fix(ci): skip create-next-app deploy on forks

[NathanDrake2406]

Summary

• skip the create-next-app Cloudflare deploy job outside Cloudflare-owned repositories
• document why the guard exists at the workflow boundary

Closes #2413.

Root cause

create-next-app-cloudflare-deploy.yml runs on push to main, so fork main branches run it too. The job deploys a fixed Cloudflare Worker and reads CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID from repository secrets. In forks those secrets resolve to empty values, so Wrangler fails in the non-interactive deploy step even though the generated project build and dist/server/wrangler.json verification already passed.

This is not a flaky test. It is a secret-backed deploy job running in a repository context where the required secrets are intentionally unavailable.

Validation

• ruby -e 'require "yaml"; YAML.load_file(ARGV.fetch(0)); puts "yaml ok"' .github/workflows/create-next-app-cloudflare-deploy.yml
• vp run fmt:check -- .github/workflows/create-next-app-cloudflare-deploy.yml
• pre-commit hook: vp check --fix on staged file and full check

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@vinext/cloudflare@2414

npm i https://pkg.pr.new/vinext@2414

commit: 3f65b5b

[github-actions]

Performance benchmarks

Compared 3f65b5b against base 0a48f0f using alternating same-runner rounds. Next.js was unchanged and skipped.

1 improved · 0 regressed · 5 within ±1.5%

Scenario	Framework	Baseline	Current	Change
Client bundle size (gzip)	vinext	124.0 KB	124.0 KB	⚫ +0.0%
Client entry size (gzip)	vinext	118.8 KB	118.8 KB	⚫ +0.0%
Dev server cold start	vinext	1.97 s	1.92 s	🟢 -2.6%
Production build time	vinext	2.26 s	2.28 s	⚫ +0.9%
RSC entry closure size (gzip)	vinext	95.2 KB	95.2 KB	⚫ 0.0%
Server bundle size (gzip)	vinext	161.5 KB	161.5 KB	⚫ +0.0%

View detailed results and traces

_{🟢 improvement · 🔴 regression · ⚫ change below 1.5% · paired base/head}