Skip to content
NutsNews chestnut logoNutsNews Wiki

Simple guide · Core platform

Page status: Active

Cloudflare Production Cache Purge

NutsNews now has a dedicated GitHub Action that purges the full Cloudflare cache after a successful production deployment.

Visual overview

Primary diagram

System map

NutsNews now has a dedicated GitHub Action that purges the full Cloudflare cache after a successful production deployment.

Render the repository-owned system map when you need it.

Diagram is not rendered yet.

View as text
Cloudflare Production Cache Purge

NutsNews now has a dedicated GitHub Action that purges the full Cloudflare cache after a successful production deployment.

flowchart TD
  accTitle: Cloudflare Production Cache Purge
  accDescr {
    NutsNews now has a dedicated GitHub Action that purges the full Cloudflare cache after a successful production deployment.
  }
  D[GitHub deployment_status event] --> P{env is Production / production?}
  P -->|no| N[No action]
  P -->|yes| W[cloudflare-production-cache-purge workflow]
  W --> F[Read CLOUDFLARE_API_TOKEN & CLOUDFLARE_ZONE_ID]
  W --> R{CLOUDFLARE_PURGE_DRY_RUN is true?}
  F --> R
  R -->|true| V[Validate secrets + zone format only]
  R -->|false| C[POST Cloudflare /purge_cache]
  C --> A["Purge everything request body"]
  C --> T[Run with no token logging]
  V --> H[No API call made]
  T --> H
  W --> L[Regression workflow can verify lock and guard behavior]

Cloudflare Production Cache Purge

Fullscreen diagram view.

Cloudflare Production Cache Purge

Section titled “Cloudflare Production Cache Purge”

NutsNews now has a dedicated GitHub Action that purges the full Cloudflare cache after a successful production deployment.

This is intentionally separate from preview smoke tests and cache observability checks. Preview deployments should never purge the production Cloudflare zone.

Workflow

Section titled “Workflow”
.github/workflows/cloudflare-production-cache-purge.yml

The workflow runs in two cases:

  1. Automatically on a successful GitHub deployment_status event where the deployment environment is Production or production.
  2. Manually from GitHub Actions with workflow_dispatch.

The action waits for the deployment success signal instead of running directly on push to main. That prevents Cloudflare from being purged before Vercel has finished deploying production.

What it purges

Section titled “What it purges”

The action calls the Cloudflare purge-cache API with:

{"purge_everything":true}

That clears the whole Cloudflare zone cache for NutsNews.

Required GitHub Actions secrets

Section titled “Required GitHub Actions secrets”

Add these repository secrets in GitHub under Settings → Secrets and variables → Actions:

CLOUDFLARE_API_TOKEN
CLOUDFLARE_ZONE_ID

Recommended Cloudflare API token permissions:

Zone → Cache Purge → Purge

Scope the token only to the NutsNews Cloudflare zone.

Do not use the global Cloudflare API key.

Manual dry run

Section titled “Manual dry run”

You can validate the workflow configuration without calling Cloudflare by running the workflow manually and enabling dry_run.

A dry run checks that the required secrets exist and that the zone id looks valid, then exits without sending the purge request.

Regression protection

Section titled “Regression protection”

These files are covered by a dedicated regression workflow:

.github/workflows/cloudflare-production-cache-purge-regression.yml
scripts/cloudflare_production_cache_purge_regression.mjs

The regression verifies that:

  • The purge workflow waits for a successful production deployment_status event.
  • The purge workflow can also be run manually.
  • The workflow does not run directly on pull requests or pushes.
  • The Cloudflare API token and zone id come from GitHub Secrets.
  • The purge request uses purge_everything.
  • The purge script does not log the Cloudflare token.
  • The purge automation files are locked by the immutable test guard.

The locked files can only be changed later if the PR title or body includes Rami’s explicit approval phrase:

IMMUTABLE TEST CHANGE APPROVED BY RAMI

Test locally

Section titled “Test locally”

From the repository root:

Terminal window
node scripts/cloudflare_production_cache_purge_regression.mjs

Dry-run the purge script locally without calling Cloudflare:

Terminal window
CLOUDFLARE_API_TOKEN=example-token \
CLOUDFLARE_ZONE_ID=00000000000000000000000000000000 \
CLOUDFLARE_PURGE_DRY_RUN=true \
node scripts/cloudflare_purge_cache.mjs

Production verification

Section titled “Production verification”

After the PR is merged and Vercel production deploy succeeds:

  1. Open the Purge Cloudflare Cache After Production Deploy workflow run.
  2. Confirm the job completed successfully after the production deployment.
  3. Open https://www.nutsnews.com and confirm the latest production changes are visible.
  4. Optionally run the existing cache observability workflow to confirm public routes are still cacheable.