feat(ci): promote Trigger.dev tasks in lockstep with the ECS traffic cutover

[TheodoreSpeaks]

Summary

• Move Trigger.dev deploys for dev, staging, and production into CI with --skip-promotion, then promote the parked task version in lockstep with the ECS traffic cutover (CodeDeploy AllowTraffic) instead of at deploy-finish. This closes the app↔task version-skew window (up to ~50 min on prod, where the deploy can queue behind a bake).
• Correlate this push to its ECS deploy via the app image digest → CodePipeline execution → CodeDeploy deployment → AllowTraffic on every target. A retag/push epoch rejects a stale historical execution reusing the same digest.
• promote-trigger* promotes only after cutover; when the app image didn't change (no-op retag / .github-only commit) it promotes immediately instead of waiting.
• staging/prod: deploy-trigger + promote-trigger (gated on promote-images.promoted); digest/epoch/changed come from promote-images.
• dev: deploy-trigger-dev + promote-trigger-dev, promoting the dev-sim preview branch (promote --env preview --branch dev-sim). Dev has no promote-images, so build-dev publishes the digest/epoch/changed as an artifact.
• New .github/scripts/wait-for-ecs-cutover.sh does the poll; verified end-to-end against real dev and staging deployments.

Prerequisites before this runs

• Add CodePipeline + CodeDeploy read perms to the OIDC deploy roles for every env in use (AWS_ROLE_TO_ASSUME, STAGING_AWS_ROLE_TO_ASSUME, DEV_AWS_ROLE_TO_ASSUME — managed outside the repo): codepipeline:ListPipelineExecutions/GetPipelineExecution/ListActionExecutions, codedeploy:GetDeployment/ListDeploymentTargets/GetDeploymentTarget, and ecr:BatchGetImage (for the no-op app-image check — staging/prod roles already have it via the image verify step; the dev role needs it added).
• Set each role's MaxSessionDuration >= the job's role-duration-seconds (5400s prod/staging, 2400s dev), since the poll can outlast the default 1h session.
• Set one TRIGGER_ACCESS_TOKEN repo secret (a Trigger.dev PAT — user-scoped, works for dev/staging/prod). It replaces the per-env token, so DEV_TRIGGER_ACCESS_TOKEN can be deleted. Then disable the Trigger.dev git integration for the envs moved into CI.

Type of Change

• New feature (CI/CD)

Testing

• wait-for-ecs-cutover.sh run against real completed dev and staging deployments: correctly resolved digest → pipeline execution → CodeDeploy deployment → AllowTraffic (exit 0), rejected a stale execution when the since-epoch was after its start, and timed out cleanly on an unmatched digest (exit 1).
• actionlint clean (only pre-existing custom-runner-label warnings); bun run lint and bun run check:api-validation:strict pass; YAML validated.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 20, 2026 6:52pm

[cursor]

PR Summary

Medium Risk
Changes production deploy orchestration and timing of when background tasks go live; mis-correlation or missing AWS IAM prerequisites could delay or block promotion, but app deploy gating and safe defaults on digest errors reduce early-promote risk.

Overview
Trigger.dev promotion is deferred until ECS blue/green traffic cutover, closing the window where the app and background tasks could run mismatched versions (notably long prod bakes behind prior deploys).

Deploy jobs now use --skip-promotion and parse the deployed version from CLI output; new promote-trigger / promote-trigger-dev jobs call promote only after wait-for-ecs-cutover.sh sees CodeDeploy AllowTraffic succeed on every ECS target. Correlation uses the app image digest (CodePipeline ECR source) plus a retag epoch so an older pipeline run with the same digest cannot satisfy the gate. When the app image did not change (no-op retag), promotion runs immediately instead of polling.

promote-images and build-dev (app leg) now emit digest, epoch, and app_image_changed via job outputs or artifacts; staging/prod also upload the build digest from build-amd64. Main/staging deploy-trigger moves from dev-only preview deploy to prod/staging with a unified TRIGGER_ACCESS_TOKEN; dev splits into dedicated deploy + promote jobs for dev-sim preview.

^{Reviewed by Cursor Bugbot for commit 4b9c850. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR promotes Trigger.dev tasks alongside the ECS traffic cutover. The main changes are:

• Deploys task versions without immediately promoting them.
• Correlates image pushes with CodePipeline and CodeDeploy executions.
• Waits for successful traffic cutover across all ECS deployment targets.
• Promotes immediately when the application image is unchanged.
• Adds separate deployment and promotion flows for dev, staging, and production.

Confidence Score: 5/5

The updated changes look safe to merge.

• The latest fixes reject stale historical executions using the retag epoch.
• Promotion waits for successful AllowTraffic on every returned ECS target.
• Workflow callers consistently pass the required digest and epoch metadata.

Important Files Changed

Filename	Overview
.github/scripts/wait-for-ecs-cutover.sh	Adds polling that resolves an image digest to its pipeline execution, deployment, and completed traffic cutover.
.github/workflows/ci.yml	Adds environment-specific Trigger.dev deployment, cutover metadata, and promotion jobs.

_{Reviews (9): Last reviewed commit: "fix(ci): require promote-images + deploy..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4b9c850. Configure here.}