Release Process — Internal

littlebig-core Workers

Prerequisites

• wrangler CLI authenticated (bunx wrangler whoami)
• D1 database IDs set in both wrangler.toml files
• Secrets set via wrangler secret put (ADMIN_TOKEN, ANTHROPIC_API_KEY, X402_WALLET_ADDRESS)

Deploy license-server

cd ~/Development/littlebig-core/packages/license-server
bunx wrangler deploy

Deploy wp-luminary-proxy

cd ~/Development/littlebig-core/packages/wp-luminary-proxy
bunx wrangler deploy

Run D1 migrations

Run from within the worker package that owns the binding:

cd ~/Development/littlebig-core/packages/license-server
bunx wrangler d1 execute littlebig-licenses --file=../../schema/migrations/0001_initial.sql
bunx wrangler d1 execute littlebig-licenses --file=../../schema/migrations/0002_threat_intel.sql

Check deployment

curl https://littlebig-license-server.andredaus.workers.dev/health
curl https://littlebig-wp-luminary-proxy.andredaus.workers.dev/health

---

Docs site (littlebig-docs)

CI/CD (automatic on push to main)

GitLab CI runs:

1. bun install
2. bun run build
3. bunx wrangler pages deploy dist --project-name littlebig-docs

Required GitLab CI/CD variables (group-level):

• CLOUDFLARE_API_TOKEN — CF API token with Pages:Edit permission
• CLOUDFLARE_ACCOUNT_ID — 24c012a99395420605c00d2a39896dd0

Manual deploy

cd ~/Development/littlebig-docs
bun install
bun run build
CLOUDFLARE_ACCOUNT_ID=24c012a99395420605c00d2a39896dd0 bunx wrangler pages deploy dist --project-name littlebig-docs

---

Cloudflare Access setup for /internal/*

One-time setup in the CF Zero Trust dashboard. Does not require any code changes.

1. Log in at one.dash.cloudflare.com → Zero Trust → Access → Applications.
2. Click Add an Application → Self-hosted.
3. Application name: LittleBig Docs Internal
4. Application domain: docs.littlebig.co — Path: /internal
   (CF Access matches /internal as a path prefix — covers /internal/*)
5. Session duration: 24h
6. Identity providers: Email OTP (or any IdP you’ve configured)
7. Policy: Allow — Email → andre@littlebig.co
8. Save.

After setup, docs.littlebig.co/internal/* requires an authenticated Cloudflare Access session. Public routes are unaffected.

---

WordPress plugin releases

Each plugin uses GitLab CI to build and push ZIPs to Cloudflare R2. The license-server /v1/update/:slug endpoint serves signed R2 URLs for Plugin Update Checker (PUC) compatibility.

Register a new plugin version

# After CI has pushed the ZIP to R2:
curl -X POST https://littlebig-license-server.andredaus.workers.dev/v1/admin/versions \
  -H "Authorization: Bearer {ADMIN_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "product_id": "prod-wpl-01",
    "version": "1.3.0",
    "zip_key": "wp-luminary/wp-luminary-1.3.0.zip",
    "changelog": "Silver tier and threat telemetry.",
    "min_wp": "6.4",
    "min_php": "8.2",
    "tested_wp": "6.7",
    "released_at": "2026-06-30T00:00:00Z"
  }'