CI/CD after an AI builder (2026)

Citation-ready definition: CI/CD after an AI builder in 2026 is a company-owned ship path that runs with the builder pane closed. Org Git holds the tree. Protected `main` requires checks on a pull request. A named host deploys from that merge. Smoke proves the URL. Rollback is a prior artifact you can point at. Clicking Publish in Lovable, Bolt, Replit, Cursor, v0, or Softgen is not that path.

The expensive 2026 miss is rarely “we never added a workflow file.” It is “we added a YAML, then kept clicking Publish from the canvas.” A green check on a personal repo hides that gap. A locked laptop, a revoked builder login, or a Friday outage will not. Green CI is not production. A preview URL is not a host you can name. A chat-triggered deploy is not a train.

This article is the delivery train after any AI builder. It expands the short clipboard on CI/CD checklist. It is not the org-Git proof on GitHub handoff after an AI builder, not the Replit host cutover on leave Replit for a production host, not the row proof on Supabase hardening, not the timing colors on when to leave an AI builder, and not the layer marks on rewrite vs harden. Those pages stay seats, the process host, RLS, the clock, and stay-or-scrap. This page is whether a change can leave a pull request and land on a host you admin — without opening the builder. Soft CTA: when the train and the pane still look the same, book.

Use the short landers for punchy lists. CI/CD checklist is the gates. GitHub handoff is the org remote. Ship checklist is the release ritual after the train exists. Production-ready is the operating contract. The vibe coding hub maps tool exits. This long-form essay stays the pipeline.

A Publish click is not a pipeline

Builders are paid to make tonight live. A pipeline is paid to ship when the founder is offline. Those jobs collide. A green Publish button feels finished. The company is unfinished if the next change still needs that tab.

Vendor docs already draw the line. Lovable’s deployment and ownership page says start on Lovable, sync Git, and move a part only when you hit a real constraint. Git sync keeps code in a repo you own. External hosting is blunt: once Git is connected, each push to GitHub can trigger a new production deploy on a host you pick — and you copy env yourself. Bolt’s project lifecycle ends at Publish. GitHub for version control is a backup. Bolt hosting is a `bolt.host` URL from the Publish menu. Replit’s Publish your app is a snapshot on a `.replit.app` URL. Editor changes do not replace that snapshot until you republish.

v0 is the cleanest sentence in that class. Once a repo is connected, GitHub is the source of truth. Publish on a GitHub-backed chat creates or reuses a pull request, merges it, and waits for the production deploy. v0 deployments still let a chat without GitHub Publish straight to Vercel. Cursor’s GitHub app is for Cloud Agents and Bugbot. It can watch checks. It is not the train. Softgen’s GitHub integration invites you as a collaborator. A collaborator seat is not a company workflow.

Five Publish patterns get treated as CI/CD. They are not:

1. A workflow file that nobody requires. A YAML in `.github/workflows` is a file. Protected branches exist so a named check must pass before `main` moves. Without that rule, the next merge is folklore.
2. A host that still deploys from the canvas. Lovable hosting, `bolt.host`, `.replit.app`, or a v0 Publish with no Git still skip the pull request.
3. Secrets that still live in the pane. GitHub Actions secrets are encrypted values the runner reads. A builder drawer every editor can open is not that.
4. A preview that reused production keys. Config shape should match. Credentials must not.
5. A green check with no rollback. Green means the suite passed. It does not mean you can point the domain at last Tuesday.

None of that is a reason to rewrite the screens. Users already accepted those flows. It is a reason to stop buying ads until a second person can open a pull request, watch the required check, and see a named host ship — with every builder closed. If you cannot name that person, that host, and that rollback, mark the host/CI layer on rewrite vs harden. If the gap is the org remote, leave this page and open GitHub handoff.

Ownership map — name a human on every row

A pipeline has owners. Logos do not count. Write a name next to workflows, secrets, environments, the host, deploy keys, and rollback. If two rows share the founder, you do not have a train. You have a laptop with extra files.

GitHub is plain about the two controls that matter after the file exists. Protected branches can require a status check before merge. Using secrets stores values at repo, org, or environment scope. Environments add reviewers and wait timers. A job that names `environment: production` does not start — and cannot read those secrets — until the rules pass. Deploying with GitHub Actions is that gate, not a Publish menu.

GitLab is the same idea with different nouns. CI/CD pipelines live in `.gitlab-ci.yml`. Stages run in order. Jobs in a stage run together. A later stage waits. If a test job fails, deploy does not start. That is a train. A builder Publish is not.

Write the names on paper this week. Workflows: who can merge a change to the YAML. Secrets: who can rotate a key without opening Lovable or Replit. Environments: who approves production. Host: which company account holds the project. Rollback: who can promote yesterday. Soft CTA: if two of those names are blank and traffic is close, book.

Builder Publish vs org CI

Score the path, not the logo. A connected repo can still ship from the pane. An org repo can still skip required checks. Mark the cell you are in. Then move one cell, not five.

Hosts already expect Git, not a canvas. Vercel’s Git deployments make a preview for every pull request and a production deploy when you merge the production branch. Environments split preview and production variables. Promoting a deployment can move a prior build without a rebuild. Netlify’s Git workflows can require that production only comes from a Git push. Deploy Previews give each pull request its own URL. Railway’s GitHub autodeploys can wait for CI so a red Actions run skips the deploy. Ship on merge is a push to `main` after that wait — not a Publish button. Fly’s GitHub Actions deploy stores `FLY_API_TOKEN` as an Actions secret and runs `flyctl deploy` on push to `main`.

Those pages assume you already picked a host. If the public origin is still Replit, stop here and open the Replit host cutover. This essay does not retell DNS. It asks whether that host waits for a check you own.

The week sequence

A pipeline without a week is a slogan. Split the work. Inventory first. Kill builder Publish last. Do not cancel the builder in day one. Do not buy ads while the pane is still the only ship path.

Day 0–1 is inventory. Write four facts. The public URL. The person who can ship tonight. The place secrets live. Whether `main` accepts a laptop push. If the remote is still personal, you are not ready for this page. Finish GitHub handoff. If the process still lives on Replit, finish the host cutover first. This sequence assumes org Git and a host you can name — or names them as the next two doors, not as essays you paste here.

Then protect `main`. GitHub’s branch protection is the rule: required checks must report `successful`, `skipped`, or `neutral` before merge. Give the job a unique name. Require that name. A second workflow with the same name will confuse the gate. Workflow syntax is the file. Events that trigger workflows should include `pull_request`. If you later add a merge queue, add `merge_group` too, or the required check never reports.

Then move secrets. Create them with Using secrets. Production values go in a production environment with a required reviewer. Preview values are a second set. Do not reuse the live key on a branch URL. Rotate anything that was pasted into Lovable, Bolt, Replit Secrets, a Cursor chat, or v0. A rotated key that still works in the builder pane means you missed a copy.

Then preview, then production, then kill. Preview is a URL per change on hosting you control. Production is a deliberate promote after smoke. Kill is the hard part: turn off canvas Publish, Bolt Update, Replit Republish, and v0 Publish-without-Git. If someone still ships from the pane after “CI exists,” the train failed. The CI/CD checklist is the short version of those gates. This page is the week you run them.

Evidence gates: green CI is not production

A check can pass and the product can still be a hostage. Collect evidence. Do not collect screenshots of a green badge.

Read the chart as a reservation, not a promise. Day 0 is cheap: if you cannot name the path, later days thrash. YAML days are check days. Secret days are rotation days. Preview days are host days. The last bar is the silent kill: more Publish clicks after you already knew the pane was the problem. Ranges are studio-observed operator days — not a bid and not a vendor SLA.

The pass is four proofs on one working day. A second person opens a trivial pull request. The required check goes green on a GitHub-hosted runner. The host shows a preview URL that is not the builder. After merge, smoke the production URL, then roll back once on purpose. If any of those four needs the founder’s builder login, stop. You have YAML. You do not have CI/CD.

Kill criteria — CI exists, Publish still ships

The train failed if any of these are still true after you said CI was done:

• Someone shipped this week by clicking Publish, Update, or Republish in Lovable, Bolt, Replit, or v0.
• `main` accepted a push that skipped the required check — or no check is required.
• Production secrets still exist in a builder pane, a chat, or git history.
• The public hostname still answers on `bolt.host`, `.replit.app`, Lovable hosting, or a v0 project that is not Git-backed.
• Nobody can name yesterday’s artifact or the person who would restore it.
• A hire still needs the founder to open the canvas to see a preview.

One of those is enough to call the week a miss. Five green badges are not a pass. Pause feature prompts that only ship from the pane. Finish the gate that failed. Then kill the click.

Builder notes stay facts, not a clone FAQ. Lovable can deploy from Git once sync exists — that is the door; canvas Publish is the thing you turn off. Bolt’s own lifecycle says GitHub plus your CI/CD tools. Replit Publish is a snapshot; Git is a different tool. v0 Publish on GitHub is already a merge. Use that. Do not keep a second Publish that skips the pull request. Cursor Cloud Agents can open pull requests. They do not replace required checks. Softgen export still starts as their repo plus your invite. Put the workflow on the company org after GitHub handoff.

FAQ

Does connecting GitHub in Lovable, Bolt, or v0 count as CI/CD?

No. Sync moves files. v0 even makes the connected repo the source of truth. That is good. It is not a required check, a secret vault, or a rollback drill. CI/CD starts when a pull request must go green on a runner you do not sit at, and a named host deploys from that merge. Connecting Git is a door on the GitHub handoff page. This page asks a different question: can you ship with the builder closed?

Is a green GitHub Actions badge production?

No. Green means the jobs you ran have passed. Production means a named host updated after that pass, smoke succeeded on the public URL, and yesterday’s artifact is still reachable. Railway’s Wait for CI exists because autodeploy would otherwise ship a red commit. Vercel and Netlify previews are not the production domain. Treat a badge as one gate, not the ship.

When should I kill builder Publish if CI already exists?

As soon as a second person has shipped a trivial pull request to the named host with every builder closed. If that proof is missing, you do not have CI yet — you have a file. Killing the click before the proof strands the journey. Leaving the click after the proof creates a second, quieter train. Kill it the same week as the proof.

Do I need GitHub Actions, or can GitLab and the host be enough?

You need a runner you do not sit at, a required gate on the default branch, and a host that respects that gate. GitHub Actions is the common path after a builder export. GitLab pipelines are the same shape. Some hosts add their own wait. None of them replace the rule that `main` cannot move on a red job. Pick one runner. Do not run two trains.

What is the minimum workflow after a vibe MVP?

Install from a lockfile on a hosted runner. Lint and typecheck. Run the smallest test that covers sign-in and the primary write. Give the job a unique name. Require it on `main`. Add a preview on the named host. Promote with a warm rollback. That is the CI/CD checklist. Size it to MVP reality. Do not add enterprise theater before those gates exist.

How is this different from leaving Replit or handing off GitHub?

GitHub handoff proves a company org owns the remote and a second human can merge. The Replit article proves the process answers on a host that is not Replit. This page proves the path between those two: pull request, check, deploy, smoke, rollback — without the builder pane. Do not paste those playbooks here. Open them when that is the actual gap.

Next steps

Inventory the current ship path. Write five owner names. Protect `main`. Land a workflow with a unique required job. Move secrets off the pane. Stand a preview. Gate production. Smoke. Roll back once on purpose. Then kill builder Publish. Pause any prompt that only ships from the hostage tab while a kill criterion is still true.

CodeCross LLC is an Austin-registered product studio (1606 Headway Cir STE 9212, Austin, TX). We help operators turn a converting preview into a train they can name: org Git, a required check, a host they admin, and a rollback someone else can run. The Austin app development company page is the studio brief. Austin mobile app development is the store-binary engagement if the next door is a signed build that still points at this builder. Company-level evidence lives on proof. When the pane and the pipeline still look the same, book a conversation.

The goal is not to punish vibe coding. It is to stop treating a Publish click as proof that the next change can live in that tab. CI/CD is a path you can run with the builder closed. Green is a gate. Production is a promote. Kill the click when the proof exists. Get those three right and most teams never need a second codebase.