Inject Netlify VITE_* env into the GH Actions deploy build

[borland667]

Summary

PR #1 moved the production build into GitHub Actions but inadvertently regressed the frontend env injection: npm run build in CI runs without Netlify's project env, so the deployed bundle was shipped with empty VITE_POSTHOG_KEY, VITE_ANALYTICS_ENABLED, VITE_ANALYTICS_PROVIDER, VITE_POSTHOG_HOST, and VITE_GOOGLE_CLIENT_ID. Result: PostHog analytics were silently dead in production.

Verified by grep-ing the live index-CB3pNDaH.js bundle for the configured PostHog key — not present, despite the Netlify project env having it set.

Fix

Use netlify deploy --prod --build instead of npm run build + netlify deploy --dir dist. The --build flag invokes netlify build, which loads Netlify's project env into the Vite build process so all VITE_* values are baked into the bundle.

Source of truth for env stays where it should be:

Env scope	Where it lives	How it reaches code
Frontend (VITE_*)	Netlify project env	netlify build injects at build time
Backend runtime	Netlify project env	Netlify Functions injects at request time
GH Actions auth	GH repo secrets	Only NETLIFY_AUTH_TOKEN, NETLIFY_SITE_ID, PRODUCTION_DATABASE_URL

What this also cleans up

• Removed explicit db:generate step — already covered by the postinstall hook that runs npx prisma generate after npm ci.
• Removed explicit Build site step — folded into netlify deploy --build.
• ARCHITECTURE.md §15.4: updated the pipeline contract, added explicit notes that --build and --skip-functions-cache are both mandatory, and noted Netlify's git auto-deploy is disabled (stop_builds: true).

Test plan

• YAML parses cleanly (steps: checkout → setup-node → install → deploy → smoke check)
• On merge: deploy-production job goes green
• Live bundle contains the PostHog key (grep for SStrVZFix)
• PostHog dashboard receives events from the deployed site

Made with Cursor