ci: post the Cloudflare preview URL as a PR comment

[StephenTangCook]

Why

Cloudflare's GitHub App stopped commenting preview URLs on this repo's PRs. Every PR from #155 to #170 got the cloudflare-workers-and-pages[bot] comment (except #164, which lost it to a five-PR dependabot burst); both PRs opened since, #171 and #172, got nothing. The Workers Builds: block-kitchen check run still arrives and passes, posted by the same app (id 85455), and its summary still carries the URLs:

Preview URL: https://7d27c007-block-kitchen.tightknit.workers.dev
Preview Alias URL: https://claude-block-advanced-toggle-c441e4-block-kitchen.tightknit.workers.dev

Both resolve, so only the comment is missing. The org installation was updated Aug 3 at 16:27 PT, the day before the first silent PR, and currently grants administration, checks, contents, deployments, metadata, pull_requests with no issues grant. That is a plausible cause but not confirmed, and it is on Cloudflare's side either way. This reads the URLs off the check run and posts the comment with our own GITHUB_TOKEN, so it does not depend on that app's comment permissions at all.

What

.github/workflows/cf-preview-url.yml, adapted from tightknit-app's cf-preview-urls.yml. Trigger on check_run: completed, filter to the Cloudflare app, resolve the PR by branch, parse the two URLs out of output.summary, then create or update a comment keyed by a <!-- cf-preview-url --> marker.

Dropped from the original, none of which apply to a single-worker repo:

• the EXPECTED_WORKERS list and the per-worker aggregation table
• the second checks.listForRef call (the check_run event payload already carries this worker's output.summary)
• the constructed fallback preview URL
• the compareCommitsWithBasehead ordering guard, replaced by a plain sha !== pr.head.sha skip

That last one is the only behavior change worth naming: a build that finishes after a newer push posts nothing instead of being ordered against the recorded commit. The newer build's own check run posts moments later, so the end state is the same and the comment can never show stale results.

Rendered output:

Cloudflare preview

✅ Deployed b537e9b · Branch preview · Commit preview · Build logs

Verification

The YAML parses, and the inline script, extracted verbatim from the file, was dry-run against the real check-run payload from #172 with a stubbed Octokit:

Case	Result
build is PR head	creates the comment above
build behind PR head	no API calls, logs the skip
no open PR for branch	no API calls, logs the skip
check run without a head branch	no API calls, logs the skip

This will not demonstrate itself on this PR. GitHub only dispatches check_run events to workflow files already on the default branch, so the first PR to get a comment is the one after this merges. If it stays silent then, the next thing to check is whether Cloudflare's own comment was disabled at the source (Workers → block-kitchen → Settings → Builds), since this workflow depends on the check run continuing to arrive.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}