Hosting

The app has never been anywhere but a laptop. Nobody outside the room has seen it, and a pull request is reviewed by reading a diff and trusting it.

This epic puts the build somewhere with a name, and gives every pull request a URL a person can open before they approve it. It adds no feature. The only thing it changes in src/ is a version stamp in the nav rail, so that a site you are looking at can say which build it is.

Definition of done for the epic

• A merge to main publishes the live site, after the existing checks pass and never before them
• Every open pull request has a working preview at a URL derived from its issue key
• A preview disappears when its pull request closes, whether it merged or not
• Publishing production never disturbs a preview, and publishing a preview never disturbs production
• No long-lived AWS credentials exist in the repository, none sit on a laptop after the first deploy, and no account-specific value is hardcoded in a workflow
• Infrastructure is applied by a workflow, and a pull request that changes it shows a changeset before anybody approves it