Repo-history example

Cloudflare Wrangler: one recurring deploy change across a 193-commit real-history window.

In a measured replay of 193 real Cloudflare Workers SDK commits from repo history, the same Wrangler deploy checks passed in standard CI every time. DriftFence still flagged the same deploy change across the full replay window.

With approved deploy behavior fixed in Git, DriftFence would have kept surfacing the same change while the repo's own checks still passed.

First divergence

Wrangler deploy stopped surfacing the same worker-not-found code.

The first commit in this window already failed the DriftFence check, and DriftFence kept flagging the same Wrangler deploy scenario across the rest of the replay window. DriftFence flagged the change at the operation level even though the same checks still passed in standard CI.

Blocked case

First-deploy worker-not-found handling changed.

Across that replay window, the same Wrangler deploy behavior kept changing: the baseline expected error code 10007, but later commits returned no error code. DriftFence caught that repeated change every time.

DriftFence report
Scenario
cloudflare.wrangler.deploy.secret-override-worker-not-found
Expected
output.errorCode = 10007
Observed
output.errorCode = null
Classification
violating

The remote-secret conflict warning and remote-config diff scenarios did not trigger DriftFence on the same commits. The flagged change stayed on one deploy surface.

Across the replay window

One recurring deploy change across the whole window.

This window does not have a before-and-after turn like Firebase. The first commit already triggered the DriftFence check. What matters is that the same deploy change kept showing up while the same deploy checks stayed green and two nearby deploy scenarios did not trigger DriftFence.

Same blocked case later

Same deploy change on every commit

  • Every commit in the window showed the same deploy change.
  • The same Wrangler deploy checks still passed in standard CI.
  • No commit in the window failed conventional CI first.
Nearby workflows with no DriftFence signal

Two other deploy workflows did not trigger DriftFence

  • Remote-secret conflict warnings did not trigger DriftFence.
  • Remote-config diff reporting did not trigger DriftFence.
  • The two other deploy workflows produced no DriftFence signal.
What it shows

A deploy-specific result

  • This page is about one Wrangler deploy behavior.
  • That behavior kept changing while the same deploy checks stayed green.
  • Two nearby deploy workflows did not show the same change.
Method

How it was measured.

This replay fixes one Wrangler deploy baseline, reruns the same deploy checks on each commit, and counts the recurring signal once even though it persisted across the full window. Exact commit references are linked below.

  • Replay size: 193 commits
  • Fixed workflows: first-deploy secret override, remote-secret conflict warning, and remote-config diff handling
  • Same Wrangler deploy checks rerun on every commit in the window
  • DriftFence gate rerun on every commit in the window with the same approved baseline
  • This page counts the recurring deploy change once, even though it persisted across many commits
Source material

Method and source files.

The links below show the benchmark notes and pinned replay plan for this Cloudflare example.

Measurement notes

The benchmark results log records the completed Wrangler deploy window, including the replay size, outcome mix, and representative first flagged change.

Fixed test plan

The Workers replay definition fixes the three Wrangler deploy workflows and the replay window used here.

Related pages

See the product, results, pricing, and trust pages alongside this Cloudflare example.