ci: label-gated hosted-web preview deploys

[t3dotgg]

Testing client-only web changes today means running the whole stack locally or waiting for a release. Anything visible on app.t3.codes had no per-PR preview.

This adds a `preview:web` label that, when applied to a same-repo PR, deploys the web app to Vercel on that push and every subsequent push. The deploy is a plain non-prod, non-aliased deployment into the existing hosted-web project, so the `latest`/`nightly` channel aliases are never touched. A sticky PR comment carries the deployment URL.

How it fits the existing architecture:

• The hosted app is already a pure static SPA with no backend proxy. `apps/web/vite.config.ts` already derives `VITE_HOSTED_APP_URL` from `VERCEL_URL` on non-production deploys, so a preview self-identifies as the hosted-static app at its own unique URL with zero build-config changes.
• Previews omit the T3 Connect cloud config (Clerk/relay), so they boot into manual pairing. The intended flow: spin up a server, run `t3 pair --tailscale`, open the pairing URL against the preview origin (or paste host + code in Settings → Connections). Packaged servers already send wildcard CORS, and HTTPS/WSS over Tailscale Serve satisfies mixed-content rules.
• Label-gating keeps Vercel build volume sane and restricts secret-bearing deploys to deliberate opt-ins; fork PRs are skipped entirely.

Caveats:

• The preview must be opened at the exact deployment URL from the comment (the hosted origin is baked in at build time).
• If the Vercel project has Deployment Protection enabled for previews, the URLs will be gated behind Vercel SSO — that's a project-settings toggle, not something this workflow can change.

The `preview:web` label has been created on the repo.

---

Written by Claude Fable 5 via Claude Code.

🤖 Generated with Claude Code

---

Note

Low Risk
CI-only, opt-in via label; deploys are non-prod and unaliased, reusing existing Vercel secrets with no application code changes.

Overview
Adds a preview:web GitHub Actions workflow so same-repo PRs can get a per-push hosted-web deployment on Vercel without touching latest/nightly aliases.

The job runs only when the label is present (including on later pushes), skips fork PRs, checks out the PR head, installs @t3tools/web, and runs a plain vercel deploy (no --prod, no channel build-env for Clerk/relay). It upserts a sticky PR comment with the exact deployment URL and pairing instructions. Concurrency is per-PR with cancel-in-progress.

^{Reviewed by Cursor Bugbot for commit 672e454. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add label-gated Vercel preview deploys for web PRs

Adds a new web-preview.yml GitHub Actions workflow that deploys a Vercel preview when a same-repo PR has the preview:web label. After deployment, it posts or updates a PR comment with the deployment URL for the current head SHA. Concurrency is scoped per-PR to cancel stale runs, and permissions are limited to contents read and pull-requests write.

^{Macroscope summarized 672e454.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8d70708a-6175-45c9-a91e-3c3965894efc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 672e454. Configure here.}

[cursor]

Unrelated labels cancel preview deploys

Medium Severity

Workflow-level concurrency with cancel-in-progress takes the slot before the job if runs. Unrelated labeled events (for example size labels from pr-size.yml) cancel an in-flight preview deploy, then the new run skips because the label is not preview:web, so no deploy finishes and the sticky URL is left missing or stale. The sibling mobile preview workflow keeps the same label gate but puts concurrency on the job so skipped runs never enter the group.

Additional Locations (1)

• .github/workflows/web-preview.yml#L35-L39

 

^{Reviewed by Cursor Bugbot for commit 672e454. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR adds a CI workflow for label-gated preview deployments. While the change is low-risk (preview only, no production impact), there's an open review comment identifying a concurrency bug that could cause preview deploys to be canceled by unrelated label events, which should be addressed.

^{You can customize Macroscope's approvability policy. Learn more.}