Harden Vercel deployment with credential validation

Author: Ashutosh-code-arch

.github/workflows/deploy.yml

@@ -67,17 +67,38 @@ jobs:
         needs: typecheck
         if: github.ref == 'refs/heads/main' && github.event_name == 'push'
         runs-on: ubuntu-latest
+        env:
+            VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+            VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
+            VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
 
         steps:
             - uses: actions/checkout@v5
             - uses: actions/setup-node@v5
               with:
                   node-version: "24"
             - name: Install Vercel CLI
-              run: npm install -g vercel
-            - name: Deploy
+              run: npm install --global vercel@59.1.3
+            - name: Validate Vercel credentials
+              run: |
+                  if [[ -z "$VERCEL_TOKEN" ]]; then
+                      echo "::error::The VERCEL_TOKEN GitHub Actions secret is missing."
+                      exit 1
+                  fi
+                  if [[ -z "$VERCEL_ORG_ID" ]]; then
+                      echo "::error::The VERCEL_ORG_ID GitHub Actions secret is missing."
+                      exit 1
+                  fi
+                  if [[ -z "$VERCEL_PROJECT_ID" ]]; then
+                      echo "::error::The VERCEL_PROJECT_ID GitHub Actions secret is missing."
+                      exit 1
+                  fi
+            - name: Pull Vercel production configuration
+              working-directory: ./frontend
+              run: vercel pull --yes --environment=production --token="$VERCEL_TOKEN"
+            - name: Build Vercel artifacts
+              working-directory: ./frontend
+              run: vercel build --prod --token="$VERCEL_TOKEN"
+            - name: Deploy Vercel artifacts
               working-directory: ./frontend
-              run: vercel --prod --yes --token=${{ secrets.VERCEL_TOKEN }}
-              env:
-                  VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
-                  VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
+              run: vercel deploy --prebuilt --prod --token="$VERCEL_TOKEN"