fix(ci): create the Cloudflare Pages project on the first deploy

.github/workflows/job-deploy-release.yaml

@@ -5,12 +5,12 @@ name: Deploy
 # push, no pull_request, no workflow_dispatch. Publishing the release is the
 # one and only "go live" action for this site.
 #
-# The Cloudflare Pages project (cryptos-pki-www) and its custom domains
-# (cryptos-pki.com, www.cryptos-pki.com) are created by hand in the
-# Cloudflare dashboard, not by this workflow -- see README.md. The org
-# secrets CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID must hold real
-# values before the first release is published; this workflow never prints
-# either one.
+# The workflow creates the Cloudflare Pages project (cryptos-pki-www) the
+# first time, when it doesn't exist yet. Its custom domains (cryptos-pki.com,
+# www.cryptos-pki.com) are still attached once by hand in the Cloudflare
+# dashboard -- see docs/deploy.md. The org secrets CLOUDFLARE_API_TOKEN and
+# CLOUDFLARE_ACCOUNT_ID must hold real values before the first release is
+# published; this workflow never prints either one.
 on:
   release:
     types: [published]
@@ -49,6 +49,37 @@ jobs:
       - name: Build (prerender)
         run: npm run build
 
+      - name: List the Cloudflare Pages projects
+        id: projects
+        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages project list --json
+
+      # Checked first so every release can run this step safely: the project
+      # is created once, on the first deploy, and left alone after that.
+      - name: Check for the cryptos-pki-www project
+        id: exists
+        env:
+          PROJECTS: ${{ steps.projects.outputs.command-output }}
+        run: |
+          set -euo pipefail
+          # Wrangler may print its banner ahead of the JSON array.
+          if printf '%s\n' "$PROJECTS" | sed -n '/^\[/,$p' | jq -e 'any(.[]; ."Project Name" == "cryptos-pki-www")' >/dev/null; then
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create the cryptos-pki-www project
+        if: steps.exists.outputs.found == 'false'
+        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages project create cryptos-pki-www --production-branch=main
+
       - name: Deploy build/client to Cloudflare Pages
         uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
         with:

README.md

@@ -25,8 +25,9 @@ npm run typecheck   # react-router typegen + tsc --noEmit
 
 The site goes live on Cloudflare Pages (project `cryptos-pki-www`, domains `cryptos-pki.com` and
 `www.cryptos-pki.com`) the moment a GitHub Release is published here -- nothing else deploys it.
-See [`docs/deploy.md`](docs/deploy.md) for what that build contains, the Cloudflare side of the
-setup, and how to roll back.
+The first deploy creates the Pages project if it doesn't exist yet; the custom domains are attached
+once by hand in Cloudflare after that. See [`docs/deploy.md`](docs/deploy.md) for what that build
+contains, the Cloudflare side of the setup, and how to roll back.
 
 ## 🙏 Acknowledgements
 

docs/deploy.md

@@ -15,11 +15,14 @@ tag can't silently move the code I'm trusting with deploy credentials.
 
 ## Where it lives
 
-- **Cloudflare Pages project:** `cryptos-pki-www`.
-- **Domains:** `cryptos-pki.com` and `www.cryptos-pki.com`. I attach both to the Pages project by
-  hand in the Cloudflare dashboard (Custom domains); because the domains' DNS already runs on
-  Cloudflare, attaching a domain creates its DNS record and certificate automatically. This
-  workflow never touches DNS or creates the Pages project itself.
+- **Cloudflare Pages project:** `cryptos-pki-www`. Before it deploys, the workflow lists the
+  account's Pages projects and creates `cryptos-pki-www` (production branch `main`) only when it
+  isn't there yet, so the first published release sets the project up and every later release
+  skips that step.
+- **Domains:** `cryptos-pki.com` and `www.cryptos-pki.com`. I attach both to the Pages project
+  once, by hand, in the Cloudflare dashboard (Custom domains), after the first deploy has created
+  the project. Because the domains' DNS already runs on Cloudflare, attaching a domain creates its
+  DNS record and certificate automatically. The workflow never touches DNS or custom domains.
 - **Credentials:** the org secrets `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID`, scoped to
   Cloudflare Pages Edit on my account only. They live in GitHub org secrets, never in this repo or
   its workflow logs.