ci: deploy to Cloudflare on merges to main

.buildkite/dist.yaml

@@ -0,0 +1,17 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/agent-stack-k8s/main/cmd/linter/schema.json
+
+agents:
+  queue: kubernetes
+
+steps:
+  - command: |
+      set -euo pipefail
+
+      nix run --print-build-logs --no-update-lock-file .#deploy-to-cloudflare -- wrangler.toml
+    label: ":kubernetes: :nixos: :cloudflare: Deploy alpha.primer.dev"
+    concurrency: 1
+    concurrency_group: primer-dist/deploy
+    concurrency_method: ordered
+    plugins:
+      - kubernetes:
+          podTemplate: nix-ci-template

flake.nix

@@ -190,6 +190,7 @@
 
           packages = {
             inherit (pkgs)
+              deploy-to-cloudflare
               primer-benchmark
               primer-miso-build-frontend
               primer-miso-dist
@@ -255,7 +256,7 @@
               };
             in
             (pkgs.lib.mapAttrs (name: pkg: mkApp pkg name) {
-              inherit (pkgs) primer-benchmark primer-miso-build-frontend;
+              inherit (pkgs) deploy-to-cloudflare primer-benchmark primer-miso-build-frontend;
             })
             // primerFlake.apps;
 
@@ -520,6 +521,8 @@
                     primer-miso-wasm = primerFlake.packages."wasm32-unknown-wasi:primer-miso:exe:primer-miso";
                   };
 
+                  deploy-to-cloudflare = final.callPackage ./nix/pkgs/deploy-to-cloudflare { };
+
                   # Note: these benchmarks should only be run (in CI) on a
                   # "benchmark" machine. This is enforced for our CI system
                   # via Nix's `requiredSystemFeatures`.
@@ -559,6 +562,7 @@
                   primer-benchmark = primerFlake.packages."primer-benchmark:bench:primer-benchmark";
 
                   inherit
+                    deploy-to-cloudflare
                     primer-miso-build-frontend
                     primer-miso-dist
                     primer-miso-frontend-tools

nix/pkgs/deploy-to-cloudflare/default.nix

@@ -0,0 +1,31 @@
+{ nix
+, wrangler
+, writeShellApplication
+,
+}:
+
+writeShellApplication {
+  name = "deploy-to-cloudflare";
+
+  runtimeInputs = [
+    nix
+    wrangler
+  ];
+
+  text = ''
+    if [ "$#" -ne 1 ]; then
+      echo "Usage: deploy-to-cloudflare <wrangler-config>" >&2
+      exit 2
+    fi
+
+    wrangler_config="$1"
+
+    if [ ! -f "$wrangler_config" ]; then
+      echo "Wrangler config not found: $wrangler_config" >&2
+      exit 1
+    fi
+
+    dist_path="$(nix build --print-build-logs --no-update-lock-file --no-link --print-out-paths .#primer-miso-dist)"
+    wrangler deploy --config "$wrangler_config" --assets "$dist_path" --keep-vars
+  '';
+}

wrangler.toml

@@ -0,0 +1,4 @@
+name = "alpha-primer-dev"
+account_id = "6739145754f7a86d724aa208fdc42422"
+compatibility_date = "2026-04-27"
+workers_dev = false