feat: add manual production deployment pipeline

scripts/deploy-production.mjs

@@ -0,0 +1,40 @@
+import { spawn } from 'node:child_process';
+import { mkdtemp, writeFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { productionSettings } from './production-settings.mjs';
+
+function execute(args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn('npx', ['--no-install', 'wrangler', ...args], { stdio: 'inherit' });
+    child.once('error', () => reject(new Error('Production Worker command could not start')));
+    child.once('exit', (code) => code === 0 ? resolve() : reject(new Error('Production Worker deployment failed')));
+  });
+}
+
+let secretDirectory;
+try {
+  const options = process.argv.slice(2);
+  if (options.some((option) => !['--dry-run', '--validate-only'].includes(option))) throw new Error('Unknown production deployment option');
+  const settings = productionSettings(process.env);
+  console.log(JSON.stringify({ worker: settings.worker, bucket: settings.bucket, origin: settings.origin, assets: settings.vars.QA_ASSET_PREFIX }));
+  if (!options.includes('--validate-only')) {
+    const args = ['deploy', '--config', settings.config, '--name', settings.worker];
+    for (const [name, value] of Object.entries(settings.vars)) args.push('--var', name + ':' + value);
+    if (options.includes('--dry-run')) {
+      args.push('--dry-run');
+    } else {
+      // Deploy code and secrets together; keep secret values out of arguments and logs.
+      secretDirectory = await mkdtemp(join(tmpdir(), 'qa-production-secrets-'));
+      const secretPath = join(secretDirectory, 'secrets.json');
+      await writeFile(secretPath, JSON.stringify(settings.secrets), { mode: 0o600 });
+      args.push('--secrets-file', secretPath);
+    }
+    await execute(args);
+  }
+} catch (error) {
+  console.error(error.message);
+  process.exitCode = 1;
+} finally {
+  if (secretDirectory) await rm(secretDirectory, { recursive: true, force: true });
+}