Cloud services

Blog post

First the repository. Then the cloud.

A hostname does not become a site here until it has a visible home in git. That one rule gives us a trustworthy name, an accountable publishing path, and an identity we can safely limit.

A team places a repository into a provisioning workshop that creates credentials, storage, a custom-domain gateway, and a global edge

We host both the files and the public edge, so we cannot responsibly attach them to a pipeline we cannot see. Every production hostname begins as one repository in our organization, and the repository is named after that hostname. Even a name used only for a redirect keeps its repository: the redirect is a Front Door rule on that site, not an invisible exception to the inventory.

What onboarding creates

  1. Name the site The production hostname becomes the repository name. Immutable numeric organization and repository ids anchor its federated credentials.
  2. Apply the leaf Provision environments, visitor TLS policy, and DNS ownership. Mint one project UUID in state and keep it for the life of the site.
  3. Set two secrets Add the uploader application id and project id to the repository. Directory and subscription ids remain organization-level secrets.
  4. Call the library The tenant workflow is a thin, pinned uses: call using GitHub reusable workflows. GitHub's actual repository must agree with the hostname it requests.

Why the origin path stays still

A per-release origin path would turn every content publish into a Front Door infrastructure mutation and give an interrupted run another way to strand the site. The route therefore matches inbound /* but stays fixed at /<PROJECT_ID>/<fqdn>/public.

A deploy replaces visitor files inside $web/<PROJECT_ID>/<fqdn>/public/ while state/ beside it holds version.txt and any unfinished purge queue. Content changes often; routing does not.

Branches become identities, not just labels

The production branch—normally main—gets a federated identity credential on the site's uploader application. If preview was provisioned, refs/heads/preview gets another credential on that same application. The environment list in the publishing workflow must remain a subset of the environments infrastructure already created; a new branch cannot invent a public hostname.

What operators never have to type

Resource-safe names, blob prefixes, the attribute-based access-control root, and linkToDefaultDomain: Disabled are derived from the site record. The less hand-entered glue onboarding contains, the fewer quiet disagreements we can create between git, identity, storage, and the edge.

For the friendly version, see publishing as an author. For the product boundary, see what owners are buying. Or continue to how hostname inventory works.