From 907515a219a31d6e81fa5dac1a92f055a7b0f68a Mon Sep 17 00:00:00 2001
From: Jacob Coffee <jacob@z7x.org>
Date: Sat, 21 Feb 2026 13:24:29 -0600
Subject: [PATCH 1/2] try to be selective/smart about purges

---
 .github/workflows/purge-cache.yml | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/purge-cache.yml b/.github/workflows/purge-cache.yml
index 91f8b101e..b44a60059 100644
--- a/.github/workflows/purge-cache.yml
+++ b/.github/workflows/purge-cache.yml
@@ -18,11 +18,27 @@ permissions: {}
 jobs:
   purge:
     runs-on: ubuntu-latest
-    env:
-      KEY: ${{ inputs.target || 'pydotorg-app' }}
     steps:
-      - name: Purge ${{ env.KEY }}
+      - uses: actions/checkout@v4
+        if: inputs.target == ''
+        with:
+          fetch-depth: 2
+
+      - name: Resolve keys
+        id: keys
+        run: |
+          if [ -n "${{ inputs.target }}" ]; then
+            echo "keys=${{ inputs.target }}" >> "$GITHUB_OUTPUT"
+          elif git diff --name-only HEAD~1 HEAD | grep -qE '^(static/|templates/)'; then
+            echo "keys=pydotorg-app" >> "$GITHUB_OUTPUT"
+          else
+            echo "keys=$(git diff --name-only HEAD~1 HEAD | grep -oP '^apps/\K[^/]+(?=/(templates|static)/)' | sort -u | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Purge ${{ steps.keys.outputs.keys || 'pydotorg-app' }}
         run: |
-          curl -fsS -X POST \
-            "https://api.fastly.com/service/${{ secrets.FASTLY_SERVICE_ID }}/purge/${{ env.KEY }}" \
-            -H "Fastly-Key: ${{ secrets.FASTLY_API_KEY }}"
+          for KEY in ${{ steps.keys.outputs.keys || 'pydotorg-app' }}; do
+            curl -fsS -X POST \
+              "https://api.fastly.com/service/${{ secrets.FASTLY_SERVICE_ID }}/purge/$KEY" \
+              -H "Fastly-Key: ${{ secrets.FASTLY_API_KEY }}"
+          done

From 60d913d16f9267849a91f5eaa66c62e04fd6548d Mon Sep 17 00:00:00 2001
From: Jacob Coffee <jacob@z7x.org>
Date: Sat, 21 Feb 2026 13:34:59 -0600
Subject: [PATCH 2/2] fix(cdn): smart surrogate key detection for Fastly cache
 purge

Only purge section-specific keys when app templates/static change,
fall back to full site purge for global template/static changes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/purge-cache.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/purge-cache.yml b/.github/workflows/purge-cache.yml
index b44a60059..f7f85c2d4 100644
--- a/.github/workflows/purge-cache.yml
+++ b/.github/workflows/purge-cache.yml
@@ -19,20 +19,20 @@ jobs:
   purge:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-        if: inputs.target == ''
+      - uses: actions/checkout@v6
+        if: github.event_name == 'push'
         with:
-          fetch-depth: 2
+          fetch-depth: 0
 
       - name: Resolve keys
         id: keys
         run: |
           if [ -n "${{ inputs.target }}" ]; then
             echo "keys=${{ inputs.target }}" >> "$GITHUB_OUTPUT"
-          elif git diff --name-only HEAD~1 HEAD | grep -qE '^(static/|templates/)'; then
+          elif git diff --name-only ${{ github.event.before }}..${{ github.sha }} | grep -qE '^(static/|templates/)'; then
             echo "keys=pydotorg-app" >> "$GITHUB_OUTPUT"
           else
-            echo "keys=$(git diff --name-only HEAD~1 HEAD | grep -oP '^apps/\K[^/]+(?=/(templates|static)/)' | sort -u | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
+            echo "keys=$(git diff --name-only ${{ github.event.before }}..${{ github.sha }} | grep -oP '^apps/\K[^/]+(?=/(templates|static)/)' | sort -u | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Purge ${{ steps.keys.outputs.keys || 'pydotorg-app' }}