Repository navigation
github-backup(deploy): the version advertised for rollback is the pre-secrets version, and --deploy-version never provisions secrets #3475
Description
Finding (from PR review)
Codex P2 on PR #3280 (chatgpt-codex-connector[bot], 2026-11-01T01:33:18Z): "Include secrets in the version advertised for rollback" — #3280 (comment)
On a fresh Worker, the tagged version is uploaded before either required secret exists. This subsequent call changes the deployed version: Cloudflare documents that
wrangler secret put"creates a new version of the Worker and deploys it immediately." Consequently, the version ID printed as live below is not the final secret-bearing version. The--deploy-versionpath deploys that advertised ID without provisioning secrets, so it does not restore the working configuration: the tagged bootstrap version lacks the bearer token required by/queueand the HMAC secret required by/github. Include the secrets before selecting the tagged deployment version, or retain and advertise the final configured version for rollback.
(Secret names only — no values are involved in this issue: the Worker secrets are DRAIN_BEARER and GITHUB_WEBHOOK_SECRET, provisioned from Bitwarden by name in setWorkerSecrets().)
No-response evidence
- PR github-backup: rename to developing-today-backup + just/nix deploy standard #3280 merged with the finding unaddressed: the inline comment has no replies, and GraphQL
reviewThreadsfor PR github-backup: rename to developing-today-backup + just/nix deploy standard #3280 shows all 3 threadsisResolved=false. - No fix commit after the comment: the ordering is still present on current main (below).
Still-live evidence (verified this run, current main)
infra/github-backup/worker/deploy.mjs (current main), normal deploy flow:
versions upload→ taggedversion.idcreateDeployment(version.id)(when not already live)setWorkerSecrets()— eachwrangler secret putcreates and deploys a NEW version, per Cloudflare's documentationreportLive()+console.log("live: ... at version ${version.id}")— advertising the pre-secrets version id as the live/rollback target
And the --deploy-version branch (createDeployment(deployVersion); reportLive(); process.exit(0)) never calls setWorkerSecrets() at all, so rolling back to the advertised bootstrap version restores a Worker with no DRAIN_BEARER / GITHUB_WEBHOOK_SECRET: /queue auth and /github HMAC verification both fail.
Dedupe
Searched open and closed issues for "github-backup rollback version secrets" (2026-11-01): no issue covers this.
Acceptance criteria
- The version advertised as live/for rollback is the final secret-bearing version (secrets provisioned before the tagged deployment version is selected, or the final configured version is retained and advertised).
- The
--deploy-versionrollback path provisions (or verifies) the required Worker secrets as part of restoring the working configuration. - Or the finding is resolved by a documented decision on this issue.
Activity
developing-today commentedon Nov 1, 2026
CODE-1331
dezren39 commentedon Nov 1, 2026
🤖 Agent note · filed
dezren39 commentedon Nov 1, 2026
🤖 Agent note · picked up
15 remaining items
dezren39 commentedon Nov 1, 2026
🤖 Agent note · picked up
github-backup(deploy): verify rollback target configuration before de…
Merge pull request #3510 from developing-today/queue/5425-3475-rollba…
dezren39 commentedon Nov 1, 2026
🤖 Agent note · done
f5f612871), this issue closed by the merge.--deploy-versionverifies the target's secret bindings first (wrangler versions view) and refuses unconfigured targets before any traffic switch, naming the roll-forward remedy.secret puthard-errorsVERSION_NOT_DEPLOYEDin the rollback state;versions secret putpatches the latest version only) — the verify-first design is the fix. Re-review completed with no unresolved findings.