feat: add optional seeding global equivalent domains to github actions

.github/workflows/deploy-dev.yaml

@@ -164,6 +164,23 @@ jobs:
                   echo "❌ Max retries ($MAX_RETRIES) exceeded"
                   exit 1
 
+            - name: Seed global equivalent domains (dev, optional)
+              env:
+                  SEED_GLOBAL_DOMAINS: ${{ vars.SEED_GLOBAL_DOMAINS || 'true' }}
+                  GLOBAL_DOMAINS_URL_DEV: ${{ vars.GLOBAL_DOMAINS_URL_DEV }}
+              run: |
+                  set -euo pipefail
+                  if [ "${SEED_GLOBAL_DOMAINS}" = "false" ]; then
+                    echo "⏭️ SEED_GLOBAL_DOMAINS=false, skipping"
+                    exit 0
+                  fi
+
+                  if [ -n "${GLOBAL_DOMAINS_URL_DEV:-}" ]; then
+                    bash scripts/seed-global-domains.sh --db vault1 --env dev --remote --wrangler-version "${WRANGLER_VERSION}" --url "${GLOBAL_DOMAINS_URL_DEV}"
+                  else
+                    bash scripts/seed-global-domains.sh --db vault1 --env dev --remote --wrangler-version "${WRANGLER_VERSION}"
+                  fi
+
             - uses: cloudflare/wrangler-action@v3
               id: cf
               with:
@@ -172,4 +189,4 @@ jobs:
                   wranglerVersion: ${{ env.WRANGLER_VERSION }}
                   packageManager: npm
 
-                  command: deploy --env dev
+                  command: deploy --env dev

.github/workflows/push-cloudflare.yaml

@@ -174,6 +174,23 @@ jobs:
                   echo "❌ Max retries ($MAX_RETRIES) exceeded"
                   exit 1
 
+            - name: Seed global equivalent domains (optional)
+              env:
+                  SEED_GLOBAL_DOMAINS: ${{ vars.SEED_GLOBAL_DOMAINS || 'true' }}
+                  GLOBAL_DOMAINS_URL: ${{ vars.GLOBAL_DOMAINS_URL }}
+              run: |
+                  set -euo pipefail
+                  if [ "${SEED_GLOBAL_DOMAINS}" = "false" ]; then
+                    echo "⏭️ SEED_GLOBAL_DOMAINS=false, skipping"
+                    exit 0
+                  fi
+
+                  if [ -n "${GLOBAL_DOMAINS_URL:-}" ]; then
+                    bash scripts/seed-global-domains.sh --db vault1 --remote --wrangler-version "${WRANGLER_VERSION}" --url "${GLOBAL_DOMAINS_URL}"
+                  else
+                    bash scripts/seed-global-domains.sh --db vault1 --remote --wrangler-version "${WRANGLER_VERSION}"
+                  fi
+
             - uses: cloudflare/wrangler-action@v3
               id: cf
               with:

README.md

@@ -198,6 +198,7 @@ The worker runs a scheduled task to clean up soft-deleted items. By default, it
 
 - **Backup & restore:** See [Database Backup & Restore](docs/db-backup-recovery.md#github-actions-backups) for automated backups and manual restoration steps.
 - **Time Travel:** See [D1 Time Travel](docs/db-backup-recovery.md#d1-time-travel-point-in-time-recovery) to restore to a point in time.
+- **Seeding Global Equivalent Domains (optional):** See [docs/deployment.md](docs/deployment.md) for seeding in CLI deploy and CI/CD.
 - **Local dev with D1:**
   - Quick start: `wrangler dev --persist`
   - Full stack (with web vault): download frontend assets as in deployment doc, then `wrangler dev --persist`

docs/deployment.md

@@ -87,6 +87,10 @@ This page covers the two deployment paths. Pick the one that fits your workflow
    # For migrations
    wrangler d1 migrations apply vault1 --remote
 
+   # (Optional) Seed global equivalent domains into D1
+   # This downloads Vaultwarden's global_domains.json by default.
+   bash scripts/seed-global-domains.sh --db vault1 --remote
+   
    wrangler deploy
    ```
 
@@ -119,7 +123,9 @@ Add the following secrets to your GitHub repository (`Settings > Secrets and var
 | `D1_DATABASE_ID` | yes | Your production D1 database ID |
 | `D1_DATABASE_ID_DEV` | no | Dev D1 database ID (required only if you use the `Deploy Dev` workflow on the `dev` branch) |
 
-### Optional Variables (Web Vault frontend version)
+### Optional Variables
+
+#### Web Vault frontend version
 
 You can pin/override the bundled Web Vault (bw_web_builds) version via GitHub Actions Variables:
 
@@ -128,6 +134,20 @@ You can pin/override the bundled Web Vault (bw_web_builds) version via GitHub Ac
 | `BW_WEB_VERSION` | prod (`main/uat/release*`) | `v2025.12.0` | `v2025.12.0` | Set to `latest` to follow upstream latest release |
 | `BW_WEB_VERSION_DEV` | dev (`dev`) | `v2025.12.0` | `v2025.12.0` | Set to `latest` to follow upstream latest release |
 
+#### Global Equivalent Domains
+
+Bitwarden clients use `globalEquivalentDomains` for URI matching across well-known domain groups.
+
+To avoid bundling a large JSON file into the Worker, the dataset can be stored in D1 and seeded during deploy.
+
+| Variable | Applies to | Default | Example | Notes |
+|----------|------------|---------|---------|-------|
+| `SEED_GLOBAL_DOMAINS` | prod + dev | `true` | `false` | Set to `false` to skip seeding (API returns empty list) |
+| `GLOBAL_DOMAINS_URL` | prod | (empty) | raw GitHub URL | Optional: pin a specific Vaultwarden tag/commit for reproducible deploys |
+| `GLOBAL_DOMAINS_URL_DEV` | dev | (empty) | raw GitHub URL | Same as prod, but for dev workflow |
+
+If you skip seeding, `/api/settings/domains` and `/api/sync` will return `globalEquivalentDomains: []`.
+
 > [!NOTE] The `CLOUDFLARE_API_TOKEN` must have **both** Worker and D1 permissions:
 > - **Edit Cloudflare Workers** - Required for deploying the Worker
 > - **Edit D1** - Required for database migrations and backups

scripts/seed-global-domains.sh

@@ -11,13 +11,16 @@ This:
 3) Executes it against a D1 database via wrangler
 
 Usage:
-  ./scripts/seed-global-domains.sh --db <d1_name> [--env <wrangler_env>] [--remote] [--url <raw_json_url>]
+  ./scripts/seed-global-domains.sh --db <d1_name> [--env <wrangler_env>] [--remote] [--url <raw_json_url>] [--wrangler-version <ver>]
 
 Examples:
   ./scripts/seed-global-domains.sh --db vault1 --remote
   ./scripts/seed-global-domains.sh --db vault1 --env dev --remote
   ./scripts/seed-global-domains.sh --db vault1 --remote \
     --url https://raw.githubusercontent.com/dani-garcia/vaultwarden/<tag-or-commit>/src/static/global_domains.json
+
+  # Use a pinned Wrangler version via npx (recommended for CI)
+  ./scripts/seed-global-domains.sh --db vault1 --remote --wrangler-version 4.54.0
 EOF
 }
 
@@ -27,6 +30,7 @@ REMOTE=0
 URL=""
 INPUT=""
 OUTPUT="sql/global_domains_seed.sql"
+WRANGLER_VERSION=""
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -42,6 +46,8 @@ while [[ $# -gt 0 ]]; do
       INPUT="${2:-}"; shift 2;;
     --output)
       OUTPUT="${2:-}"; shift 2;;
+    --wrangler-version)
+      WRANGLER_VERSION="${2:-}"; shift 2;;
     -h|--help)
       usage; exit 0;;
     *)
@@ -74,6 +80,12 @@ if [[ "$REMOTE" -eq 1 ]]; then
   WRANGLER_ARGS+=(--remote)
 fi
 
-wrangler "${WRANGLER_ARGS[@]}"
+WRANGLER=(wrangler)
+if [[ -n "$WRANGLER_VERSION" ]]; then
+  WRANGLER=(npx --yes "wrangler@${WRANGLER_VERSION}")
+elif ! command -v wrangler >/dev/null 2>&1; then
+  WRANGLER=(npx --yes wrangler)
+fi
 
+"${WRANGLER[@]}" "${WRANGLER_ARGS[@]}"