fix: add --scope flag to Vercel CLI commands in production workflow

[amikofalvy]

Summary

• Fixes authorization error in Vercel production deployment workflow
• The vercel inspect and vercel promote commands were failing because VERCEL_ORG_ID as an env var isn't used by the CLI for scope resolution
• Added --scope=${{ secrets.VERCEL_ORG_ID }} to both commands

Context

Failed run: https://github.com/inkeep/agents/actions/runs/21695031954/job/62563333139

Error was:

Error: Not authorized: Trying to access resource under scope "andrew-mikofalvys-projects". 
You must re-authenticate to this scope or use a token with access to this scope.

Test plan

• Re-run the Vercel production deployment workflow after merge

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agents-api	Building	Preview, Comment	Feb 5, 2026 1:36am
agents-docs	Building	Preview, Comment	Feb 5, 2026 1:36am
agents-manage-ui	Building	Preview, Comment	Feb 5, 2026 1:36am

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4922639

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[claude]

Claude finished @amikofalvy's task in 1m 5s —— View job

---

PR Review Summary

1 Key Finding | Risk: Low

This is a small, targeted fix for a CI/CD authorization issue. The change correctly addresses the Vercel CLI behavior where the --scope flag is required for organization context, even when VERCEL_ORG_ID is set as an environment variable.

Review

Changes reviewed:

• .github/workflows/vercel-production.yml (+2/-2)

What the fix does:

• Adds --scope=${{ secrets.VERCEL_ORG_ID }} to vercel inspect (line 64)
• Adds --scope=${{ secrets.VERCEL_ORG_ID }} to vercel promote (line 67)

Analysis:

✅ Correctness: The fix is correct. While VERCEL_ORG_ID is set as an environment variable at line 22, the Vercel CLI's inspect and promote commands require the explicit --scope flag for organization scope resolution. The env var is primarily used by vercel pull and vercel deploy.

✅ Security: The secret is properly referenced using ${{ secrets.VERCEL_ORG_ID }} - no hardcoded values or exposure risks.

✅ Consistency: The fix follows the same pattern already used for --token across all Vercel commands in this workflow.

💡 Minor Observation (Not Blocking)

🟡 The VERCEL_ORG_ID environment variable at line 22 appears redundant now since:

• vercel pull uses VERCEL_ORG_ID env var ✓
• vercel deploy uses VERCEL_ORG_ID env var ✓
• vercel inspect now uses explicit --scope flag
• vercel promote now uses explicit --scope flag

The env var is still useful for pull and deploy commands, so keeping it is fine. This is just noted for future reference.

---

✅ APPROVE

Summary: Clean, minimal fix that correctly addresses the Vercel CLI authorization error. The change follows established patterns in the workflow and properly handles the secret. The test plan (re-running the workflow after merge) is appropriate for validating this fix.

---

Other Findings (0)

No additional findings. This is a straightforward infrastructure fix with no code logic or security concerns.