[3/4] feat: linkedin-sync worker that debounces profile changes into deploys

[devnull03]

Stacked on #4. Next: #6.

LinkedIn has no "profile changed" webhook, so workers/linkedin-sync is a standalone Cloudflare Worker. It collects change signals and turns them into one redeploy once they have been quiet for 2 hours.

 POST /hook ───────────┐
 PUT  /export (zip) ───┼──► Debouncer (Durable Object)        content-release.yml (#4)
 hourly cron (DMA) ────┘    alarm = last signal + 2h  ─────►  repository_dispatch ──► tag ──► deploy

How it works

• The debounce is a Durable Object alarm. Every signal pushes the alarm out to now + DEBOUNCE_MINUTES (120). MAX_WAIT_MINUTES (24 h) stops a constant trickle of edits from postponing forever. When the alarm fires, the worker sends repository_dispatch: content-changed with the collected reasons.
• A failed dispatch stays pending, and the alarm retries with backoff.
• A signal that arrives mid-dispatch isn't lost.
• Signals
  • POST /hook: an iOS Shortcut, a mail rule on LinkedIn's notification emails, or curl.
  • PUT /export: upload the LinkedIn data-export ZIP. It is stored in R2 and served to CI via GET /export with a separate read-only token, so content:fetch builds from it. For a non-EEA account this is how new LinkedIn data reaches the site. Re-uploading an identical file is ignored.
  • Hourly cron: only when LINKEDIN_DMA_TOKEN is set (EEA/CH accounts). It hashes the official Snapshot API data canonically and signals on change; the first hash is a baseline.
• GET /status shows what's pending and when it fires, plus the last dispatch result. POST /flush deploys now.
• Tokens are compared in constant time. ?token= also works for senders that can't set headers.

Setup

See workers/linkedin-sync/README.md:

1. wrangler r2 bucket create linkedin-exports
2. Worker secrets: HOOK_SECRET, EXPORT_READ_TOKEN, and GITHUB_TOKEN (a fine-grained PAT with Contents: read & write on this repo, which repository_dispatch requires).
3. pnpm worker:deploy
4. In this repo's settings: LINKEDIN_EXPORT_URL (variable) and LINKEDIN_EXPORT_TOKEN (secret).

Verification

• pnpm worker:test: 6 node --test cases for the debounce state machine (window reset, max-wait cap, single dispatch, retry on failure, mid-dispatch signal, fingerprint baseline).
• pnpm worker:check: tsc against generated Workers types. Both run in CI.
• End to end in local wrangler dev, with a 3 s debounce and a mock GitHub API:
  • 3 rapid hooks → exactly 1 dispatch after the window, carrying all 3 reasons.
  • Export upload → stored, then dispatched; the same ZIP again → nothing scheduled; a non-ZIP body → 400.
  • The read-only token can download the export but can't trigger a deploy (401).
  • LINKEDIN_EXPORT=<worker>/export pnpm content:fetch parses the uploaded ZIP.
  • Unauthenticated requests → 401.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
portfolio	Ready	Preview	Oct 6, 2026 6:06am UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.