[Chore] CI never builds or verifies the actual Vercel deploy path

[collinsezedike]

Summary

Nothing in CI actually runs scripts/build-vercel.sh, the literal command Vercel executes to build every production deployment. CI builds apps/api-local and typechecks api/, but never exercises the real deploy path end to end.

Motivation

This gap is not theoretical: it already caused a production incident. packages/api-core was added and wired into every api/v1/* handler, but never added to build-vercel.sh's esbuild bundling step, so every Vercel serverless function importing it threw ERR_MODULE_NOT_FOUND in production (fixed in #398). Nothing in CI would have caught this before it shipped, because nothing in CI runs the script that actually builds for Vercel.

Proposed Solution

Add a CI job (or a step in the existing lint-typecheck job) that runs bash scripts/build-vercel.sh on every PR and fails if it errors, so a missing workspace-bundle step or similar build breakage is caught before merge instead of in production. At minimum, the job should assert that every workspace package imported by api/v1/* handlers has a corresponding dist/index.js produced by the script.

Scope

Field	Value
Area	CI
Protocol affected	None
Network	N/A
Breaking change?	No

Alternatives Considered

Relying on manual review to catch missing bundle steps: already demonstrated to fail once; the reviewer (and the author) both missed it because nothing surfaced the gap until Vercel's runtime logs did.

Acceptance Criteria

• CI runs scripts/build-vercel.sh (or an equivalent check) on every PR touching api/, packages/api-core, packages/shared, or packages/stellar-sdk-helpers
• The check fails if any workspace package imported by an api/v1/* handler doesn't have a bundled dist/index.js after the script runs
• Verified by intentionally reverting the fix(build): bundle api-core for the Vercel serverless runtime #398 fix locally and confirming the new CI check fails

Additional Context

See #398 for the incident and fix.

[blockchain-maxis]

Hi, I would like to work on this issue. I will add a CI job that runs scripts/build-vercel.sh on every PR touching api/, packages/api-core, packages/shared, or packages/stellar-sdk-helpers, and follows it with an assertion step that checks every workspace package imported by api/v1 handlers has a corresponding dist/index.js produced by the script so a missing bundle step fails the PR before it reaches Vercel. I will verify the check works correctly by locally reverting the fix from issue 398 and confirming the new CI job fails as expected, then restore the fix before submitting so the check is proven to catch the exact class of incident it is designed to prevent. I will also add a brief comment in the workflow file explaining why this job exists and referencing issue 398 so future contributors understand the motivation and do not remove it without understanding the risk. Can I be assigned?

[grantfox-oss]

🦊 GrantFox — @blockchain-maxis has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #401)
2. Your PR will be reviewed by the drydocs maintainers

Good luck! Track your progress on GrantFox.

[collinsezedike]

Hey @blockchain-maxis, checking in since this issue has been open a week with no activity yet. Are you still planning to work on it?

If you're stuck on anything, let me know and I can help.

If you're no longer able to take it on, let me know and I'll pass it to someone else.