A release checklist for a static site
Verify the artifact before replacing the live directory, and keep the checks close to the release command.
Static-Web
A release is not complete until the public edge agrees
Build once, inspect the output, then exercise representative public routes before replacing the live directory.
A static server should have one obvious root
One root, one file_server, and a small header policy make a static deployment easy to inspect.
Security headers should describe the actual page
Start with a narrow policy, then expand it only when a documented feature needs another resource.