From 197d41b8675726c5209e8fde6b43ba777db2ae96 Mon Sep 17 00:00:00 2001
From: Kit Langton <kit.langton@gmail.com>
Date: Thu, 20 Aug 2026 12:56:28 -0400
Subject: [PATCH] chore(catalog): harden deployment workflow

---
 .github/workflows/deploy-catalog.yml |  7 +++++++
 apps/catalog/AGENTS.md               | 19 +++++++++++++++++++
 apps/catalog/wrangler.jsonc          |  1 +
 3 files changed, 27 insertions(+)

diff --git a/.github/workflows/deploy-catalog.yml b/.github/workflows/deploy-catalog.yml
index a9fbcd2..eed5e13 100644
--- a/.github/workflows/deploy-catalog.yml
+++ b/.github/workflows/deploy-catalog.yml
@@ -22,6 +22,10 @@ jobs:
   deploy:
     if: github.repository == 'anomalyco/opencode-drive' && github.ref_name == 'main'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
+    environment:
+      name: catalog-production
+      url: https://dev.opencode.ai/lab/catalog
     steps:
       - uses: actions/checkout@v6
 
@@ -43,3 +47,6 @@ jobs:
         run: bun run deploy
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+
+      - name: Verify deployment
+        run: curl --fail --retry 5 --retry-all-errors --retry-delay 2 --silent --show-error --output /dev/null https://dev.opencode.ai/lab/catalog
diff --git a/apps/catalog/AGENTS.md b/apps/catalog/AGENTS.md
index 64f1b52..b08b1db 100644
--- a/apps/catalog/AGENTS.md
+++ b/apps/catalog/AGENTS.md
@@ -140,6 +140,25 @@ For UI changes, verify in a real browser at desktop and mobile widths:
 
 For protocol changes, also run the OpenCode simulation tests and the full OpenCode Drive test suite.
 
+## Deployment
+
+The catalog deploys to <https://dev.opencode.ai/lab/catalog> through `.github/workflows/deploy-catalog.yml`. The workflow runs automatically for relevant changes merged to `main` and can be triggered manually from GitHub Actions or with:
+
+```bash
+gh workflow run deploy-catalog.yml --ref main -R anomalyco/opencode-drive
+```
+
+The workflow validates Drive and the catalog before deploying. It requires the repository Actions secret `CLOUDFLARE_API_TOKEN`, scoped to edit Workers and routes in the Anomaly Cloudflare account. `wrangler.jsonc` pins that account; do not remove or replace the account ID with a secret.
+
+After triggering a deployment, wait for the workflow and verify the live route:
+
+```bash
+gh run watch --exit-status -R anomalyco/opencode-drive
+curl --fail --silent --show-error --output /dev/null https://dev.opencode.ai/lab/catalog
+```
+
+Do not deploy from a feature branch. For an exceptional local deployment, run `bun run deploy` from `apps/catalog` only after `bun run check`, and confirm `bunx wrangler whoami` has access to the Anomaly account.
+
 ## Dependencies
 
 The catalog consumes OpenCode Drive as a Bun workspace dependency (`"opencode-drive": "workspace:*"`) and imports only its published entry points (`opencode-drive`, `opencode-drive/driver`, `opencode-drive/client` for protocol schemas, and the browser-safe `opencode-drive/frame` for renderer geometry). Never import package-internal `src/` paths.
diff --git a/apps/catalog/wrangler.jsonc b/apps/catalog/wrangler.jsonc
index 28a235c..25be42a 100644
--- a/apps/catalog/wrangler.jsonc
+++ b/apps/catalog/wrangler.jsonc
@@ -1,6 +1,7 @@
 {
   "$schema": "node_modules/wrangler/config-schema.json",
   "name": "opencode-lab-catalog",
+  "account_id": "15d29c8639fd3733b1b5486a2acfd968",
   "main": "worker.ts",
   "compatibility_date": "2026-08-12",
   "workers_dev": false,