Verify the repository Cloudflare connection with a read-only workflow #29

🤖 Generated by the Agentic Engineer

Objective

Verify this repository's existing Cloudflare connection through a reviewed, read-only GitHub-hosted workflow, keeping the credential in CI.

Details

The maintainer wants the mail-related Cloudflare changes to use this declarative owner. Its current workflow validates configuration, while repository-level credential metadata alone cannot establish whether an approved organization credential is available to a job. A manual check can resolve that uncertainty before requesting another private handoff.

Use one documented Cloudflare credential binding, fixed read-only API operations and a known owned zone. Report only capability verdicts. Independent state custody, import and a reviewed non-destructive plan remain separate prerequisites for any apply.

Priority is High because the result unblocks the ongoing mail and alerting deployment. End-to-end Effort is Medium, including guarded workflow authoring, offline failure controls, CI, review, protected merge and the first main-only run. Service class is Standard.

Checklist

• Accept manual dispatch on main with typed confirmation; reject other refs before checkout and credential use.
• Keep workflow permissions read-only and use the approved CI secret reference without exposing values or private account metadata.
• Verify the owned-zone binding and active token through fixed GET requests, with no redirects or provider mutation.
• Fail closed on missing credentials, unavailable tools, ambiguous inventory, invalid responses and inactive authorization.
• Exercise success and failure controls offline, then run the reviewed workflow once from main and record the actual connection verdict.

Dependencies

Part of #21. Related ownership/import work: devantler-tech/monorepo#3274. This check does not enable apply automation or establish state custody.