Release Process — Internal

littlebig-core Workers

Prerequisites

• wrangler CLI authenticated (bunx wrangler whoami)
• D1 database IDs set in both wrangler.toml files
• Secrets set via wrangler secret put (ADMIN_TOKEN, ANTHROPIC_API_KEY, X402_WALLET_ADDRESS)

Deploy license-server

Typecheck and test first, and deploy only if both pass (do not chain them with a pipe, which hides the exit code):

cd ~/Development/littlebig-core/packages/license-server
export CLOUDFLARE_ACCOUNT_ID=24c012a99395420605c00d2a39896dd0
bunx tsc --noEmit && bun test && bunx wrangler deploy

The Paddle webhook tests start a local Worker and create their own local Secrets Store entries; CLOUDFLARE_ACCOUNT_ID must be set.

Deploy the other Workers

Worker	Directory	Command
Product Admin (products.andredaus.com)	~/Development/littlebig-products-admin	bunx wrangler deploy
Auth server	~/Development/littlebig-auth/packages/auth-server	bunx wrangler deploy
CMS (cms.littlebig.co)	~/Development/littlebig-cms	bun run build && bunx wrangler deploy
Website	~/Development/littlebig-co	pushing to main deploys it (Workers Builds)

All of them need CLOUDFLARE_ACCOUNT_ID=24c012a99395420605c00d2a39896dd0.

Deploy wp-luminary-proxy

cd ~/Development/littlebig-core/packages/wp-luminary-proxy
bunx wrangler deploy

Run D1 migrations (license database)

There is no migration-tracking table: files are applied by hand, in numeric order, with --remote. Check the next free number first (ls schema/migrations) and never reuse one. Migrations 0018 and later are purely additive (new columns with defaults, new tables), so they are safe to apply before deploying the code that uses them.

cd ~/Development/littlebig-core/packages/license-server
bunx wrangler d1 execute littlebig-licenses --remote --file ../../schema/migrations/00NN_name.sql

The original two for a fresh database:

Run from within the worker package that owns the binding:

cd ~/Development/littlebig-core/packages/license-server
bunx wrangler d1 execute littlebig-licenses --file=../../schema/migrations/0001_initial.sql
bunx wrangler d1 execute littlebig-licenses --file=../../schema/migrations/0002_threat_intel.sql

Check deployment

curl https://license.littlebig.co/health
curl https://littlebig-wp-luminary-proxy.andredaus.workers.dev/health

---

Docs site (littlebig-docs)

CI/CD (automatic on push to main)

GitLab CI runs:

1. bun install
2. bun run build
3. bunx wrangler pages deploy dist --project-name littlebig-docs

Required GitLab CI/CD variables (group-level):

• CLOUDFLARE_API_TOKEN — CF API token with Pages:Edit permission
• CLOUDFLARE_ACCOUNT_ID — 24c012a99395420605c00d2a39896dd0

Manual deploy

cd ~/Development/littlebig-docs
bun install
bun run build
CLOUDFLARE_ACCOUNT_ID=24c012a99395420605c00d2a39896dd0 bunx wrangler pages deploy dist --project-name littlebig-docs

---

Cloudflare Access setup for /internal/*

One-time setup in the CF Zero Trust dashboard. Does not require any code changes.

1. Log in at one.dash.cloudflare.com → Zero Trust → Access → Applications.
2. Click Add an Application → Self-hosted.
3. Application name: LittleBig Docs Internal
4. Application domain: docs.littlebig.co — Path: /internal
   (CF Access matches /internal as a path prefix — covers /internal/*)
5. Session duration: 24h
6. Identity providers: Email OTP (or any IdP you’ve configured)
7. Policy: Allow — Email → andre@littlebig.co
8. Save.

After setup, docs.littlebig.co/internal/* requires an authenticated Cloudflare Access session. Public routes are unaffected.

---

WordPress plugin releases

Each plugin uses GitLab CI to build and push ZIPs to Cloudflare R2. The license-server /v1/update/:slug endpoint serves signed R2 URLs for Plugin Update Checker (PUC) compatibility.

Register a new plugin version

# After CI has pushed the ZIP to R2:
curl -X POST https://littlebig-license-server.andredaus.workers.dev/v1/admin/versions \
  -H "Authorization: Bearer {ADMIN_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "product_id": "prod-wpl-01",
    "version": "1.3.0",
    "zip_key": "wp-luminary/wp-luminary-1.3.0.zip",
    "changelog": "Silver tier and threat telemetry.",
    "min_wp": "6.4",
    "min_php": "8.2",
    "tested_wp": "6.7",
    "released_at": "2026-06-30T00:00:00Z"
  }'