Establish the source of truth
Store public-safe site source, articles, assets and build configuration together. Keep internal operations notes, secrets and private infrastructure records in a separate restricted repository. A private source repository can still generate a public website.
Choose the production branch deliberately. Do not enable automatic production deployment before the review and release policy is understood.
Validate a candidate
- Build from the locked dependency versions in a clean workspace.
- Run link, navigation, accessibility and mobile-layout checks.
- Review article accuracy, image rights, metadata and public-data exposure.
- Deploy only to an approved preview audience; a hard-to-guess URL is not access control.
- Record the commit, build result, review and remaining limitations.
Publish and verify
An authorized release operator publishes the reviewed artifact. After deployment, read the actual production domain: check HTTPS, representative pages, assets, redirects, headers and the failure page. Confirm that unrelated domain records were preserved.
Retain the previous successful deployment and a documented rollback procedure. Practice recovery in staging before treating rollback as proven.