v1.4.1

Fixed

• cloudflare-version.yml previews of Workers that implement a Durable Object (Containers included) no longer fail on the missing preview URL — Cloudflare never generates one for them. The metadata step falls back to the target URL and sets a new preview-note output ("no preview URL … version is uploaded at 0% traffic"), which cloudflare-pr.yml surfaces in the sticky PR comment and the step summary. Deploys are unchanged, and a missing Version ID still fails the step.

Changed

• advance internal pins to the v1.4.1 implementation

Validation

• pnpm install --frozen-lockfile
• pnpm run lint, 82 Node tests (including a new regression test for the preview-URL fallback), actionlint with shellcheck

v1.4.0

Added

• releasePrefix in npm policies: namespaces the npm flow's release tags (types-v1.2.3) so a repository with more than one release flow keeps independent histories; threaded through version derivation, the conventional commit range, and a tag-namespace guard in npm-release.yml
• d1Migrations in deployment policies: D1 migrations apply inside cloudflare-version.yml immediately before each deploy — deploy only, never preview, per-target --env, from the deployment working directory's wrangler configuration

Changed

• npm publishes request --provenance only when the source repository is public; the registry refuses provenance from private repositories (E422), which failed every private-repository publish
• npm-publish.yml runs its package-scoped steps (version write, name read, publish) in the npm policy's workingDirectory, matching npm-pr.yml and npm-main.yml — npm publish from a workspace root packed the root package
• npm-main.yml strips the configured release prefix when deriving publishable versions
• advance internal pins to the v1.4.0 implementation, which also makes the v1.3.4 conventional-bump metadata script reachable for the first time

Validation

• pnpm install --frozen-lockfile
• pnpm run lint, 79 Node tests, actionlint
• scripts/policy.bundle.mjs regenerated via pnpm build

v1.3.4

Changed

• right-size TypeScript quality, Cloudflare build/deploy, npm pack, and npm publish jobs on ubicloud-standard-4
• retain ubicloud-standard-2 for orchestration and ubicloud-standard-8 for container builds
• keep required quality checks on Dependabot pull requests while skipping credentialed Cloudflare previews that cannot receive Actions secrets
• advance nested reusable-workflow pins to the immutable v1.3.4 implementation

Validation

• pnpm install --frozen-lockfile
• pnpm run check (Prettier, 63 Node tests, actionlint)

v1.3.3

Changed

• run all direct reusable-workflow jobs on Ubicloud runners
• use ubicloud-standard-2 for lightweight orchestration and ubicloud-standard-8 for consumer builds, tests, publishing, and container work
• pin nested reusable workflows to the immutable Ubicloud implementation commit

Validation

• enforce approved Ubicloud runner labels in workflow tests and actionlint
• verify policy and quality jobs on live Ubicloud capacity

v1.3.2

Fixed

• pin all Cloudflare entry workflows to the immutable single-token Wrangler message fix
• apply the release-deploy correction consistently to pull request, main, and explicit release paths

v1.3.1

Fixed

• keep Wrangler version metadata as a single command token during Cloudflare release deploys
• prevent release URLs from being interpreted as Worker entry-point paths

v1.3.0

What's Changed

• [codex] Add generic Phala deployment workflow and harden npm jobs by @2xburnt in #20
• [codex] Add app-scoped Cloudflare workflows by @2xburnt in #21
• [codex] Harden app-scoped release metadata by @2xburnt in #23
• Pin v1.3.0 release metadata by @2xburnt in #24

Full Changelog: v1.2.8...v1.3.0

v1.2.8

Allow same-repository pull requests to run Cloudflare quality and preview jobs when the consumer repository is itself a GitHub fork. External fork pull requests and drafts remain excluded.

v1.2.7

Publish the stable GitHub release after successful automatic promotion even when an optional preview ancestor was skipped.

v1.2.6

Allow automatic production promotion to proceed after an intentionally skipped preview job.