From 3dca962be3653857bb83c3d530703e626b72fece Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Konrad=20Fr=C3=B6hlich?= Date: Sun, 12 Jul 2026 14:59:58 +0200 Subject: [PATCH] fix(deploy): only run DO migration on initial worker creation (#1) The DO migration (new_tag=v1) may only be applied once. The old durable-object-namespace detection wrongly reported 'migration needed' even though the namespace already existed at tag v1, so Terraform re-sent the v1 migration on an already-migrated worker and Cloudflare rejected the apply with 412 / code 10079. Gate migration on worker-script existence instead. Co-authored-by: Test User Co-authored-by: Claude Opus 4.8 --- .github/workflows/deploy.yml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index b001122..5de295a 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -78,13 +78,20 @@ jobs: run: | terraform init - DO_RESP=$(curl "https://api.cloudflare.com/client/v4/accounts/$TF_VAR_CLOUDFLARE_ACCOUNT_ID/workers/durable_objects/namespaces?per_page=1000" \ + # The DO migration (new_tag = "v1") may only be applied ONCE, at the + # worker's initial creation. If the worker already exists it is already + # at tag "v1", and re-sending the migration makes Cloudflare reject the + # apply with 412 / code 10079 ("Actor migration tag precondition failed, + # got tag '' when expected tag is 'v1'"). So gate the migration purely on + # worker-script existence, not on a (flaky) durable-object namespace query. + WORKER_HTTP=$(curl -s -o /dev/null -w "%{http_code}" \ + "https://api.cloudflare.com/client/v4/accounts/$TF_VAR_CLOUDFLARE_ACCOUNT_ID/workers/scripts/uptimeflare_worker" \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN") - if echo "$DO_RESP" | jq -e '.result[] | select(.script == "uptimeflare_worker" and .class == "RemoteChecker")' > /dev/null; then - echo "Existing Durable Object namespace found for uptimeflare_worker RemoteChecker. No migration needed." + if [[ "$WORKER_HTTP" == "200" ]]; then + echo "Worker uptimeflare_worker already exists (HTTP $WORKER_HTTP); DO migration v1 already applied. No migration needed." else - echo "No existing Durable Object namespace found for uptimeflare_worker RemoteChecker. Need migration." + echo "Worker uptimeflare_worker not found (HTTP $WORKER_HTTP). Applying initial DO migration." export TF_VAR_enable_do_migration=true fi