From 26e487247455c09e3802d03a4d1ef1f856c22481 Mon Sep 17 00:00:00 2001
From: syn <syn@neonronin.sh>
Date: Fri, 17 Jul 2026 14:44:21 -0500
Subject: [PATCH] chore: move Worker deployment to corporate Cloudflare

---
 .github/workflows/test.yml       | 28 ++++++++++++++++++++++++++++
 .github/workflows/trufflehog.yml | 24 ++++++++++++++++++++++++
 .gitignore                       |  6 +++++-
 wrangler.jsonc                   | 16 +++++++++++++---
 4 files changed, 70 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/trufflehog.yml

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1592dfd..0f12e64 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -24,3 +27,28 @@ jobs:
 
       - name: Run tests
         run: npm test
+
+  deploy:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: test
+    runs-on: ubuntu-latest
+    concurrency:
+      group: deploy-production
+      cancel-in-progress: false
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Deploy Worker
+        run: npm run deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml
new file mode 100644
index 0000000..62fd14a
--- /dev/null
+++ b/.github/workflows/trufflehog.yml
@@ -0,0 +1,24 @@
+name: Secret Scanning
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  trufflehog:
+    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: Secret Scanning
+        uses: trufflesecurity/trufflehog@7f4e37db2d928c18ddd7ddf0604f8f7d1f5793ec # v3.93.0
+        with:
+          extra_args: --results=verified,unknown
diff --git a/.gitignore b/.gitignore
index e0ed1f9..e3ef5a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -31,4 +31,8 @@ lerna-debug.log*
 
 # misc
 .DS_Store
-.kilo
\ No newline at end of file
+.kilo
+*.sqlite
+*.sqlite3
+*.db
+*.swp
diff --git a/wrangler.jsonc b/wrangler.jsonc
index 1725404..3afe30b 100644
--- a/wrangler.jsonc
+++ b/wrangler.jsonc
@@ -1,16 +1,23 @@
 {
 	"$schema": "node_modules/wrangler/config-schema.json",
 	"name": "pinchbench-api",
+	"account_id": "e115e769bcdd4c3d66af59d3332cb394",
 	"main": "src/index.ts",
 	"compatibility_date": "2026-02-12",
 	"d1_databases": [
 		{
 			"binding": "prod_pinchbench",
 			"database_name": "prod-pinchbench",
-			"database_id": "85219a08-0016-4255-bd3f-c347705f97a0",
+			"database_id": "e6c249ec-b2ae-4230-a1d7-17016431cabd",
 			"remote": true
 		}
 	],
+	"routes": [
+		{
+			"pattern": "api.pinchbench.com",
+			"custom_domain": true
+		}
+	],
 	"triggers": {
 		"crons": [
 			"0 3 * * *"
@@ -26,7 +33,10 @@
 	// Set CF_ACCESS_TEAM_DOMAIN and CF_ACCESS_AUD in Cloudflare Dashboard (Settings → Variables)
 	// For local development only: set CF_ACCESS_BYPASS=true via `wrangler dev --var CF_ACCESS_BYPASS:true`
 	"vars": {
-		"CF_ACCESS_BYPASS": "false"
+		"CF_ACCESS_BYPASS": "false",
+		"CF_ACCESS_TEAM_DOMAIN": "engineering-e11.cloudflareaccess.com",
+		"CF_ACCESS_AUD": "b71bf455da18651ded735997d7fc391bd234a7eb7a637c884aecc1ac535baa0e",
+		"GITHUB_CLIENT_ID": "Ov23litsCSqJuxLAb956"
 	}
 	// "compatibility_flags": [
 	//   "nodejs_compat"
@@ -60,4 +70,4 @@
 	//   "enabled": true,
 	//   "head_sampling_rate": 1
 	// }
-}
\ No newline at end of file
+}