feat: v0.3 core CI (M8) — .gitflare/ci.yml jobs on Cloudflare Sandboxes

[sinameraji]

What

Ships the M8 slice of v0.3 (Generic CI) from PLAN.md §4: a .gitflare/ci.yml workflow format with jobs / needs / run: steps, executed on Cloudflare Sandboxes running on the user's own account. Deploy jobs gate on test jobs and ship what CI just built rather than the stale committed file. Live logs, cancel, run history, and GitHub commit-status postback are all in.

on: push
branches: [main]
jobs:
  test:
    steps:
      - run: npm ci
      - run: npm test
  deploy:
    needs: [test]        # deploys only if tests pass
    steps:
      - cloudflare/deploy: { project: my-worker, kind: worker, entry: dist/worker.js }

How it works

• Format — new src/ci/workflow.ts reuses the existing hand-rolled YAML subset (extended with |/|- block scalars for multi-line run:) and the shared cloudflare/deploy step validator. needs gets parse-time unknown/cycle validation + Kahn topo order; per-job env + timeout_minutes.
• Execution — new CiDO (binding CI, migration v3). POST /run answers 202 and the pipeline runs as detached DO work under an alarm watchdog. One sandbox per run, cloned from the Artifacts mirror with env-scoped git auth (the read token never lands in argv, .git/config, or stderr; every log line is scrubbed). Jobs run in topo order with streamed, line-buffered logs over a hibernatable WebSocket.
• Deploy jobs delegate to DeployDO (mode: "ci", strict at-sha ref-aware clone) so deploy history + rollback stay in one place across both workflow formats. Worker entries built in the sandbox are handed over via entryOverrides (gated on the deploy job's whole needs closure of run jobs succeeding).
• CLI — gitflare ci enable/disable/run/list/cancel. Enable provisions a [[containers]] block using the public docker.io/cloudflare/sandbox image (no local Docker), default instance type standard-1. Migrations v3+v4 are emitted unconditionally so cross-machine redeploys never miss an applied tag; CI_ENABLED gates behavior while the container config stays provisioned across disable.
• Status — results post back via the legacy Commit Status API (gitflare/ci), soft-fail (GitHub being down is the whole point).

Quality

• Adversarial pre-design review (3 lenses) before coding, then a 4-lens code review of the diff (18 findings, all verifier-confirmed). 14 fixed (watchdog/pipeline verdict races, unauthenticated cancel on public mirrors, tag-push noise, failed-build artifact leakage, dead SANDBOX fallback, skipped-deploy-reads-green, shell-metachar in remote allowlist, duplicate webhook deliveries, CONTROL_SECRET stranding); 4 documented as known limitations in PLAN §12 (all around DO eviction / GitHub webhook ordering — acceptable for a not-yet-live-validated milestone).
• 115 unit tests (pnpm -r test), typecheck clean, worker bundle 1.57 MB / 354 KB gzip.
• Config validated with wrangler deploy --dry-run: both the CI-provisioned and default TOML variants parse and resolve all four DO class exports, including migration v4 with an unbound Sandbox class.

Not in this PR (rest of v0.3, tracked in PLAN §12 M8 notes)

R2 build cache, Browser Run for E2E, the GitHub Actions importer, Pages build-artifact handover, runtime: worker (Dynamic Workers can't run npm), per-job container images (containers pin the image at deploy time). And the standing caveat: needs one live run against a real Workers Paid account to confirm the Containers provisioning path + Sandbox exec/gitCheckout wire behavior.

🤖 Generated with Claude Code