Deploy step fails with `opennextjs-cloudflare: Permission denied`

[ClaudiaGivan]

What versions & operating system are you using?

⛅️ wrangler 4.106.0
────────────────────
node_version: '24'

Please provide a link to a minimal reproduction

pfizer-fit/gtel-reports-automation-fe

Describe the Bug

The deploy job in the shared reusable workflow
(pfizer-fit/bench-stack-cloudflare-actions/.github/workflows/reusable-app-deploy.yml@v1)
fails at the "Deploy Worker" step for OpenNext/Next.js projects with:

Run WRANGLER="$RUNNER_TEMP/trusted-wrangler/node_modules/.bin/wrangler"
▲ [WARNING] Proxy environment variables detected. We'll use your proxy for fetch requests.

 ⛅️ wrangler 4.111.0
────────────────────
OpenNext project detected, calling `opennextjs-cloudflare deploy`
sh: 1: opennextjs-cloudflare: Permission denied

✘ [ERROR]

Please provide any relevant error logs

No response

[workers-devprod]

Note

This is an automated, advisory triage report generated by workers-devprod. It is not an official maintainer response — a maintainer will follow up.

🤖 Automated triage report

Issue Triage: #14738

Summary

wrangler deploy fails at the OpenNext delegation step in a custom GitHub Actions reusable workflow with sh: 1: opennextjs-cloudflare: Permission denied.

Classification

• Type: Bug
• Component: packages/wrangler
• Severity: Medium
• Has Reproduction: No (repro link points to a private/inaccessible repo)
• Quality: Incomplete

Findings

• Created: 2026-07-17
• Author: ClaudiaGivan
• Version: wrangler 4.111.0 (log output; header states 4.106.0), node 24
• Labels: none
• Comments: 0

Analysis

• When wrangler detects an OpenNext project it delegates to opennextjs-cloudflare deploy. The failure is sh: 1: opennextjs-cloudflare: Permission denied, i.e. the opennextjs-cloudflare binary could not be executed (missing execute bit / EACCES), not a wrangler logic error.
• The environment is a bespoke CI setup: a custom reusable workflow (pfizer-fit/bench-stack-cloudflare-actions/.../reusable-app-deploy.yml@v1) that runs a "trusted-wrangler" pinned into $RUNNER_TEMP/trusted-wrangler/node_modules/.bin/wrangler, with proxy environment variables in play. This strongly points to how that workflow installs/copies binaries (permissions lost during copy, restricted temp mount, or a partial install) rather than a defect in wrangler itself.
• The two versions cited (4.106.0 vs 4.111.0 in the log) are inconsistent, so it's unclear exactly which wrangler version produced the failure.
• The reproduction link (pfizer-fit/gtel-reports-automation-fe) is a private repo and cannot be cloned or inspected. There is no minimal, self-contained reproduction, no relevant error logs beyond the snippet, and no comments.
• Because the root cause appears environmental and the only repro is inaccessible, there is not enough information to investigate or confirm a workers-sdk bug.

Recommendation

Status: NEEDS MORE INFO

Reasoning: The reproduction link is a private repo we cannot access, and the error (Permission denied on the opennextjs-cloudflare binary) looks like an environment/CI-permissions problem in a custom "trusted-wrangler" workflow rather than a confirmed wrangler defect. We need a public minimal reproduction and details of how the wrangler/OpenNext binaries are installed before this can be investigated.

Action: Request a public minimal reproduction and CI setup details; apply awaiting reporter response. If it turns out the binary permission is lost by the custom workflow's install/copy step, this is not a workers-sdk bug.

Suggested Labels: awaiting reporter response

Suggested Comment

Thanks for reporting this. The error sh: 1: opennextjs-cloudflare: Permission denied means the opennextjs-cloudflare binary couldn't be executed — this usually indicates a missing execute permission (EACCES) on the binary rather than a problem inside wrangler itself, and your logs show it happening inside a custom reusable workflow that pins a "trusted-wrangler" into $RUNNER_TEMP. To help us investigate, could you provide:

• A public minimal reproduction (a repo we can clone and run) — the linked repo appears to be private, so we can't access it.
• The exact wrangler version that produced the failure (your report mentions 4.106.0 but the log shows 4.111.0).
• How wrangler and opennextjs-cloudflare are installed in the reusable workflow — in particular, whether the trusted-wrangler step copies/moves files into $RUNNER_TEMP/trusted-wrangler (copying can drop the executable bit on node_modules/.bin binaries).
• The output of ls -l node_modules/.bin/opennextjs-cloudflare (and the same for the $RUNNER_TEMP/trusted-wrangler copy) right before the deploy step runs.

Without a reproduction we can run, we won't be able to look into this further.

Structured summary (JSON)

{
  "issueNumber": 14738,
  "title": "Deploy step fails with `opennextjs-cloudflare: Permission denied`",
  "githubUrl": "https://github.com/cloudflare/workers-sdk/issues/14738",
  "recommendation": "NEEDS MORE INFO",
  "difficulty": "n/a",
  "reasoning": "The reproduction link is a private repo we cannot access, and the `Permission denied` error on the opennextjs-cloudflare binary looks like a CI/permissions problem in a custom trusted-wrangler workflow rather than a confirmed wrangler defect.",
  "suggestedAction": "Request a public minimal reproduction, the exact wrangler version, and details of how the binaries are installed/copied in the reusable workflow; apply the awaiting reporter response label.",
  "hasSuggestedComment": true,
  "suggestedLabels": ["awaiting reporter response"]
}