From e9dd6c33c8e8bdbe0962414e0dc3303d575e914b Mon Sep 17 00:00:00 2001
From: Stefan <stefan@starflinger.eu>
Date: Mon, 10 Aug 2026 15:37:18 +0200
Subject: [PATCH] ci: purge the config-server cache when genesis artifacts
 change

Cloudflare caches the genesis artifacts on config.<network>.ethpandaops.io
for a day (ethpandaops/ethPandaOps cloudflare/terraform/cache-rules.tf),
so a regenerated genesis would otherwise be served stale until the TTL
expired.

Trigger on push to master rather than from the ansible run: the config
server proxies raw.githubusercontent.com/<repo>/master/..., so what
changes the bytes GitHub serves is the push, not the playbook. Ansible
writes network-configs into the operator's working tree and a human
commits afterwards, so purging at playbook time would evict the entry
before the new content existed and immediately re-cache the old object
for a full day.

Purge by hostname rather than by URL. Every purge method is available on
all Cloudflare plans, and only the paths matched by the cache rule are
cacheable on these hosts, so purging the host is equivalent to listing
them and cannot drift out of sync with the rule.
---
 .github/workflows/purge-config-cache.yaml | 47 +++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 .github/workflows/purge-config-cache.yaml

diff --git a/.github/workflows/purge-config-cache.yaml b/.github/workflows/purge-config-cache.yaml
new file mode 100644
index 00000000..e40e25d2
--- /dev/null
+++ b/.github/workflows/purge-config-cache.yaml
@@ -0,0 +1,47 @@
+name: Purge config cache
+
+# Cloudflare caches the genesis artifacts these hosts serve for a day
+# (ethpandaops/ethPandaOps -> cloudflare/terraform/cache-rules.tf), so a
+# regenerated genesis has to be purged explicitly. Nothing else on those hosts
+# is cached, so nothing else needs purging.
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'network-configs/*/metadata/genesis.ssz'
+      - 'network-configs/*/parsed/parsedConsensusGenesis.json'
+
+permissions:
+  contents: read
+
+jobs:
+  purge:
+    name: Purge Cloudflare cache
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Purge changed networks
+        env:
+          CF_TOKEN: ${{ secrets.CLOUDFLARE_CACHE_PURGE_TOKEN }}
+          CF_ZONE: ${{ secrets.CLOUDFLARE_ZONE_ID }}
+        run: |
+          set -euo pipefail
+
+          hosts=$(git diff --name-only HEAD^ HEAD \
+            -- 'network-configs/*/metadata/genesis.ssz' \
+               'network-configs/*/parsed/parsedConsensusGenesis.json' \
+            | cut -d/ -f2 | sort -u \
+            | sed 's|.*|config.glamsterdam-&.ethpandaops.io|')
+
+          echo "Purging:"
+          echo "$hosts"
+
+          echo "$hosts" | jq -Rn '{hosts: [inputs]}' | curl -sS --fail-with-body \
+            -X POST "https://api.cloudflare.com/client/v4/zones/$CF_ZONE/purge_cache" \
+            -H "Authorization: Bearer $CF_TOKEN" \
+            -H "Content-Type: application/json" \
+            --data @-