@@ -2,7 +2,7 @@
 title: "How to host a test version of your app without replacing production (2026)"
 slug: "host-a-test-version-without-replacing-production"
 date: "2026-10-15"
-updatedAt: "2026-10-31"
+updatedAt: "2026-11-03"
 authors:
   - "Gregory Boch"
 metaTitle: "Host a test version without replacing production: previews and staging (2026)"
@@ -121,6 +121,8 @@ Coding assistants such as Claude Code, Codex, Cursor or GitHub Copilot fit the p
 
 Two more details matter with an assistant. Give it credentials that reach previews, not production: preview-scoped environment variables, and API tokens limited to non-production resources. And check that your host builds previews for pull requests a bot opens; on some hosts that is a separate setting.
 
+If your production deploy runs as a GitHub Actions job, a [GitHub deployment environment](https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments) with required reviewers, self-reviews prevented and administrator bypass turned off can gate the deploy itself: a job that references the environment waits until a reviewer other than the person who started it approves. Keep the production deploy credentials in that environment, not in repository secrets, because a job gets environment secrets only after that approval. On GitHub Free, Pro and Team, required reviewers work only in public repositories, so a private repository needs GitHub Enterprise.
+
 On Prisma Compute, an [enrolled coding agent](https://www.prisma.io/docs/prisma-compute/agent-enrollment) gets its own Prisma credential: by default it works on preview branches and asks you before it changes production through the Prisma API. That policy does not cover the deploy workflow, so a push to the default branch still deploys production, and the branch protection from step 1 still decides what reaches it. Nor does it cover a Prisma CLI session you are signed in to on the same machine, or a database connection string the agent can already read, such as `DATABASE_URL` in your `.env` file: with one of those, the agent connects to the database directly. To make the policy the only way the agent reaches Prisma, sign out of the Prisma CLI while the agent works.
 
 ## How to do it on common hosts
@@ -156,13 +158,13 @@ A 6.5-minute walkthrough of this workflow on Prisma Compute and Prisma Postgres:
 - **Staging:** every project starts with a `production` environment, and Railway's docs describe a persistent `staging` environment that auto-deploys from a `staging` branch, with its own variables, as a common pattern.
 - **Database:** Railway's Environments page does not say what data a PR environment's database starts with, so check before you test destructive changes.
 
-### Render
+### Render preview environments and staging [#render]
 
 - **Test version:** preview environments, on a Pro workspace plan or higher, copy the services, datastores and environment groups defined in your Blueprint (`render.yaml`) for each pull request (in manual mode, only for pull requests whose title includes `[render preview]`), and delete the copy when the pull request is merged or closed. Set a `previewValue` on environment variables that hold production values, such as an API key, so the preview uses a test value, and check which environment groups the preview copies. Service previews instead create a temporary instance of a single service per pull request, at its own `onrender.com` URL; the instance copies the base service's settings, including environment variables such as database connection information, so change those on the preview instance.
 - **Database:** datastore copies in a preview environment do not include data from the production resource; Render's docs suggest seeding sample data while the preview environment initializes.
 - **Staging:** a Render project can hold separate environments such as staging and production, with environment-scoped variables and, on a Pro workspace or higher, an option to block private network traffic between environments. Hobby workspaces can have up to two environments per project.
 
-### Vercel
+### Vercel preview deployments and staging [#vercel]
 
 - **Test version:** by default Vercel creates a preview deployment when you push to a branch other than the production branch, open a pull request on GitHub, GitLab or Bitbucket, or run `vercel` without `--prod`. Each preview has a branch URL, which follows the latest commit on the branch, and a commit URL.
 - **Staging:** a `staging` Git branch with an assigned domain works on all plans, including Hobby; Custom Environments such as `staging` or `QA`, with their own branch tracking, domain and variables, are available on Pro and Enterprise.
@@ -209,7 +211,7 @@ Pick by what a preview includes by default and where its database comes from. Fl
 | Vendor | Pages |
 | --- | --- |
 | Fly.io | [Git branch preview environments on GitHub (review apps)](https://docs.fly.io/blueprints/review-apps-guide/), [Staging and production isolation](https://docs.fly.io/blueprints/staging-prod-isolation/), [Create an app with fly launch](https://docs.fly.io/launch/create/) (checked 2026-10-24) |
-| GitHub | [About protected branches](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches), [About rulesets](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets), [GitHub's plans](https://docs.github.com/en/get-started/learning-about-github/githubs-plans), [Approving a pull request with required reviews](https://docs.github.com/en/pull-requests/how-tos/review-pull-requests/approving-a-pull-request-with-required-reviews), [Review output from Copilot](https://docs.github.com/en/copilot/how-tos/copilot-on-github/use-copilot-agents/review-copilot-output) (checked 2026-10-16) |
+| GitHub | [About protected branches](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches), [About rulesets](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets), [GitHub's plans](https://docs.github.com/en/get-started/learning-about-github/githubs-plans), [Approving a pull request with required reviews](https://docs.github.com/en/pull-requests/how-tos/review-pull-requests/approving-a-pull-request-with-required-reviews), [Review output from Copilot](https://docs.github.com/en/copilot/how-tos/copilot-on-github/use-copilot-agents/review-copilot-output), [Deployments and environments](https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments) (checked 2026-10-16; deployments and environments and GitHub's plans 2026-11-02) |
 | Neon | [Integrating Neon with Vercel](https://neon.com/docs/guides/vercel-overview), [Vercel-Managed Integration](https://neon.com/docs/guides/vercel-managed-integration), [Neon-Managed Vercel Integration](https://neon.com/docs/guides/neon-managed-vercel-integration), [Branching](https://neon.com/docs/introduction/branching) (checked 2026-10-25) |
 | Netlify | [Deploy Previews](https://docs.netlify.com/deploy/deploy-types/deploy-previews/), [Branch deploys](https://docs.netlify.com/deploy/deploy-types/branch-deploys/), [Netlify Database](https://docs.netlify.com/build/data-and-storage/netlify-database/) (Deploy Previews checked 2026-10-25) |
 | Prisma | [Deploy on push: preview and staging environments per Git branch](https://www.prisma.io/docs/compute/deploy-on-push), [Compute known limitations](https://www.prisma.io/docs/compute/limitations), [Compute FAQ](https://www.prisma.io/docs/compute/faq), [Enroll your coding agent](https://www.prisma.io/docs/prisma-compute/agent-enrollment) (checked 2026-10-26; deploy on push 2026-10-30) |
@@ -230,3 +232,4 @@ Pick by what a preview includes by default and where its database comes from. Fl
 - 2026-10-28: the "Which host fits your app" table now comes right after the opening answer, before "The options at a glance", and the opening answer lists how each host starts a preview as one bullet per host. No vendor detail changed; the Prisma Compute cells were checked against Prisma's deploy-on-push docs on 2026-10-28.
 - 2026-10-29: the Prisma Compute setup line now says the app needs a Prisma Composer declaration today and that deploying an existing repository without a Composer file is planned for early 2027. Checked against Prisma's deploy-on-push docs and Compute FAQ on 2026-10-29.
 - 2026-10-31: the opening answer now names the six hosts in its second sentence and says that on several of them a preview first takes a setting, a workflow or a paid plan; the host FAQ now lists the hosts in alphabetical order and says that on Prisma Compute an app that reads `DATABASE_URL` is only as separate as that value; the "New database, migrations and a seed script" row now says what Prisma Compute and Render preview databases start with. Checked against Prisma's deploy-on-push docs and Render's preview environments docs on 2026-10-30.
+- 2026-11-03: the Render and Vercel host headings now say what each section covers, with the same anchors; the coding-assistant section now says that a GitHub deployment environment with required reviewers can gate a production deploy that runs as a GitHub Actions job when the deploy credentials are environment secrets, and that in a private repository this needs GitHub Enterprise. Checked against GitHub's docs on 2026-11-02.