Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Security: sharp is pinned to 0.35.5 everywhere (librsvg CVE-2026-96889) | 1 | { |
| 2 | "$schema": "../../node_modules/wrangler/config-schema.json", | |
| 3 | "name": "g1t-deployments", | |
| 4 | "account_id": "1e6f2cffa3f445920836e8ebe446bb58", | |
| 5 | "compatibility_date": "2026-09-26", | |
| 6 | "main": "./src/index.ts", | |
| 7 | // Reached only through service bindings; builds report through the API. | |
| 8 | "workers_dev": false, | |
| 9 | "placement": { "mode": "off" }, | |
| 10 | "d1_databases": [ | |
| 11 | { | |
| 12 | "binding": "DB", | |
| 13 | "database_name": "g1t-deployments", | |
| 14 | "database_id": "aa935a8f-845b-4132-8fa3-98f1afba1db5", | |
| 15 | "migrations_dir": "migrations" | |
| 16 | } | |
| 17 | ], | |
| 18 | "services": [ | |
| 19 | { "binding": "REPOS", "service": "g1t-repos" }, | |
| 20 | { "binding": "WORK", "service": "g1t-work" }, | |
| 21 | { "binding": "IDENTITY", "service": "g1t-identity" }, | |
| 22 | { "binding": "BILLING", "service": "g1t-billing" }, | |
| 23 | { "binding": "RUNNER", "service": "g1t-runner" }, | |
| 24 | // Deployments belong to projects. | |
| 25 | { "binding": "PROJECTS", "service": "g1t-projects" }, | |
| 26 | // Secrets and variables, with who may read each. | |
| 27 | { "binding": "ACTIONS", "service": "g1t-actions" }, | |
| 28 | // Production's screenshot, asked for once per deploy (services/og). | |
| Events: review requests, assignments, stops and deployments are published | 29 | { "binding": "SCREENSHOTS", "service": "g1t-og", "entrypoint": "Screenshots" }, |
| 30 | // Each finished build is published: deployment.succeeded or | |
| 31 | // deployment.failed, for the inbox, webhooks and workflows. | |
| Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry. | 32 | { "binding": "EVENTS", "service": "g1t-events" }, |
| 33 | // Observability: the token each project's apps send OpenTelemetry | |
| 34 | // with. Every app also names g1t-telemetry as its Tail Worker. | |
| 35 | { "binding": "TELEMETRY", "service": "g1t-telemetry" } | |
| Security: sharp is pinned to 0.35.5 everywhere (librsvg CVE-2026-96889) | 36 | ], |
| 37 | // Pull requests opened, pushed to, closed and merged; pushes to the | |
| 38 | // default branch. | |
| 39 | "queues": { | |
| Merge branch 'worktree-agent-ad8a36dfcd4176015' into spend-guardrails | 40 | "consumers": [{ "queue": "g1t-events-deployments", "max_batch_size": 20, "max_batch_timeout": 1, "max_retries": 3, "dead_letter_queue": "g1t-events-dlq" }] |
| Security: sharp is pinned to 0.35.5 everywhere (librsvg CVE-2026-96889) | 41 | }, |
| 42 | // Builds that died, usage counts, idle previews, apps of ended plans, | |
| 43 | // and charging a month that is over. | |
| 44 | "triggers": { "crons": ["*/10 * * * *"] }, | |
| 45 | "vars": { | |
| 46 | "CLOUDFLARE_ACCOUNT_ID": "1e6f2cffa3f445920836e8ebe446bb58", | |
| 47 | // The Workers for Platforms namespace apps are uploaded to; the | |
| 48 | // dispatcher on *.g1t.page (services/pages) reads from the same one. | |
| 49 | "DISPATCH_NAMESPACE": "g1t-deployments", | |
| 50 | "SITE": "https://g1t.sh", | |
| 51 | // The g1t.page zone: custom domains are Cloudflare for SaaS custom | |
| 52 | // hostnames on it (see src/domains.ts). | |
| Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's. | 53 | "CUSTOM_HOSTNAMES_ZONE_ID": "45d1c969bdd9d593756e70d5f45c2cbb", |
| Merge branch 'worktree-agent-a4d0c5ee9c2f877aa' | 54 | // Docker deployments (src/containers.ts): "on" runs container apps, |
| 55 | // found from a project's files with nothing to set. "off" for an | |
| 56 | // account without Containers (a self-hosted g1t): a container build | |
| 57 | // is then refused at its registry step, or built as the site the | |
| 58 | // project is without its Dockerfile ("Docker deployments" in | |
| 59 | // docs.g1t.sh/guides/deploy-to-cloudflare/). | |
| 60 | "CONTAINERS": "on", | |
| Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's. | 61 | // Where container apps' Workers report how long they ran. |
| Apps on g1t.page send Cloudflare's own traces to Observability: a span for each fetch, KV, D1, R2 and Durable Object call, with nothing in their code. Each upload names the Workers Observability destination g1t-traces (TRACES_DESTINATION), which sends OTLP to otel.g1t.sh/cloudflare/v1/traces with the telemetry service's export key; traces only, since logs already arrive through the Tail Worker, and nothing is kept in Cloudflare's own storage. The git guide says that with two-factor authentication on, git takes an access token, not the account password. | 62 | "G1T_API": "https://api.g1t.sh", |
| 63 | // Cloudflare's own tracing of each app (a span for every fetch, KV, | |
| 64 | // D1 and other call), sent to this Workers Observability destination | |
| 65 | // on the account, which points at otel.g1t.sh/cloudflare/v1/traces | |
| 66 | // with the telemetry service's CLOUDFLARE_EXPORT_KEY. Empty: none. | |
| 67 | "TRACES_DESTINATION": "g1t-traces" | |
| Security: sharp is pinned to 0.35.5 everywhere (librsvg CVE-2026-96889) | 68 | }, |
| 69 | // Custom domains: hostname to app, written here and read by the | |
| 70 | // dispatcher (services/pages). Made by scripts/setup-custom-domains.sh. | |
| 71 | "kv_namespaces": [{ "binding": "DOMAINS", "id": "14bc5c233d4c46a5bbf23b5367cce5fd" }], | |
| 72 | // Secret: CLOUDFLARE_API_TOKEN, scoped to Workers Scripts (edit) and | |
| 73 | // Account Analytics (read), and, for custom domains, SSL and | |
| Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's. | 74 | // Certificates (edit) on the g1t.page zone; for Docker deployments, also |
| 75 | // Containers (edit), for applications and registry logins. Without it | |
| 76 | // nothing deploys. | |
| Merge branch 'worktree-agent-a8752162fea25f63f' into spend-guardrails | 77 | // Every log kept: few requests, and a failed deploy must be traceable. |
| 78 | "observability": { "enabled": true, "head_sampling_rate": 1 } | |
| Security: sharp is pinned to 0.35.5 everywhere (librsvg CVE-2026-96889) | 79 | } |
This file's history is long; its oldest lines are credited to the oldest commit read.