Deploy code-managed edge rules (CLI 6.3.0)

README.md

@@ -158,3 +158,25 @@ jobs:
 ## License
 
 MIT License
+
+
+### Declarative edge rules (CLI 6.3.0 / next action release)
+
+Provide `rules: edge-rules.json`, `functions: edge-functions.json`,
+`api-token: ${{ secrets.QUANT_API_TOKEN }}` and
+`api-base-url: ${{ vars.QUANT_BASE_URL }}` alongside the normal deployment inputs.
+The portal injects the project-scoped API secret and the environment-specific
+portal `/api/v2` URL when a static/Studio template includes `edge-rules.json`.
+Rules access is validated before uploads; rules are applied after functions and
+assets are uploaded. Uploads continue to use the separate `token` input.
+Never substitute the content write token for `api-token`.
+
+Rules deployed this way are managed in code and are read-only in the dashboard.
+If one was changed outside code anyway, the access check fails before any upload
+and the log lists the changed fields. Set `rules-force: true` for one run to
+overwrite those rules with the manifest; it never takes over a rule the manifest
+did not create.
+
+This change requires the new portal rules endpoint and CLI 6.3.0 Docker image
+before releasing the action. Existing template workflows should remain pinned
+to their current action until that release is available.

action.yml

@@ -9,7 +9,7 @@ inputs:
     description: "Your project name"
     required: true
   token:
-    description: "Your API token"
+    description: "Your content write token (uploads only)"
     required: true
   dir:
     description: "The directory to deploy"
@@ -49,12 +49,41 @@ inputs:
   functions:
     description: "Path to JSON file containing functions configuration"
     required: false
+  rules:
+    description: "Path to an edge rules JSON manifest"
+    required: false
+  api-token:
+    description: "Project-scoped portal API token for rules (QUANT_API_TOKEN)"
+    required: false
+  api-base-url:
+    description: "Portal API base URL, including /api/v2 (QUANT_BASE_URL)"
+    required: false
+  rules-force:
+    description: "Overwrite managed rules that were changed outside code (never takes over a rule the manifest did not create)"
+    required: false
+    default: "false"
 runs:
   using: "composite"
   steps:
+    - name: Validate Rules Access
+      if: inputs.rules != ''
+      uses: "docker://quantcdn/cli:6.3.0"
+      env:
+        QUANT_API_TOKEN: ${{ inputs.api-token }}
+        QUANT_BASE_URL: ${{ inputs.api-base-url }}
+      with:
+        args: >
+          rules
+          ${{ inputs.rules }}
+          --functions="${{ inputs.functions }}"
+          -c ${{ inputs.customer }}
+          -p ${{ inputs.project }}
+          --force=${{ inputs.rules-force }}
+          --dry-run
+
     - name: Deploy Functions
       if: inputs.functions != ''
-      uses: "docker://quantcdn/cli:6.1.0"
+      uses: "docker://quantcdn/cli:6.3.0"
       env:
         CUSTOMER: ${{ inputs.customer }}
         TOKEN: ${{ inputs.token }}
@@ -71,7 +100,7 @@ runs:
 
     - name: Deploy Assets
       if: inputs.dir != ''
-      uses: "docker://quantcdn/cli:6.1.0"
+      uses: "docker://quantcdn/cli:6.3.0"
       with:
         args: >
           deploy
@@ -87,6 +116,21 @@ runs:
           --endpoint=${{ inputs.endpoint }}
           --revision-log=${{ inputs.revision-log }}
           --enable-index-html=${{ inputs.enable-index-html }}
+    - name: Deploy Rules
+      if: inputs.rules != ''
+      uses: "docker://quantcdn/cli:6.3.0"
+      env:
+        QUANT_API_TOKEN: ${{ inputs.api-token }}
+        QUANT_BASE_URL: ${{ inputs.api-base-url }}
+      with:
+        args: >
+          rules
+          ${{ inputs.rules }}
+          --functions="${{ inputs.functions }}"
+          -c ${{ inputs.customer }}
+          -p ${{ inputs.project }}
+          --force=${{ inputs.rules-force }}
+
 branding:
   icon: "upload-cloud"
   color: "blue"