GitHub deployment
Fork the repository, keep credentials in a protected GitHub Environment, and run the reviewed first-install workflow. It intentionally refuses an existing Worker; automated cloud upgrades are not implemented yet.
Open deployment action ↗Create a Cloudflare API token
Scope it to the account that will own the Worker, D1 database, and R2 bucket. Never commit it or paste it into FREE CRM.
Add protected environment secrets
Create the cloudflare-production environment, require approval if desired, and add the three values below.
# Add secrets to the cloudflare-production environment:
CLOUDFLARE_ACCOUNT_ID
CLOUDFLARE_API_TOKEN
FREE_CRM_OWNER_EMAIL
# Then run: Actions → Deploy FREE CRM → Run workflowRun and verify
The workflow requires all owner credentials, validates the release, proves resource ownership, audits the Access policy, and reports success only after unauthenticated CRM access is denied.