fix(ci): skip the relay deploy when the fork has no relay to deploy to

[yordis]

• This fork owns none of the upstream production infrastructure, and the production environment carries no variables or secrets, so the relay deploy fails at its first credential lookup.
• The failure only became visible now: the job asked for runners this organization does not have, so every run since it was added sat queued until a later push superseded it.
• The release chain reads the same relay state, so it is gated the same way rather than building against an empty config.
• The workflows stay in place and start working on their own the moment the environment carries credentials.

[cursor]

PR Summary

Low Risk
CI-only workflow gating with no application or production runtime changes; upstream repos with credentials should behave the same when relay_url is populated.

Overview
Adds an upfront Cloudflare credential check to deploy-relay.yml and the release workflow’s relay_public_config job. When CLOUDFLARE_ACCOUNT_ID or CLOUDFLARE_API_TOKEN is missing, the workflows log a notice and skip checkout, deploy, state reads, and config resolution instead of failing on the first secret lookup.

In release.yml, jobs that bake in production relay/Clerk settings (build, publish_cli, deploy_web, announce_discord) now gate on relay_public_config.outputs.relay_url being non-empty rather than requiring that job to succeed. Forks or environments without production relay infra can finish the workflow without a failed deploy or builds against empty relay config; full release behavior resumes automatically once credentials are present.

^{Reviewed by Cursor Bugbot for commit 06c8ba7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: c06d5d08-2c88-4dba-80b3-1b0d69d3d9c7

📥 Commits

Reviewing files that changed from the base of the PR and between d9acfe1 and 06c8ba7.

📒 Files selected for processing (2)

• .github/workflows/deploy-relay.yml
• .github/workflows/release.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The workflows now check production relay credentials before running relay operations. Release jobs also require a non-empty relay URL before building, publishing, deploying, or announcing releases.

Changes

Relay credential gating

Layer / File(s)	Summary
Gate production relay deployment .github/workflows/deploy-relay.yml	The workflow records whether Cloudflare credentials exist. Checkout, setup, deployment, and commit status steps run only when credentials are configured.
Gate release relay configuration and dependents .github/workflows/release.yml	The release workflow skips relay configuration without credentials. Downstream jobs run only when relay_url is non-empty.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 06c8b

Relay deployment and relay-dependent release work now skip cleanly when production relay credentials are unavailable, while continuing to run when configuration is present. No current merge-blocking risk is identified.

Suggested reviewers: juliusmarminge, t3dotgg, maria-rcks

Poem

A rabbit checks the tokens bright
Then skips the relay flight
No URL, no release train
Safe workflows wait again
Credentials make the hops take wing

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the problem, the change, and the intended behavior, but it omits the required "What Changed," "Why," and "Checklist" sections. It also does not identify UI changes as not appl…	Rewrite the description using the repository template. Add completed "What Changed" and "Why" sections, state that UI changes are not applicable or remove that section, and complete the Checklist with the relevant items checked.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main CI change: skipping relay deployment when no relay is configured.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the problem, the change, and the intended behavior, but it omits the required "What Changed," "Why," and "Checklist" sections. It also does not identify UI changes as not applicable.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yordis/fix-relay-deploy-guard

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−17 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−8 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−9 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−16 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−12 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: d9acfe1 · PR result: 06c8ba7 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.