is on dc/v2; nothing deploys until it merges to main. Change the branch in deploy.yml if needed.

Verify

• Push to main (or run the workflow manually via the Actions tab → Deploy → Run workflow) and confirm a green run + the Worker updates.

Read .github/workflows/deploy.yml first to confirm the push trigger and wrangler deploy step. In web-dec, run pnpm db:migrate against the production DATABASE_URL after configuring the listed GitHub Actions and Cloudflare runtime secrets. Done means a main-branch or manually triggered workflow completes successfully and the Worker updates.