fix(deploy): only run DO migration on initial worker creation (#1)

The DO migration (new_tag=v1) may only be applied once. The old
durable-object-namespace detection wrongly reported 'migration needed'
even though the namespace already existed at tag v1, so Terraform
re-sent the v1 migration on an already-migrated worker and Cloudflare
rejected the apply with 412 / code 10079. Gate migration on
worker-script existence instead.

Co-authored-by: Test User <test@example.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -78,13 +78,20 @@ jobs:
         run: |
           terraform init
 
-          DO_RESP=$(curl "https://api.cloudflare.com/client/v4/accounts/$TF_VAR_CLOUDFLARE_ACCOUNT_ID/workers/durable_objects/namespaces?per_page=1000" \
+          # The DO migration (new_tag = "v1") may only be applied ONCE, at the
+          # worker's initial creation. If the worker already exists it is already
+          # at tag "v1", and re-sending the migration makes Cloudflare reject the
+          # apply with 412 / code 10079 ("Actor migration tag precondition failed,
+          # got tag '' when expected tag is 'v1'"). So gate the migration purely on
+          # worker-script existence, not on a (flaky) durable-object namespace query.
+          WORKER_HTTP=$(curl -s -o /dev/null -w "%{http_code}" \
+            "https://api.cloudflare.com/client/v4/accounts/$TF_VAR_CLOUDFLARE_ACCOUNT_ID/workers/scripts/uptimeflare_worker" \
             -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN")
 
-          if echo "$DO_RESP" | jq -e '.result[] | select(.script == "uptimeflare_worker" and .class == "RemoteChecker")' > /dev/null; then
-            echo "Existing Durable Object namespace found for uptimeflare_worker RemoteChecker. No migration needed."
+          if [[ "$WORKER_HTTP" == "200" ]]; then
+            echo "Worker uptimeflare_worker already exists (HTTP $WORKER_HTTP); DO migration v1 already applied. No migration needed."
           else
-            echo "No existing Durable Object namespace found for uptimeflare_worker RemoteChecker. Need migration."
+            echo "Worker uptimeflare_worker not found (HTTP $WORKER_HTTP). Applying initial DO migration."
             export TF_VAR_enable_do_migration=true
           fi