Cloud & DevOps Workflows

Make a Cloudflare Workers app resilient to bot scans that arrive within minutes of HTTPS publication via CT Log enumeration. Use when deploying a new Worker (especially with auth or paid bindings), when budget/cost is a concern, or when you want to detect "/.env" / "/admin" / "/wp-login.php" / "/.git/config" probing. Covers the mental model (CT Log → bot scan → which paths actually cost you money), the edge-cache absorption that makes most scans free, the narrow set of unauthenticated routes that do need rate limiting (auth begin/verify), the exact wrangler.jsonc observability + ratelimits config (plus the wrangler 3.x unsafe.bindings fallback for projects still on v3), the IP-keyed Hono middleware pattern (with the fail-open variant), the verification flow via wrangler versions view + Workers Observability — including the trap that v3's versions view renders neither the unsafe ratelimit binding nor observability, and a credential-free verification path for sandboxed agents / keyless CI — and the documented eventual-consistency caveat that makes synthetic burst tests look like the limiter is broken.

Deploy Cloudflare Workers from GitHub with ZERO Cloudflare credentials stored in GitHub (no CLOUDFLAREAPITOKEN in Actions secrets), using Workers Builds — Cloudflare's git-connected CI/CD. Use when setting up or migrating a Workers project so that an autonomous agent pipeline never holds a Cloudflare secret, or when asked "can we deploy without a CF API token in CI". Covers the traps that cost hours — the default build token lacking D1 Edit (with silent migration failure), Root directory hiding in the Advanced settings accordion, preview builds sharing the PRODUCTION D1 database, and Workers Builds NOT waiting for GitHub CI (gate with a branch ruleset instead).