diff --git a/.github/workflows/deploy-dev.yaml b/.github/workflows/deploy-dev.yaml index a4d28b8..56da873 100644 --- a/.github/workflows/deploy-dev.yaml +++ b/.github/workflows/deploy-dev.yaml @@ -13,6 +13,10 @@ jobs: # Pin tool versions to avoid upstream updates breaking CI WORKER_BUILD_VERSION: "0.7.1" WRANGLER_VERSION: "4.54.0" + # Web Vault frontend (bw_web_builds) version tag (default pinned; override via GitHub Actions Variables) + # - Set repository variable BW_WEB_VERSION_DEV (e.g. v2025.12.0) to override + # - Set to "latest" to follow the latest bw_web_builds release + BW_WEB_VERSION: ${{ vars.BW_WEB_VERSION_DEV || 'v2025.12.0' }} # Required for wrangler CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} @@ -51,15 +55,19 @@ jobs: - name: Download and extract frontend (bw_web_builds) run: | - # Get latest version tag from bw_web_builds - LATEST_TAG=$(curl -s https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest | jq -r .tag_name) - echo "📦 Downloading frontend version: $LATEST_TAG" + set -euo pipefail + TAG="${BW_WEB_VERSION}" + if [ "${TAG}" = "latest" ]; then + TAG="$(curl -s https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest | jq -r .tag_name)" + fi + + echo "📦 Downloading frontend version: ${TAG}" # Download the web vault release - wget -q "https://github.com/dani-garcia/bw_web_builds/releases/download/$LATEST_TAG/bw_web_${LATEST_TAG}.tar.gz" + wget -q "https://github.com/dani-garcia/bw_web_builds/releases/download/${TAG}/bw_web_${TAG}.tar.gz" # Extract to public/web-vault - tar -xzf bw_web_${LATEST_TAG}.tar.gz -C public/ + tar -xzf "bw_web_${TAG}.tar.gz" -C public/ # bw_web_builds extracts into a web-vault folder (expected) if [ ! -d "public/web-vault" ]; then @@ -72,7 +80,7 @@ jobs: find public/web-vault -type f -name '*.map' -delete # Cleanup - rm -f bw_web_${LATEST_TAG}.tar.gz + rm -f "bw_web_${TAG}.tar.gz" echo "✅ Frontend files extracted to ./public/web-vault" ls -la public/web-vault/ | head -20 diff --git a/.github/workflows/push-cloudflare.yaml b/.github/workflows/push-cloudflare.yaml index 861fc6e..cdcb1a1 100644 --- a/.github/workflows/push-cloudflare.yaml +++ b/.github/workflows/push-cloudflare.yaml @@ -13,6 +13,10 @@ jobs: # Pin tool versions to avoid upstream updates breaking CI WORKER_BUILD_VERSION: "0.7.1" WRANGLER_VERSION: "4.54.0" + # Web Vault frontend (bw_web_builds) version tag (default pinned; override via GitHub Actions Variables) + # - Set repository variable BW_WEB_VERSION (e.g. v2025.12.0) to override + # - Set to "latest" to follow the latest bw_web_builds release + BW_WEB_VERSION: ${{ vars.BW_WEB_VERSION || 'v2025.12.0' }} # Required for wrangler CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} @@ -61,15 +65,19 @@ jobs: - name: Download and extract frontend (bw_web_builds) run: | - # Get latest version tag from bw_web_builds - LATEST_TAG=$(curl -s https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest | jq -r .tag_name) - echo "📦 Downloading frontend version: $LATEST_TAG" + set -euo pipefail + TAG="${BW_WEB_VERSION}" + if [ "${TAG}" = "latest" ]; then + TAG="$(curl -s https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest | jq -r .tag_name)" + fi + + echo "📦 Downloading frontend version: ${TAG}" # Download the web vault release - wget -q "https://github.com/dani-garcia/bw_web_builds/releases/download/$LATEST_TAG/bw_web_${LATEST_TAG}.tar.gz" + wget -q "https://github.com/dani-garcia/bw_web_builds/releases/download/${TAG}/bw_web_${TAG}.tar.gz" # Extract to public/web-vault - tar -xzf bw_web_${LATEST_TAG}.tar.gz -C public/ + tar -xzf "bw_web_${TAG}.tar.gz" -C public/ # bw_web_builds extracts into a web-vault folder (expected) if [ ! -d "public/web-vault" ]; then @@ -82,7 +90,7 @@ jobs: find public/web-vault -type f -name '*.map' -delete # Cleanup - rm -f bw_web_${LATEST_TAG}.tar.gz + rm -f "bw_web_${TAG}.tar.gz" echo "✅ Frontend files extracted to ./public/web-vault" ls -la public/web-vault/ | head -20 diff --git a/README.md b/README.md index 719ef66..6a5002c 100644 --- a/README.md +++ b/README.md @@ -66,7 +66,7 @@ It's highly recommended to deploy your own instance since the demo can hit the r ## Frontend (Web Vault) -The frontend is bundled with the Worker using [Cloudflare Workers Static Assets](https://developers.cloudflare.com/workers/static-assets/). The GitHub Actions workflow automatically downloads the latest [bw_web_builds](https://github.com/dani-garcia/bw_web_builds) (Vaultwarden web vault) and deploys it together with the backend. +The frontend is bundled with the Worker using [Cloudflare Workers Static Assets](https://developers.cloudflare.com/workers/static-assets/). The GitHub Actions workflows download a **pinned** [bw_web_builds](https://github.com/dani-garcia/bw_web_builds) (Vaultwarden web vault) release (default: `v2025.12.0`) and deploy it together with the backend. You can override it via GitHub Actions Variables (`BW_WEB_VERSION` for prod, `BW_WEB_VERSION_DEV` for dev), or set it to `latest` to follow upstream. **How it works:** - Static files (HTML, CSS, JS) are served directly by Cloudflare's edge network. @@ -216,7 +216,7 @@ wrangler dev --persist **Full stack (with Web Vault):** -1. Download the frontend assets (see [deployment doc](docs/.md#download-the-frontend-web-vault)). +1. Download the frontend assets (see [deployment doc](docs/deployment.md#download-the-frontend-web-vault)). 2. Start locally: ```bash diff --git a/docs/deployment.md b/docs/deployment.md index 45ac0c4..3c53023 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -58,13 +58,16 @@ This page covers the two deployment paths. Pick the one that fits your workflow 5. **Download the frontend (Web Vault):** ```bash - # Get latest version tag - LATEST_TAG=$(curl -s https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest | jq -r .tag_name) + # Default pinned version (override by exporting BW_WEB_VERSION) + BW_WEB_VERSION="${BW_WEB_VERSION:-v2025.12.0}" + if [ "${BW_WEB_VERSION}" = "latest" ]; then + BW_WEB_VERSION="$(curl -s https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest | jq -r .tag_name)" + fi # Download and extract - wget "https://github.com/dani-garcia/bw_web_builds/releases/download/$LATEST_TAG/bw_web_${LATEST_TAG}.tar.gz" - tar -xzf bw_web_${LATEST_TAG}.tar.gz -C public/ - rm bw_web_${LATEST_TAG}.tar.gz + wget "https://github.com/dani-garcia/bw_web_builds/releases/download/${BW_WEB_VERSION}/bw_web_${BW_WEB_VERSION}.tar.gz" + tar -xzf "bw_web_${BW_WEB_VERSION}.tar.gz" -C public/ + rm "bw_web_${BW_WEB_VERSION}.tar.gz" # Remove large source maps to satisfy Cloudflare static asset per-file limits find public/web-vault -type f -name '*.map' -delete @@ -114,6 +117,16 @@ Add the following secrets to your GitHub repository (`Settings > Secrets and var | `CLOUDFLARE_API_TOKEN` | yes | Your Cloudflare API token | | `CLOUDFLARE_ACCOUNT_ID` | yes | Your Cloudflare account ID | | `D1_DATABASE_ID` | yes | Your production D1 database ID | +| `D1_DATABASE_ID_DEV` | no | Dev D1 database ID (required only if you use the `Deploy Dev` workflow on the `dev` branch) | + +### Optional Variables (Web Vault frontend version) + +You can pin/override the bundled Web Vault (bw_web_builds) version via GitHub Actions Variables: + +| Variable | Applies to | Default | Example | Notes | +|----------|------------|---------|---------|-------| +| `BW_WEB_VERSION` | prod (`main/uat/release*`) | `v2025.12.0` | `v2025.12.0` | Set to `latest` to follow upstream latest release | +| `BW_WEB_VERSION_DEV` | dev (`dev`) | `v2025.12.0` | `v2025.12.0` | Set to `latest` to follow upstream latest release | > [!NOTE] The `CLOUDFLARE_API_TOKEN` must have **both** Worker and D1 permissions: > - **Edit Cloudflare Workers** - Required for deploying the Worker