feat(cron): add publish-due endpoint and rebuildHooks config by michaelmcker · Pull Request #772 · emdash-cms/emdash

michaelmcker · 2026-04-26T09:40:54Z

What does this PR do?

Adds a POST /_emdash/api/cron/publish-due endpoint that publishes all content items whose scheduled_at has passed and fires configured rebuildHooks once per batch.

Also adds the rebuildHooks option to the integration config so users can point EmDash at a Vercel / Netlify / Cloudflare deploy hook URL to trigger a rebuild whenever scheduled content goes live.

Closes #

Type of change

Checklist

I have read CONTRIBUTING.md
pnpm typecheck passes
pnpm lint passes
pnpm test passes (or targeted tests for my change)
pnpm format has been run
I have added/updated tests for my changes (if applicable)
User-visible strings in the admin UI are wrapped for translation and pnpm locale:extract has been run (if applicable)
I have added a changeset (if this PR changes a published package)
New features link to an approved Discussion: https://github.com/emdash-cms/emdash/discussions/...

AI-generated code disclosure

This PR includes AI-generated code

What's included

POST /_emdash/api/cron/publish-due

Iterates all collections, finds items where scheduled_at <= now and status = 'scheduled'
Publishes each due item in a transaction, fires content:afterPublish hooks per item
Fires rebuildHooks once for the whole batch (not per item)
Auth: Authorization: Bearer <EMDASH_CRON_SECRET> when the env var is set; localhost-only in dev; 503 if neither applies
Suitable for Vercel Cron, Cloudflare Workers cron triggers, or any HTTP scheduler

rebuildHooks config option

emdash({
  rebuildHooks: ["https://api.vercel.com/v1/integrations/deploy/..."],
})

Each URL receives a POST request after a publish batch. Requests are deferred past the response via after() so the isolate response isn't blocked. Failures are logged but never surfaced as errors.

Tests — 6 unit tests in tests/unit/api/publish-due.test.ts covering: empty (no-op), past-scheduled item published, future item skipped, multiple items across collections, idempotency (second call publishes 0), and items returned for hook dispatch.

Docs — new guides/scheduled-publishing.mdx and updated reference/configuration.mdx.

Screenshots / test output

✓ tests/unit/api/publish-due.test.ts (6 tests) 42ms
Test Files  157 passed (157)
     Tests  2593 passed (2593)

Adds POST /_emdash/api/cron/publish-due to publish all content items whose scheduled_at has passed, then fire content:afterPublish hooks per item and rebuild hooks once for the batch. - New route secured by EMDASH_CRON_SECRET (or CRON_SECRET for Vercel) - Constant-time token comparison via SHA-256 XOR - rebuildHooks?: string[] config option fires POST to each URL after batch via after() so Workers doesn't cancel in-flight fetches - Per-item publish failures are logged and skipped (batch continues) - handleContentPublishDue exported from core package - Integrates into runSystemCleanup via optional publishFn callback - 6 unit tests covering all required scenarios Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…SH_CRON_SECRET - New guide: guides/scheduled-publishing.mdx — covers setup steps for Vercel Cron, Cloudflare Workers scheduled events, and self-hosted cron, plus how to get deploy hook URLs from Vercel/Netlify/CF Pages - configuration.mdx: document rebuildHooks option with example and fire-and-forget semantics note - configuration.mdx: add EMDASH_CRON_SECRET to env vars table with CRON_SECRET fallback note for Vercel Cron compatibility - Sidebar: add Scheduled Publishing entry in Guides Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-04-26T09:41:04Z

Scope check

This PR changes 628 lines across 15 files. Large PRs are harder to review and more likely to be closed without review.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

changeset-bot · 2026-04-26T09:41:04Z

🦋 Changeset detected

Latest commit: 24691af

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 12 packages

Name	Type
emdash	Patch
@emdash-cms/cloudflare	Patch
@emdash-cms/fixture-perf-site	Patch
@emdash-cms/perf-demo-site	Patch
@emdash-cms/cache-demo-site	Patch
@emdash-cms/admin	Patch
@emdash-cms/auth	Patch
@emdash-cms/blocks	Patch
@emdash-cms/gutenberg-to-portable-text	Patch
@emdash-cms/x402	Patch
create-emdash	Patch
@emdash-cms/plugin-embeds	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-04-26T09:41:06Z

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

I have read the CLA Document and I hereby sign the CLA

_{You can retrigger this bot by commenting recheck in this Pull Request.}_{Posted by the CLA Assistant Lite bot.}

github-actions · 2026-04-26T13:20:52Z

Overlapping PRs

This PR modifies files that are also changed by other open PRs:

fix(admin): extend server-side content search to the content picker and MCP #752 (3 shared files)
feat(admin): add Taxonomy Types management page #213 (4 shared files)
feat: pluggable auth providers — add AT Protocol, refactor GitHub/Google #398 (4 shared files)
feat: Node.js plugin isolation via workerd sandbox #426 (4 shared files)
Store CSS classes, make editor toolbar extensible #143 (3 shared files)

This may cause merge conflicts or duplicated work. A maintainer will coordinate.

github-actions · 2026-05-10T18:30:06Z

This PR has been inactive for 14 days. It will be closed automatically in 7 days if there is no further activity.

If you're still working on this, please push an update or leave a comment.

emdashbot

The approach is sound: a cron-facing HTTP endpoint for scheduled publishing plus configurable rebuild hooks fits EmDash's architecture well. The implementation is mostly clean, but the endpoint is non-functional as-is because the auth middleware blocks it before the route handler can validate the cron secret. I also found docs referencing non-existent code and a docs/code mismatch on when rebuild hooks fire.

Headline issues

Cron endpoint is unreachable — auth.ts rejects the Authorization: Bearer <cron_secret> header (it expects ec_pat_ / ec_oat_ tokens) and enforces X-EmDash-Request CSRF on non-public API routes, so the route handler’s secret check never runs. The route needs to be added to PUBLIC_API_PREFIXES.
Docs reference missing handleScheduled helper — the Cloudflare Workers docs tell users to import handleScheduled from emdash/astro/scheduled, which does not exist.
Rebuild hooks don't fire on unpublish — the updated docs say hooks run after "published or unpublished", but handleContentUnpublish never calls fireRebuildHooks().
Dead code in cleanup.ts — runSystemCleanup accepts a publishFn parameter and publishDueContent was added, but the only caller in emdash-runtime.ts never passes it, so that code path is never exercised.

Process note: This PR adds a user-facing feature but the PR template’s "approved Discussion" checkbox is unchecked. AGENTS.md requires one for features.

What I checked: auth middleware flow, API route conventions (envelope shape, CSRF, error handling), hook firing paths, cleanup scheduler wiring, SQL safety (sql.ref usage is correct), index coverage (scheduled_at partial index exists), docs accuracy, and test coverage (6 unit tests).

michaelmcker and others added 2 commits April 25, 2026 05:31

github-actions Bot added area/core area/docs needs-rebase size/XL labels Apr 26, 2026

github-actions Bot added cla: needed overlap labels Apr 26, 2026

adamslowe mentioned this pull request May 5, 2026

Scheduled posts never become visible on SQLite/D1: string comparison between ISO scheduled_at and SQLite CURRENT_TIMESTAMP always evaluates false #917

Closed

github-actions Bot mentioned this pull request May 7, 2026

feat: per-field allowed MIME types for file and image fields #942

Merged

11 tasks

github-actions Bot added stale and removed stale labels May 10, 2026

This was referenced May 11, 2026

Add plugin-defined MCP tools #988

Open

feat(admin): install sandboxed plugins from the experimental registry #1011

Merged

feat(admin): sidebar menu tree with collection grouping, plugin subgroups, and public menu sync #1024

Closed

github-actions Bot added stale and removed stale labels May 25, 2026

github-actions Bot mentioned this pull request May 29, 2026

[codex] Add visual sections and public Pages preview #1206

Draft

18 tasks

scottbuscemi mentioned this pull request May 29, 2026

fix(core): auto-publish scheduled content and fix SQLite datetime comparison #1216

Open

18 tasks

github-actions Bot added the review/needs-review No maintainer or bot review yet label May 30, 2026

ascorbic added the bot:review Trigger an emdashbot code review on this PR label May 31, 2026

emdashbot Bot reviewed May 31, 2026

View reviewed changes

github-actions Bot added review/awaiting-author Reviewed; waiting on the author to respond and removed review/needs-review No maintainer or bot review yet labels May 31, 2026

github-actions Bot mentioned this pull request May 31, 2026

Registry: env constraints (env:emdash, env:astro) end-to-end with admin compatibility warning #1238

Merged

18 tasks

This was referenced Jun 2, 2026

Fix locale-scoped content updates #1302

Merged

fix(scheduling): drive scheduled publishing from a real heartbeat #1312

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cron): add publish-due endpoint and rebuildHooks config#772

feat(cron): add publish-due endpoint and rebuildHooks config#772
michaelmcker wants to merge 2 commits into
emdash-cms:mainfrom
michaelmcker:feat/publish-due-cron

michaelmcker commented Apr 26, 2026

Uh oh!

github-actions Bot commented Apr 26, 2026

Uh oh!

changeset-bot Bot commented Apr 26, 2026

Uh oh!

github-actions Bot commented Apr 26, 2026

Uh oh!

github-actions Bot commented Apr 26, 2026

Uh oh!

github-actions Bot commented May 10, 2026

Uh oh!

emdashbot Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

michaelmcker commented Apr 26, 2026

What does this PR do?

Type of change

Checklist

AI-generated code disclosure

What's included

Screenshots / test output

Uh oh!

github-actions Bot commented Apr 26, 2026

Scope check

Uh oh!

changeset-bot Bot commented Apr 26, 2026

🦋 Changeset detected

Uh oh!

github-actions Bot commented Apr 26, 2026

Uh oh!

github-actions Bot commented Apr 26, 2026

Overlapping PRs

Uh oh!

github-actions Bot commented May 10, 2026

Uh oh!

emdashbot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants