World C3: Release & Deploy

Capstone mission 3: Release it

You will learn: to give Kedai Kancil staging, production, a canary step and a rollback job, then prove it with a bad release.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

Pick an event. Press Run and watch the line.

Tag v1.0.1: the canary fails its smoke test, production is skipped, and rollback runs.

What happened on GitHub

Push tag v1.0.1

Workflow file .github/workflows/release.yml

1name: Release
2on:
3  push:
4    tags: ['v*']
5permissions:
6  contents: read
7jobs:
8  canary:
9    runs-on: ubuntu-latest
10    environment: staging
11    steps:
12      - uses: actions/checkout@v7
13      - run: npm ci
14      - run: npx wrangler deploy --env staging
15        env:
16          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
17      - run: curl --fail --silent "$STAGING_URL/health"
18        env:
19          STAGING_URL: ${{ vars.STAGING_URL }}
20  production:
21    needs: canary
22    runs-on: ubuntu-latest
23    environment:
24      name: production
25      url: ${{ vars.SITE_URL }}
26    steps:
27      - uses: actions/checkout@v7
28      - run: npm ci
29      - run: npx wrangler deploy --env production
30        env:
31          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
32  rollback:
33    needs: canary
34    if: failure()
35    runs-on: ubuntu-latest
36    environment: staging
37    steps:
38      - uses: actions/checkout@v7
39      - run: npm ci
40      - run: npx wrangler rollback --env staging --message "Canary failed"
41        env:
42          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

The line

Push tag v1.0.1 · v1.0.1

Mission 3: Release it. Kedai Kancil already tests and builds itself. Now make releasing safe. Your goal: a bad release, caught and rolled back by the pipeline. Run it to see the goal.

Try it

Step 1: two kitchens. Your shop’s web front end goes on Cloudflare’s free Workers plan. Add this to wrangler.jsonc:

"account_id": "YOUR_ACCOUNT_ID",
"env": { "staging": {}, "production": {} }

Real mission

Make a Cloudflare API token from the "Edit Cloudflare Workers" template. Limit it to your one account.
Make your built site answer /health with ok. A health.html file in the build folder works.
Create the staging environment in your repo.
gh api --method PUT "repos/{owner}/{repo}/environments/staging"
Create production too. Then, in its settings, add yourself as a required reviewer.
gh api --method PUT "repos/{owner}/{repo}/environments/production"
Store the token in staging. It asks you to paste the value.
gh secret set CLOUDFLARE_API_TOKEN --env staging
Store a token in production too.
gh secret set CLOUDFLARE_API_TOKEN --env production
Save your staging address as a repository variable. Do the same for SITE_URL.
gh variable set STAGING_URL --body "https://kedai-kancil-staging.YOUR-SUBDOMAIN.workers.dev"

0 of 7 steps done · Your ticks are saved.

Try it

Step 2: build release.yml. Canary first. Production after it, with your approval. Rollback only if the canary fails.

Tap blocks to add them. Put them in order.

Blocks

Your workflow

Tap a block above to start.

Workflow file .github/workflows/

name: Release

What runs

Nothing to run yet.

Try it

Step 3: ship one good release, then one bad one on purpose.

Real mission

Commit the workflow and push it.
git add .github/workflows/release.yml && git commit -m "ci: add release workflow" && git push
Ship a good release: make the tag v1.0.0 and push it.
git tag v1.0.0 && git push origin v1.0.0
The canary passes. Production waits. Open the run and approve it.
Break it on purpose: delete the health page, then commit and push.
Tag the bad release and push the tag.
git tag v1.0.1 && git push origin v1.0.1
Watch the run: canary red, production skipped, rollback green.
Put the health page back, then ship v1.0.2 the same way.

0 of 7 steps done · Your ticks are saved.

Check

Let GitHub’s public API confirm it. Type your username, then check.

Check it on GitHub

Your Kedai Kancil repo is publicNot checked yet
Workflows ran at least 3 timesNot checked yet
It has at least 2 release tagsNot checked yet

Check

The API can’t see inside a run. Check these yourself.

Real mission

The v1.0.1 run shows: canary failed, production skipped, rollback passed.
Your staging /health page says ok again.
Production never got v1.0.1.
Production waited for your approval on v1.0.0.

0 of 4 steps done · Your ticks are saved.

You did it!

You can now release Kedai Kancil safely, with an undo button.

Go deeper (optional)

Safety: the free Workers plan is enough here. Containers for the API need Workers Paid. Set a budget alert first. Use test tokens and delete them when done. This canary is a staging copy. A true canary sends a share of real users. On Cloudflare, that is a gradual deployment.