Scan after deploy
GitHub Actions
Start a scan from your workflow after each deploy.
Integration guide
Scan your website after a Cloudflare Pages deploy
Deploy to Cloudflare Pages from GitHub Actions with Wrangler, then add the Rookflare step. The scan starts once the new version is live.
Overview
What the Cloudflare Pages integration does
What it does
- Calls Rookflare after “wrangler pages deploy” returns, so the scan sees the version you just uploaded.
- Uses Cloudflare’s Direct Upload: GitHub Actions builds the site and Wrangler uploads it, instead of Cloudflare building from Git.
- Sends the commit SHA from GitHub as the ref, like the GitHub Actions guide.
Before you start
- A Growth and Agency plan. The 14-day free trial runs on Growth, so you can set it up before you pay.
- A verified website in Rookflare with monitoring turned on, and the owner or admin role.
- A Cloudflare Pages project and a Cloudflare API token with the permission Account → Cloudflare Pages → Edit.
- CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID saved as GitHub repository secrets. The account ID is in the API section of a zone’s Overview page in Cloudflare.
Setup
Set up Cloudflare Pages step by step
-
Step 1
Create the deploy hook in Rookflare
Open the website, go to the Settings tab and select “Create deploy hook” in the “Scan after deploy” card. Copy the token right away: this is the only time Rookflare shows it in full. The card keeps the endpoint and the last four characters of the token.
The Scan after deploy card right after “Create deploy hook”: the full token is shown once, with the endpoint below it. -
Step 2
Add the Rookflare token next to the Cloudflare secrets
In GitHub, open the repository’s Settings → Secrets and variables → Actions and add ROOKFLARE_DEPLOY_TOKEN with the token as its value, next to CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID.
-
Step 3
Add the step after the Wrangler deploy
Put the Rookflare step right after the step that runs “wrangler pages deploy”. Replace dist with your build output folder and northwind-shop with your Pages project name.
- name: Deploy to Cloudflare Pages uses: cloudflare/wrangler-action@v3 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} command: pages deploy dist --project-name=northwind-shop - name: Scan with Rookflare after deploy if: success() run: | curl -fsS -X POST "https://app.rookflare.example/api/webhooks/deploy" \ -H "Authorization: Bearer ${{ secrets.ROOKFLARE_DEPLOY_TOKEN }}" \ -H "Content-Type: application/json" \ -d '{"ref": "${{ github.sha }}"}'Sample endpoint and placeholder token. The dashboard fills in yours.
-
Step 4
Deploy the production branch
Push to the branch you set as the project’s production branch. In Cloudflare the deployment appears under the project with the Production label; right after it, “Last used” changes on the Rookflare card and Scan history shows a scan with the trigger “After deploy”.
The website’s Scan history: the newest scan has the trigger “After deploy” and is scanning; below it a scheduled scan and an earlier deploy scan, both completed.
Troubleshooting
If it does not work
-
Every branch push starts a scan
Wrangler deploys the current Git branch. A branch other than the production branch becomes a preview deployment on its own pages.dev address, yet the Rookflare step still scans your live site. Run the deploy job only on the production branch, or add “if: github.ref == 'refs/heads/main'” to the Rookflare step.
-
Builds on Cloudflare’s Git integration
A command in the Pages build settings runs before Cloudflare publishes the build, so a scan from there would see the old version. Move the deploy to GitHub Actions as shown, or call the hook from a later step of your own pipeline.
-
Wrangler fails with an authentication error
The Cloudflare token needs Account → Cloudflare Pages → Edit, and CLOUDFLARE_ACCOUNT_ID must be the account that owns the project. This happens before the Rookflare step, which is skipped when the deploy fails.
-
Rookflare answers with an error code
401 means a wrong, rotated or revoked token, 402 a plan or daily limit, 409 an unverified or paused website and 429 more than 30 calls a minute. The cURL guide explains each answer and what to do.
Can Cloudflare Pages call Rookflare by itself?
This guide does not rely on it. Calling the hook from the workflow that runs Wrangler is the setup we know starts the scan after the new version is live.
Rookflare monitors our custom domain, not pages.dev. Does that matter?
No. A production deployment serves both the pages.dev address and the custom domains of the project, and Rookflare scans the pages of the website you added.
Does Cloudflare need the commit SHA too?
Wrangler can attach it with --commit-hash, which helps you match a Cloudflare deployment to a commit. Rookflare gets the SHA from its own step, so the two stay in sync when both use github.sha.
Start monitoring your website
Add your address, pick the pages and approve the first scan as your baseline.
Plans start at €19 per month. Prices are provisional.