Per-PR previews

Want the preview private to internal reviewers? Add a password gate per preview, share it in a sidechannel.

The trap to avoid first. App passwords are stored on the app, not on the channel — vibehost app password set from a PR workflow gates every channel of that app, including production. If you then forget to clear the password when the PR closes (or just merge a PR that ran this recipe), your production site is now password-gated. Never run app password set against your real production app from a PR workflow.

The fix: deploy PR previews to a dedicated preview-only app that nothing else publishes to. Channels of that app are still independent, but the password gate now sits on an app no end-user is supposed to hit anyway. Make this explicit at deploy time:

      - name: Deploy preview (separate app)
        env:
          VIBEHOST_TOKEN: ${{ secrets.VIBEHOST_TOKEN }}
          PR: ${{ github.event.pull_request.number }}
        run: |
          ~/.vibehost/bin/vibehost deploy ./dist \
            --app my-site-previews \
            --channel "pr-$PR" --json

      - name: Set preview-app password (once, gates ALL preview channels — OK)
        if: github.event.action == 'opened'
        env:
          VIBEHOST_TOKEN: ${{ secrets.VIBEHOST_TOKEN }}
          PR: ${{ github.event.pull_request.number }}
        run: |
          PW=$(echo "${{ secrets.PREVIEW_PASSWORD_SALT }}-pr-$PR" | sha256sum | cut -c1-12)
          echo "::add-mask::$PW"
          ~/.vibehost/bin/vibehost app password set "$PW" --app my-site-previews
          echo "Password (DM'd, not in logs): $PW"

Two notes on this shape:

• if: github.event.action == 'opened' — set the password once when the PR opens, not on every push. Rotating the password on each synchronize invalidates everyone's cookie and forces a re-prompt.
• Don't try to "clear the password on close" if the preview app is shared across PRs — another PR may still need the gate. The right cleanup is vibehost channel delete (already in the closed job); the password stays on the dedicated preview app, where it's the only thing it gates.

If you genuinely need per-PR password rotation, give each PR its own preview-app: --app my-site-pr-$PR. Heavier (one app row per PR), but the gate is then truly scoped to that PR — and vibehost app delete my-site-pr-$PR --force in the close hook removes the password along with everything else.

Monorepo with multiple deployable apps. Deploy each to its own channel:

    strategy:
      matrix:
        include:
          - app: docs-site
            dir: apps/docs/out
          - app: marketing
            dir: apps/marketing/dist

    steps:
      # ... checkout + build all apps ...
      - run: |
          ~/.vibehost/bin/vibehost deploy ${{ matrix.dir }} \
            --app ${{ matrix.app }} \
            --channel "pr-${{ github.event.pull_request.number }}"

Use paths-filter to skip apps that didn't change in the PR. See the monorepo recipe.

jobs:
  preview:
    if: github.event.action != 'closed' && github.event.pull_request.draft == false

Resumes auto-deploy when the author marks the PR ready for review.

You might want a different API_URL per preview (for any app that reads a runtime config endpoint):

      - name: Set preview env
        env:
          VIBEHOST_TOKEN: ${{ secrets.VIBEHOST_TOKEN }}
        run: |
          ~/.vibehost/bin/vibehost env set \
            API_URL="https://staging-api.example.com" \
            --app my-site \
            --target runtime

Caveat: env vars are per-app, not per-channel. To get per-PR env, use a dedicated "preview" app and deploy all PRs to it (each on its own channel, but sharing the env). For full per-PR isolation, separate apps per PR — but that's overkill in 99% of cases.