🐛 fix(deploy): anchor .vercelignore paths so merging to main stops shipping a 404

[scttbnsn]

Merging #17 fired the first Vercel git-integration production deploy this project has ever had. It went green, took the rolester.codeswhat.com alias, and served a 404. I restored the site by hand with a prebuilt deploy; this fixes the cause so merge-to-main deploys work, which is how this repo is supposed to ship.

Root cause

.vercelignore uses .gitignore semantics: a pattern with no leading slash matches at every depth. The bare src entry was meant to drop the CLI source at the repo root. It also matched website/src and docs-site/src.

From the broken build log:

Found .vercelignore (repository root)
Removed 315 ignored files defined in .vercelignore
...
Route (pages)
─ ○ /404

No Route (app) table, for either app. Next found no app directory because Vercel had deleted it, emitted a lone 404 page, exported that, and shipped it. The build never failed — it succeeded at building nothing.

15 files were deleted, including website/src/app/page.tsx, website/src/app/layout.tsx, and docs-site/src/app/[[...slug]]/page.tsx.

Why it stayed hidden

Every prior deploy was vercel deploy --prebuilt, which uploads the already-built output directory and never applies .vercelignore. The landmine was armed the day the file was written and only went off when a merge to main triggered a git build for the first time.

The fix

Anchor every product-internal path with a leading slash. The recursive patterns (node_modules, .next, out, *.tsbuildinfo) stay unanchored on purpose.

Verified with git ls-files -i -c -X .vercelignore, which uses the same semantics:

	app files removed	root internals excluded
before	15	525
after	0	525

The test change

tests/release-safety.test.mjs asserted the exact unanchored lines (^candidate$, ^.rolester$) as its privacy guard — so anchoring the paths broke it. That assertion is what pinned the bug in place. It now asserts the anchored form (same privacy intent: candidate/, .rolester/, workspace/ still never reach Vercel) and adds a regression check that the depth-matching bare forms cannot come back.

I confirmed the new assertion fails against the old .vercelignore before keeping it, so it is a real guard and not a rubber stamp.

Verification

• git ls-files -i -c -X .vercelignore → 0 files removed from website/ or docs-site/
• node --test tests/release-safety.test.mjs → 6/6, and 1 failure when pointed at the old file
• The Vercel preview build on this PR is the live proof: its log should now show a Route (app) table with / rather than a lone /404. Checking that before merge.

Note

I am not disabling git deploys. Merge-to-main should deploy — that is the point. This makes it actually work.

🐛 Fixed

• Anchored product-internal entries in .vercelignore with leading / so root-only paths no longer match nested directories like website/src or docs-site/src.
• Updated the release-safety test to assert the anchored Vercel ignore patterns and reject the old unanchored forms at multiple depths.

🔧 Changed

• Added .vercelignore documentation clarifying .gitignore-style matching semantics for unanchored patterns.

• Kept recursive ignore patterns unanchored where depth-wide matching is intended.

• Verify any other root-adjacent paths in .vercelignore still use the intended matching behavior.

• Keep the release-safety test aligned with future .vercelignore edits to prevent regressions.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
rolester-website	Ready	Preview, Comment	Jul 9, 2026 10:01pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b67044bf-ca61-4c48-b4d4-e8d7a5a28555

📥 Commits

Reviewing files that changed from the base of the PR and between db381e4 and 5d12b08.

📒 Files selected for processing (2)

• .vercelignore
• tests/release-safety.test.mjs

---

📝 Walkthrough

Walkthrough

Updated .vercelignore comments to document .gitignore-style matching semantics. CLI, product-internal directories, and selected documentation files are now root-anchored. Release-safety tests verify expected anchored entries and reject unanchored matches for common directory names at multiple depths.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/vercelignore-anchor-root-paths

---

_{Comment @coderabbitai help to get the list of available commands.}

[biggest-littlest]

Verified the root cause independently: git ls-files -i -c -X .vercelignore on the old file lists website/src/app/page.tsx and docs-site/src/app/[[...slug]]/page.tsx among the removals, and the broken build log has no Route (app) table. The preview build on this branch now shows ┌ ○ /. Test change keeps the privacy intent (anchored /candidate, /.rolester, /workspace) and adds a real regression guard. Ship it.

[ALARGECOMPANY]

Good root-cause fix rather than turning off deploys.