Skip to content

0013: Apply Production migrations in the Vercel build

Keep Production credentials in Vercel and verify readiness through GitHub

  • Status: Accepted
  • Date: 2026-09-30
  • Decision maker: Trevor Gerhardt

Context

The Production migration workflow pulled Vercel environment values into GitHub Actions. Vercel replaced Secret values with redacted placeholders. The workflow accepted those placeholders as credentials and failed with a generic deployment error.

Decision

The Concourse app applies Production migrations in an uncached task before its Vercel application build. The task reads supplied configuration only and runs only for the Production build target. It uses the existing Persistence migration API and closes the database after every outcome. Migration files participate in the affected-build decision.

GitHub validates the dispatch and checkout, then checks the exact deployment's readiness response. It reads no Production database credentials. The existing commit-status name remains compatible with configured Vercel Deployment Checks.

Preview keeps its migration, native Turso proof, seed, and administrator bootstrap sequence in GitHub before deployment. These steps require a migrated database before the Preview build begins.

The deployment guide owns configuration and recovery procedures.

Consequences

  • Production database credentials stay in Vercel. GitHub does not pull them or hold a second copy.
  • Migration failure prevents a successful build. Cached application outputs cannot skip migration execution.
  • A completed migration remains applied if the application build or promotion check later fails.
  • Migrations must support the currently serving version and the selected rollback version.
  • Schema history remains owned by Persistence. This change does not reset an existing database or repair an incompatible baseline.

References