This build

What is running here, and how it got here

Every deployment to this site is a tagged release. Nothing reaches it by hand.

How a change reaches this site

1. Work is agreed in the delivery workspace — a brief, acceptance criteria and a due date, with AI agents doing the implementation and an independent QC pass.
2. Gates — the working tree must be clean, main must match the remote, and the test suite must pass. A failure stops the release; nothing is deployed.
3. A tag is cut (v*-demo) and pushed. The tag is the only thing this site will run.
4. GitHub Actions builds and deploys over a restricted connection that accepts nothing but "deploy this tag".
5. The deployment verifies itself — it checks this page's own health endpoint reports the expected commit, then smoke-tests sign-in. If either fails, the release is marked failed.
6. The result is recorded as a GitHub Release, so every deployment has a written trail.

Rolling back means redeploying an earlier tag. It rebuilds the image, so recovery takes minutes rather than seconds — a deliberate trade for having one path in.

Machine-readable version of this page · What is this? → · How it works