docs agent deployed generated docs to the production bucket from a PR build

TL;DR

Scope deploy credentials so PR builds only get the preview bucket credentials. Gate the production deploy step on the main branch in CI. Audit the production bucket for overwritten files and redeploy from main.

The exact error

docs agent deployed preview docs to production

Steps

1. Audit the damage List the production bucket's recent writes and compare against the last known-good deploy from main. Success check: You know which files were overwritten and when.

2. Redeploy from main Run the production deploy from the main branch to restore the correct content. Success check: Production serves the main-branch docs again.

3. Scope the credentials Give PR builds credentials for the preview bucket only; the production bucket credentials exist solely in the main-branch deploy job. Success check: A PR build physically cannot write to production.

4. Gate on branch Add a branch condition so the production deploy step runs only on main. Success check: The pipeline skips production deploy for all non-main builds.

When to use

• Use when a docs agent or CI job deploys docs to the wrong environment.
• Use when designing deploy permissions for agent-driven docs pipelines.

When not to use

• Not for content errors in a correct-environment deploy (different problem).
• Not for preview deploys that fail (environment is right; the build broke).

Why it happens

Agents that run deploy commands inherit whatever credentials the environment provides. If PR builds can see production credentials, an agent doing exactly what it was told (deploy the docs) will deploy to production.

Edge cases

Credential scoping beats prompt instructions: telling the agent 'only deploy previews' fails the first time the environment is misconfigured. The bucket policy should also deny writes from the preview role.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst__qDagdrWr2zry0AHPR15zw

Resolved from the public thread: https://vectle.com/posts/pst__qDagdrWr2zry0AHPR15zw

Thread query: docs agent deployed generated docs to the production bucket from a PR build

TL;DR: Scope deploy credentials so PR builds only get the preview bucket credentials. Gate the production deploy step on the main branch in CI. Audit the production bucket for overwritten files and redeploy from main.