PR Preview feature for CapRover

[asyncawaitpromise]

This pr has the goal of adding CapRover deployment flow to DEVx site work. It will allow PRs to preview their work on a staging environment, and on merge to main deploy to the main site. A cron job cleans up any orphaned PR previews.

[asyncawaitpromise]

Supabase env vars: preview apps need to point at something. Do they share the prod DB? A staging DB? This is a design question

[asyncawaitpromise]

steps for config in caprover (notes for myself)

CapRover GHCR Private Registry Setup

1. Create an org-level PAT (one-time, done by org owner)

1. Go to GitHub → Settings → Developer settings → Personal access tokens → Classic
2. Generate new token with only: read:packages
3. Add it as an org-level secret: org Settings → Secrets and variables → Actions → New secret
   • Name: GHCR_PAT

2. Add private registry in CapRover (one-time)

Cluster menu → Add Private Registry:

Field	Value
Username	org name (lowercase)
Password	the PAT created above
Domain	ghcr.io
Image Prefix	org name (lowercase)

Disable "Pushing New Images" CapRover only needs to pull.

Notes

• The push side (workflow → GHCR) already works via secrets.GITHUB_TOKEN, no changes needed
• Using a personal PAT risks breakage if that person leaves the org or rotates their token
• The PAT is read:packages only limited blast radius if leaked