Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

ops(vercel): isolate preview and production environments

Open
  • Is something wrong?
#1,024 3 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Domain
cloud, devops, documentation, infrastructure

Research direction

Start by auditing the live Vercel project settings against the three-environment contract and the repository’s canonical release/operator guide. Coordinate with #988, #622, and #995 without duplicating their scopes. Done means a concise environment matrix, verified production and Preview behavior, documented operator steps and plan limitations, and a repeatable verification checklist.

Written by the indexing model from the issue text.

Description

devops p2-high ready-for-human type:chore

Freshness amendment: 2026-09-28

Requires Git-integrated automatic Production path; ADR0051 and vercel.json git.deploymentEnabled=false now hold all Git triggers off and require Dashboard Create Deployment. PR #1050 delivered environment matrix; retain live isolation audit, replace release acceptance text.

The review finding above explains the corrections to this ticket. Original observations retain their evidence date. Completed prerequisites are historical context; unfinished acceptance criteria remain open.

This was generated by AI during triage.

Agent Brief

Category: enhancement
Summary: Make Vercel Preview, Production, and local Development clearly isolated and easy to operate.

Current behavior:

The repository policy says Production ships from the current green main SHA through Dashboard Create Deployment during the ADR 0051 manual hold and Preview deployments are opt-in. The Vercel project still needs a simple, verified operator model for how those environments differ. The audit tracked in #622 found production database and service credentials shared with Preview. #988 separately owns the provider-by-provider environment-variable inventory and its drift check; this issue should complement that work rather than duplicate it.

Desired behavior:

Maintain an auditable three-environment contract:

  • Production: deploys from the current green main SHA through Dashboard Create Deployment during the manual hold; all automatic Git deployment triggers remain disabled, using production domains, data, and credentials.
  • Preview: created only when an operator deliberately requests a PR preview, using non-production resources and credentials, with protected access where the current Vercel plan supports it.
  • Development: local development values only; never production credentials.

The Vercel project settings and operator documentation should agree. Preserve the main-only production release path and current opt-in Preview policy unless a deliberate ADR decision changes them. Coordinate variable scopes with #988 and database isolation with #622. Document the non-secret NODE_OPTIONS=--experimental-require-module runtime setting from #995 for the environments that need server rendering.

Key interfaces:

  • Vercel project configuration: production branch, Preview creation policy, domains, deployment protections, ignored-build behavior, and environment scopes.
  • The canonical release/operator guide and its links to the relevant ADRs and environment-variable contract.
  • Vercel-managed environment variables and integrations; secrets must not be copied into GitHub.

Acceptance criteria:

  • Audit the live Vercel project settings and record, in one concise matrix, each environment’s purpose, deployment trigger/branch, domain behavior, access controls, data/services, and variable scope.
  • Confirm Production is the main Git-integrated release path and production aliases are not assigned to Preview deployments.
  • Keep Preview opt-in for a deliberately selected PR unless an approved ADR changes that policy; verify Preview cannot receive production database or other production service credentials.
  • Verify local Development uses local values only. If Vercel plan limits prevent a desired Preview access control, document the limitation and the safe alternative rather than implying an unavailable protection exists.
  • Document simple operator steps to request a Preview, verify it, remove it, and release to Production through a reviewed merge to main. State that Dashboard Redeploy is not the release path for main.
  • Cross-link #988 for the complete variable inventory/drift check, #622 for database branch and credential isolation, and #995 for the runtime flag; avoid duplicating their implementation scope.
  • Provide a verification checklist showing that a Preview has no production domain or production credentials, and that a fresh main deployment uses Production settings.

Out of scope:

  • Changing main as the only Production release branch.
  • Enabling automatic Preview deployments by default without an explicit ADR decision.
  • Reimplementing the provider-variable inventory or Neon branch lifecycle tracked by #988 and #622.
  • Using a Vercel Dashboard Redeploy to ship main.

Related issues: #622, #732, #988, #995.

Dominant language
TypeScript
Stars
1
Forks
0
Avg merge
1h 44m
Merged PRs (30d)
689

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from fderuiter/deruiter.dev

All issues in fderuiter/deruiter.dev

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.