A hostname is a promise we can account for

Each production fully qualified domain name (FQDN) equals its GitHub repository name. The reusable workflow compares the hostname it was given with the repository GitHub says is running; if they disagree, publishing stops. Environment names are deliberately small—one lowercase DNS-label token—because they feed a public naming rule, not an open-ended URL builder.

Two shapes, one unambiguous rule

1. Zone apex When the repository name is the zone itself, its only optional environment is preview.{zone}.
2. Label site For www.example.tld, preview becomes www-preview.example.tld. The leftmost label takes the suffix.

The dash keeps a label site from claiming preview.example.tld, which belongs to the apex site if it exists. We never guess “apex” from the number of dots: an NS-delegated zone such as studio.example.tld is still an apex when the production FQDN equals that delegated zone.

Collisions are onboarding errors, not runtime surprises

Every production name and every environment hostname must be unique across the platform. If an apex preview would collide with a repository already named preview.example.tld, provisioning stops on the colliding side. Environment hosts are alternate views of one site; a genuinely separate public site gets its own repository, project prefix, and uploader identity.

A redirect still belongs to a site

Front Door evaluates URL redirects before forwarding to origin. We use temporary HTTP 307 responses—not permanent 301/308 responses and not a reverse proxy—so the visitor's method is preserved and the decision remains reversible. A catch-all can send www to the apex while keeping the source repository, custom domain, and certificate in inventory. Its origin simply goes unused while that rule matches.

For example, www.xyz.tld can redirect to xyz.tld, while www-preview.xyz.tld redirects to preview.xyz.tld. The source domains and routes remain provisioned even though matching requests do not reach their storage origins.

Attaching a redirect does require one unusually broad invalidation: purge the source hostname for the exact tree the rule now owns. A host-wide redirect means /*, including cached fingerprinted objects that would otherwise continue returning 200. That is a redirect-configuration purge, not the small unhashed-path purge used by everyday deploys.

Next: how a name proves ownership, or return to all posts.