2026 OpenClaw Frontend Practice:
Cloudflare Pages Deploy Hook → Remote Mac Smoke, Security Headers Audit & Build Summary Callback
Audience: Cloudflare Pages teams fighting stale caches, header regressions, and Workers layering after deploy. Unlike Netlify hook smoke tests, this CF-native chain adds purge-aware warm-up, _headers diff, batched curl, OpenClaw gateway orchestration, and a failure summary beside build metrics PR summaries. Cross-check pre-deploy smoke and service worker acceptance when SWs wrap HTML.
01 Why Pages deploy hooks still need a remote Mac runner
A Deploy Hook means “build finished,” not that CSP, HSTS, or Permissions-Policy survived Workers plus _headers on the edge.
- Cache invalidation lag. Without a deliberate purge or versioned asset names, smoke tests may pass against fresh artifacts in CI yet miss a sticky document at the edge.
- Headers as merged policy. The file in Git is not always the byte-for-byte response users see; you must diff effective headers after deploy.
- Browser reality. Safari and Chromium still diverge on storage partitions and service worker timing, so a remote Mac remains the honest place to replay Playwright after the hook fires.
02 Decision matrix: Netlify hooks vs Cloudflare Pages hooks
Netlify and CF hooks look similar; edge semantics differ.
| Topic | Netlify Deploy Hook emphasis | Cloudflare Pages emphasis |
|---|---|---|
| Hook contract | Build completes; preview URLs are first-class. | Production and preview projects; pair hook with cache purge plans and Workers routes. |
| Headers source of truth | netlify.toml headers blocks. |
Repo _headers plus dashboard rules; requires curl diff against live responses. |
| Stale content risk | CDN invalidation patterns differ per asset class. | Explicit purge APIs and tag strategies; treat HTML and hashed chunks separately. |
| Verification style | Warm GET plus Playwright remains valid. | Add batched curl for security headers and redirect chains on multiple entry URLs. |
03 Reproducible hook chain you can paste into a shell
Validate X-Hook-Secret, enqueue OPENCLAW_RUN_ID, return 202 Accepted; run heavy work on the Mac.
- Capture deploy context: export
GIT_SHA,CF_PAGES_COMMIT_SHAor provider metadata,DEPLOYMENT_ID, and the publicPAGES_URLyou intend to test. - Plan cache invalidation: issue targeted purges for the HTML shell and any non-fingerprinted JSON, or rely on content hashes when your bundler already emits immutable names.
- Warm with backoff: loop
curl -fsS -o /dev/null -w '%{http_code}' "$PAGES_URL/healthz"until200or a deadline; jitter retries when you see429after purge storms. - Headers rules diff: check out the previous tag, run
diff -uon_headers, and store a short text artifact beside the build for auditors. - Curl batch for security headers: feed a newline list of URLs through
xargs -n1to capturestrict-transport-security,content-security-policy, andpermissions-policywithcurl -sSI; fail if any required directive disappears. - Playwright smoke: run
npx playwright test tests/smoke --project=webkit --project=chromiumagainstPAGES_URLafter curl gates pass. - Build summary JSON: write
.openclaw/reports/build_summary.jsonwithschema: "build_summary/v1", timings, failing curl lines, header diffs, and Playwright traces; POST withIdempotency-Key: ${GIT_SHA}:${DEPLOYMENT_ID}:cfpages.
04 OpenClaw gateway orchestration and failure summaries
The OpenClaw gateway sequences curl_batch, headers_diff, playwright_smoke, stopping on first non-zero exit. Emit NDJSON with phase, attempt, http_status, openclaw_run_id.
Failure digests should list the first bad URL, missing header, purge id, and deployment id. Success runs still log cf_cache_status to prove warm-up hit fresh bytes.
05 Citable guardrails
Document whether you purge by URL list, prefix, or tag; full-zone purges are a last resort because they amplify API rate limits during dense release trains.
Store the unified diff of _headers next to the deployment id so security reviewers can compare repository intent with live curl captures.
Scope OPENCLAW_GATEWAY_TOKEN to summary POST and queue APIs only; never embed Cloudflare API tokens inside client-side bundles or public logs.
06 FAQ: hooks, caches, and headers
| Symptom | Likely cause | What to verify |
|---|---|---|
| Smoke passes once, then flakes | Racing purge completion or hitting different pops. | Increase warm-up deadline, log cf-ray and age, and rerun curl batch before Playwright. |
| CSP missing in production only | Another rule overrides static headers for that route. | Compare curl -sSI for both apex and www; grep Workers bindings for duplicate header injection. |
| Hook returns 403 | Rotated secret or wrong project slug. | Regenerate the hook URL, update vault entries, and grep internal docs for stale endpoints. |
| 429 from Cloudflare APIs | Purge bursts or secondary rate limits. | Shard purges, backoff with jitter, and cache deployment metadata for five minutes. |
Should curl batches replace Playwright?
No. Curl proves transport-layer headers and redirects; browsers still enforce CSP and mixed content differently. Use curl as a fast gate, then let Playwright cover DOM and storage behaviors.
Where does the Netlify article still help?
It remains the reference for generic hook hygiene, NDJSON fields, and callback idempotency. Swap provider-specific URLs and add the cache plus headers steps from this Pages-focused guide.
Run Cloudflare Hook Chains on Real Apple Hardware
Keep Pages deploy hooks attached to durable Safari and Chromium automation, stream OpenClaw summaries, and avoid laptop-bound flake. Review pricing and help with no login, then buy or rent a remote Mac when your edge releases outgrow shared CI minutes.