Per-PR preview deploys with GitHub Actions

To keep a preview private to internal reviewers, add a password gate and share the password somewhere other than the PR.

Don't set the password on your production app. App passwords are stored on the app, not on the channel, so vibehost app password set from a PR workflow gates every channel of that app, including production. If you then forget to clear the password when the PR closes, or merge a PR that ran this recipe, your production site ends up behind the password. Never run app password set against your real production app from a PR workflow.

Instead, deploy PR previews to a dedicated app that nothing else publishes to. Its channels are still independent, and the password gate sits on an app no end user is supposed to open anyway. Name that app explicitly at deploy time:

      - name: Deploy preview (separate app)
        env:
          VIBEHOST_TOKEN: ${{ secrets.VIBEHOST_TOKEN }}
          PR: ${{ github.event.pull_request.number }}
        run: |
          ~/.vibehost/cli/vibehost deploy ./dist \
            --app my-site-previews \
            --channel "pr-$PR" --json

      - name: Set preview-app password (once, gates ALL preview channels — OK)
        if: github.event.action == 'opened'
        env:
          VIBEHOST_TOKEN: ${{ secrets.VIBEHOST_TOKEN }}
          PR: ${{ github.event.pull_request.number }}
        run: |
          PW=$(echo "${{ secrets.PREVIEW_PASSWORD_SALT }}-pr-$PR" | sha256sum | cut -c1-12)
          echo "::add-mask::$PW"
          ~/.vibehost/cli/vibehost app password set "$PW" --app my-site-previews
          echo "Password (DM'd, not in logs): $PW"

Two things to note:

• if: github.event.action == 'opened' sets the password once, when the PR opens, not on every push. Changing the password on each synchronize invalidates everyone's cookie and makes them enter it again.
• Don't clear the password on close if the preview app is shared across PRs, because another PR may still need the gate. vibehost channel delete in the closed job is the cleanup you need. The password stays on the dedicated preview app, which is all it gates.

If you need a different password for each PR, give each PR its own preview app with --app my-site-pr-$PR. That costs one app per PR, but the gate then covers only that PR, and vibehost app delete my-site-pr-$PR --force in the close hook removes the password along with everything else.

In a monorepo with several deployable apps, deploy each one to its own channel:

    strategy:
      matrix:
        include:
          - app: docs-site
            dir: apps/docs/out
          - app: marketing
            dir: apps/marketing/dist

    steps:
      # ... checkout + build all apps ...
      - run: |
          ~/.vibehost/cli/vibehost deploy ${{ matrix.dir }} \
            --app ${{ matrix.app }} \
            --channel "pr-${{ github.event.pull_request.number }}"

Use paths-filter to skip apps that didn't change in the PR. See the monorepo recipe.

jobs:
  preview:
    if: github.event.action != 'closed' && github.event.pull_request.draft == false

Previews start deploying again when the author marks the PR ready for review.

An app that reads a runtime config endpoint might need a different API_URL for each preview:

      - name: Set preview env
        env:
          VIBEHOST_TOKEN: ${{ secrets.VIBEHOST_TOKEN }}
        run: |
          ~/.vibehost/cli/vibehost env set \
            API_URL="https://staging-api.example.com" \
            --app my-site \
            --target runtime

Env vars belong to the app, not the channel. To get per-PR env, use a dedicated "preview" app and deploy all PRs to it, each on its own channel but sharing the env. Full per-PR isolation takes a separate app per PR, which is more than almost any team needs.