From 831d4406619ebb8c9db702e8a639177c466f09c2 Mon Sep 17 00:00:00 2001
From: hoelee <me@hoelee.com>
Date: Fri, 16 Oct 2026 17:15:33 +0800
Subject: [PATCH] ci(deploy): purge the Cloudflare edge after each deploy

Prepares the HTML edge-cache step from the external review: as soon as a Cache
Rule for HTML exists at the edge, deploys must purge or a new post can keep
serving stale HTML for the whole Edge TTL. Skips silently while CF_TOKEN /
CF_ZONE_ID are unset (both are now set as repo secrets, neither is in the repo).
---
 .gitea/workflows/deploy.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 7b559ca..7296ad6 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -26,3 +26,23 @@ jobs:
           cp -r dist/* /mnt/user/docker/nginx-hoelee-blog/html/
           echo "Deployed. Contents:"
           ls -la /mnt/user/docker/nginx-hoelee-blog/html/
+
+      # Purge the Cloudflare edge after deploy. Required as soon as an HTML cache
+      # rule exists at the edge (Caching -> Cache Rules): without a purge, a new or
+      # edited post can keep serving the old HTML until the Edge TTL expires.
+      # Skipped silently while the secrets are unset so the deploy never breaks.
+      - name: Purge Cloudflare cache
+        run: |
+          if [ -z "${CF_TOKEN}" ] || [ -z "${CF_ZONE_ID}" ]; then
+            echo "CF_TOKEN / CF_ZONE_ID not set — skipping purge (add both as repo secrets)"
+            exit 0
+          fi
+          echo "Purging zone ${CF_ZONE_ID} ..."
+          curl -sS -X POST "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/purge_cache" \
+            -H "Authorization: Bearer ${CF_TOKEN}" \
+            -H "Content-Type: application/json" \
+            --data '{"purge_everything":true}' | head -c 400
+          echo
+        env:
+          CF_TOKEN: ${{ secrets.CF_TOKEN }}
+          CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}