fix(ci): scope vercel promote to the team that owns the deployment - #982
Merged
Conversation
Production promotion fails on main:
Error: Deployment doesn't belong to current team brian-loves-projects-c1a217a2
`vercel build`, `deploy` and `pull` read the team from .vercel/project.json,
but `promote` takes a bare deployment URL and cannot — it falls back to the
token's default team, which is a personal one, not cacheplane. Both promote
calls were introduced without --scope in #963, so neither the Website nor the
cockpit redirect service has ever promoted since.
refs/deploy/last-promoted still points at 8687258 (#945, 2026-09-01), so
everything merged in the last two days is built and verified but never live.
Verified both --scope forms against the API: the team slug and the team id in
VERCEL_ORG_ID each resolve to cacheplane. Use the existing secret rather than
hardcoding a slug, and guard it so an unscoped promote cannot return.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
blove
added a commit
that referenced
this pull request
Sep 3, 2026
…untime (#983) The deploy job re-runs the ordinary Website suite against production with only BASE_URL set, and #982 let that step run for the first time since the custom-target specs landed. Two failure clusters surfaced, both invisible to PR CI by construction because only the push-only deploy job runs the suite against a remote origin: - Twelve custom-runtime-target cases dial a fixture runtime on 127.0.0.1:4399 and the local example apps. Those exist only because the Playwright config starts them, and it starts nothing when BASE_URL is set, so every case failed with ECONNREFUSED after the site had already promoted. The config now ignores the fixture-driven specs whenever it starts no local server, including production-smoke mode. - The reduced-motion check held the runtime in its configuring state by refusing http://localhost:4300. Against the deployed site the frame loads from the production runtime origin, the handshake completes within half a second, and the loader is gone before the assertion. The route now matches the runtime frame by the session params Run mode stamps on every runtime URL, which holds the loader on screen locally and in production alike. Verified by running the full suite against https://threadplane.ai exactly as the deploy step does: 105 passed, 0 failed (was 104 passed, 13 failed). Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Production promotion fails on
main:vercel build,deployandpullread the team from.vercel/project.json.promotetakes a bare deployment URL and cannot — it falls back to the token's default team, which is a personal one, notcacheplane.Both promote calls were introduced without
--scopein #963, so neither the Website nor the cockpit redirect service has ever promoted since.refs/deploy/last-promotedstill points at86872580(#945, 2026-09-01): everything merged in the last two days is built and verified, but never went live.Verification
Promote verified Website artifact unchangedwith every prior step green — includingVerify Website preview runtime embedding policy, which passed for the first time thanks to ci: give the Website preview verification a Vercel automation bypass #974's bypass.--scopeforms against the live API: the team slugcacheplaneand the team id inVERCEL_ORG_IDeach resolve correctly. Used the existing secret rather than hardcoding a slug.vercel promotecarries--scope; mutation-probed by removing it, which fails two tests.ci-workflow.spec.mjs: 37/37.Note
This is the fourth defect in the same family tonight: a failure path that only exists after merge. PR CI never runs the deploy job, so an unscoped
promotecould not be caught beforemain.🤖 Generated with Claude Code