security(deploy-pages): enforce explicit caller contract

[seonghobae]

Root cause

The reusable Cloudflare Pages workflow predated the current least-privilege boundary: it declared no named secret interface, instructed callers to use secrets: inherit, and interpolated caller-controlled project, path, and domain strings into Wrangler, Cloudflare URLs, and the shell summary before validation.

The historical #901 implementation was source-valid but DIRTY, duplicated an unrelated CHANGELOG entry, omitted the root README from its contract test, and accepted uppercase or 59-character project names that Cloudflare Pages rejects.

Change

• require exactly CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID at workflow_call
• replace every central deploy-pages example with explicit two-name mappings
• fail closed on project, build-directory, symlink, and domain inputs before command, URL, or summary use
• enforce the observed Cloudflare Pages project-name boundary: 1-58 lowercase alphanumeric/hyphen characters, no leading/trailing hyphen
• keep checkout pinned, contents: read, caller-repository checkout, and Cloudflare deployment semantics
• document migration, rollback, current live consumer search, and APA 7th references

Consumer evidence

A live gh search code deploy-pages.yml@ --owner ContextualWisdomLab on 2026-08-24 returned only this central workflow plus the central root and infrastructure README examples. No product caller migration is currently required.

Verification

• TDD RED: adding root README to the contract reproduced its remaining secrets: inherit example
• TDD RED: production validation accepted both Uppercase and 59-character project names
• focused production-validator contracts: 32 passed
• uv run --with pip coverage run -m pytest -q: 1,425 passed, 1 skipped, 16 subtests
• coverage: 8,346 statements and 3,214 branches at 100%
• interrogate: 100%
• compileall, actionlint with ShellCheck 0.11.0, git diff check, and healthy synchronized CodeGraph

The explicit --with pip isolates the current-main fresh-uv bootstrap gap tracked separately by #1265.

Supersedes #901.
Closes #900.

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f380d53e-8655-48b4-b767-049c32a63009

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/pr901-current-main-replacement-20260824

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 new potential issue.