Appendix

A. Full bitbucket-pipelines.yml

The complete pipeline with the guarded production rollback in place. Replace the example hostnames with the Worker’s real routes.

image: node:20

definitions:
  caches:
    npm: ~/.npm
  steps:
    - step: &quality
        name: Quality gate
        caches: [npm]
        script:
          - npm ci
          - npm run lint
          - npm run typecheck
          - npm run test
          - bash scripts/preflight-secrets.sh
          - npx wrangler deploy --dry-run --env staging
        artifacts:
          - dist/**

pipelines:
  pull-requests:
    "**":
      - step: *quality

  branches:
    develop:
      - step: *quality
      - step:
          name: Deploy dev
          deployment: test
          caches: [npm]
          script:
            - npm ci
            - npx wrangler deploy --env dev --var COMMIT_SHA:$BITBUCKET_COMMIT
            - bash scripts/smoke.sh https://example.adventive.dev $BITBUCKET_COMMIT

    main:
      - step: *quality
      - step:
          name: Deploy staging
          deployment: staging
          caches: [npm]
          script:
            - npm ci
            - npx wrangler deploy --env staging --var COMMIT_SHA:$BITBUCKET_COMMIT
            - bash scripts/smoke.sh https://example.adventivestg.com $BITBUCKET_COMMIT

  tags:
    "v*.*.*":
      - step: *quality
      - step:
          name: Deploy production
          deployment: production
          trigger: manual
          caches: [npm]
          script:
            - npm ci
            - npx wrangler deploy --env production --var COMMIT_SHA:$BITBUCKET_COMMIT
            - |
              if ! bash scripts/smoke.sh https://example.adventive.com $BITBUCKET_COMMIT; then
                npx wrangler rollback --env production --message "automatic rollback from CI after smoke failure"
                exit 1
              fi

B. Glossary

Workers Builds — Cloudflare’s native CI/CD for Workers. Connects a Worker to a GitHub or GitLab repository and deploys on push. Does not support Bitbucket.

External CI/CD — A pipeline you own that deploys a Worker by running Wrangler against a Cloudflare API token. The supported path for any non-GitHub, non-GitLab provider.

Bitbucket Deployments — Bitbucket’s environment tracking. A step tagged with deployment: <env> records to that environment, can hold environment-scoped variables, and can be gated to authorized reviewers.

Deployment variable — A Bitbucket variable scoped to a single deployment environment, visible only to steps deploying to that environment. Used to keep the production token out of staging builds.

Secured variable — A Bitbucket variable masked in logs and unreadable after save. The API token must be secured.

Gate sequence — The ordered checks every build runs before deploy: install, lint, typecheck, unit tests, secret scan, dry-run deploy.

Soak window — The minimum time a change lives in staging before promotion to production, sized by change type and Worker tier.

Wrangler environment — A named block in wrangler.toml ([env.dev], [env.staging], [env.production]) selected at deploy time with --env.

C. References

1. Cloudflare, CI/CD overview: https://developers.cloudflare.com/workers/ci-cd/
2. Cloudflare, Workers Builds (GitHub and GitLab only): https://developers.cloudflare.com/workers/ci-cd/builds/
3. Cloudflare, external CI/CD, GitHub Actions: https://developers.cloudflare.com/workers/ci-cd/external-cicd/github-actions/
4. Cloudflare, Secrets Store access control and CI token permissions: https://developers.cloudflare.com/secrets-store/access-control/
5. Cloudflare, Wrangler commands: https://developers.cloudflare.com/workers/wrangler/commands/
6. Atlassian, Bitbucket Pipelines configuration: https://support.atlassian.com/bitbucket-cloud/docs/configure-bitbucket-pipelinesyml/
7. Atlassian, Bitbucket Deployments: https://support.atlassian.com/bitbucket-cloud/docs/set-up-and-monitor-deployments/
8. Adventive, QA and Deployment SOP: system-infrastructure/cloudflare/workers/qa-deployment-process.md
9. Adventive, Wrangler Configuration Standard: system-infrastructure/cloudflare/workers/wrangler-configuration.md
10. Adventive, Secrets and Security Policy: system-infrastructure/cloudflare/workers/security-secrets-policy.md