ci: deploy to production on GitHub release

[AnaBerg]

What

Production deploys stop happening on every merge to main and now run when a GitHub release is published.

• vercel.json: disables Vercel's Git-triggered deploys for main. PR previews are unaffected — only production auto-deploy is turned off.
• .github/workflows/production-deploy.yml: on release: published, checks out the release tag and deploys via the Vercel CLI (pull → build --prod → deploy --prebuilt --prod). Pre-releases are skipped.

Required before merge

Add these repository secrets, otherwise the workflow fails and nothing deploys:

• VERCEL_TOKEN — Vercel → Account Settings → Tokens
• VERCEL_ORG_ID and VERCEL_PROJECT_ID — from .vercel/project.json after running vercel link

Notes

• Actions are pinned by SHA and the Vercel CLI by version, matching the existing PR validation workflow.
• After merging, the first production deploy happens on the next published release, not on the merge itself.
• Replaces ci: deploy to production on GitHub release #5, which accidentally carried unrelated docs commits.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
shareable-docs	Ready	Preview, Comment	Jul 28, 2026 12:52am

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4dd0b912-8c7b-4c4c-86f8-b1757adaebdf

📥 Commits

Reviewing files that changed from the base of the PR and between 68e6beb and 9f180ee.

📒 Files selected for processing (1)

• .github/workflows/production-deploy.yml

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Validate

🔇 Additional comments (1)

.github/workflows/production-deploy.yml (1)

36-36: LGTM!

Also applies to: 38-54

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added automated production deployments when a non-prerelease version is published.
  • Deployments now pull the production environment, build in production mode, and publish prebuilt output.

• Configuration

  • Disabled automatic deployments from the main branch on the deployment platform.
  • Added deployment OpenAPI schema configuration to support API documentation.

Walkthrough

Adds a release-triggered production deployment workflow using Bun and Vercel, with prerelease gating and serialized deployments. Adds Vercel configuration to disable Git deployments from main.

Changes

Production deployment

Layer / File(s)	Summary
Deployment triggers and policy .github/workflows/production-deploy.yml, vercel.json	The workflow runs for published non-prerelease releases with serialized production concurrency, while Vercel Git deployment is disabled for main.
Release build and Vercel deployment .github/workflows/production-deploy.yml	The workflow checks out the release tag, installs dependencies with Bun 1.3.13, and pulls, builds, and deploys production output using Vercel CLI 58.0.0.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant Bun
  participant VercelCLI
  participant Vercel
  GitHubActions->>GitHubActions: Check out release tag
  GitHubActions->>Bun: Install dependencies with frozen lockfile
  GitHubActions->>VercelCLI: Pull production environment
  VercelCLI->>Vercel: Build production output
  VercelCLI->>Vercel: Deploy prebuilt output

Loading

Possibly related PRs

• AnaBerg/shareable-docs#5: Adds overlapping production deployment workflow and Vercel configuration changes.

Poem

Release tags hop into flight,
Bun builds softly through the night.
Vercel catches files anew,
Main branch skips its old debut.
Squeak! Production shines bright too.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: switching production deploys to GitHub release events.
Description check	✅ Passed	The description accurately matches the changeset and explains the new release-based production deployment flow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/vercel-release-deploy

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/production-deploy.yml:
- Around line 21-24: Remove VERCEL_TOKEN from the job-level env block and add it
only to the env sections of the Pull Vercel environment, Build, and Deploy
steps. Keep VERCEL_ORG_ID and VERCEL_PROJECT_ID at their existing scope.
- Around line 33-36: Update the “Set up Bun” step using oven-sh/setup-bun to set
its no-cache option to true, ensuring this privileged production deploy does not
use Bun executable caching.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4124bad0-5485-446e-a2df-b1dd0e8d2d73

📥 Commits

Reviewing files that changed from the base of the PR and between e479bac and 68e6beb.

📒 Files selected for processing (2)

• .github/workflows/production-deploy.yml
• vercel.json

📜 Review details

🧰 Additional context used

🪛 zizmor (1.26.1)

.github/workflows/production-deploy.yml

[error] 34-34: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🔇 Additional comments (4)

.github/workflows/production-deploy.yml (3)

1-19: LGTM!

---

26-31: LGTM!

---

38-48: LGTM!

vercel.json (1)

1-8: LGTM!