Skip to content

SOP-003 — Deploy the intranet (Vercel)

Guide

SOP-003 — Deploy the intranet (Vercel)

Runbook · owner: Operations (Process Engineer) + Delivery. Decision: ADR-0008. Layer: SOP/Runbook (docs/canon.md).

Purpose

Get the static intranet live on Vercel, visible only to the Principal, kept in sync with the repo. The Principal does the account-level steps (1–3); an agent prepares the repo and verifies (4–5).

Principal steps (one-time, Vercel dashboard)

  1. New Project → Import {{github-user}}/{{project-slug}} (authorize the Vercel GitHub app for this repo only). Name it {{project-slug}}-intranet (matches astro.config.mjs site).
  2. Settings → Build: Framework Astro, Root Directory = intranet, Build npm run build, Output dist (defaults once root dir is set).
  3. Settings → Deployment Protection → Vercel Authentication = Standard Protection (All Deployments), before the first deploy finishes, so the site is never publicly visible. Confirm your account is a team member.

Agent steps

  1. Ensure the repo is deploy-ready: astro.config.mjs site set, npm run build green locally ([sync] … docs … + ~50 pages, no error reading ../).
  2. After deploy, verify (Vercel MCP): get_deployment READY; get_deployment_build_logs shows the sync line + page count; fetch the URL unauthenticated → expect the Vercel login interstitial (gate on), not the dashboard. Then update site to the real URL if different, and tag the first-product-slice milestone.

Deployment budget (ADR-0009)

Vercel Hobby allows 100 deployments/day. To stay well under:

  • Previews are off — only the production branch (main) deploys (intranet/vercel.json). Verify previews locally (npm run build) and via CI.
  • Path-gated builds — intranet/scripts/vercel-ignore.sh skips builds for commits with no portal-relevant change.
  • Batch pushes — promote to main once per session/milestone, not per commit. Each main push is a deploy; commit freely, push deliberately.

Guardrails

  • No secrets in the repo/bundle (security.md); Deployment Protection adds none.
  • No PA personal information is published (confidentiality.md) — spot-check dist.
  • Re-deploys are automatic on repo changes (GitHub-connected).