feat(ci): promote Trigger.dev tasks in lockstep with the ECS traffic cutover

[TheodoreSpeaks]

Summary

• Move Trigger.dev deploys for dev, staging, and production into CI with --skip-promotion, then promote the parked task version in lockstep with the ECS traffic cutover (CodeDeploy AllowTraffic) instead of at deploy-finish. This closes the app↔task version-skew window (up to ~50 min on prod, where the deploy can queue behind a bake).
• Correlate this push to its ECS deploy via the app image digest → CodePipeline execution → CodeDeploy deployment → AllowTraffic on every target. A retag/push epoch rejects a stale historical execution reusing the same digest.
• promote-trigger* promotes only after cutover; when the app image didn't change (no-op retag / .github-only commit) it promotes immediately instead of waiting.
• staging/prod: deploy-trigger + promote-trigger (gated on promote-images.promoted); digest/epoch/changed come from promote-images.
• dev: deploy-trigger-dev + promote-trigger-dev, promoting the dev-sim preview branch (promote --env preview --branch dev-sim). Dev has no promote-images, so build-dev publishes the digest/epoch/changed as an artifact.
• New .github/scripts/wait-for-ecs-cutover.sh does the poll; verified end-to-end against real dev and staging deployments.

Prerequisites before this runs

• Add CodePipeline + CodeDeploy read perms to the OIDC deploy roles for every env in use (AWS_ROLE_TO_ASSUME, STAGING_AWS_ROLE_TO_ASSUME, DEV_AWS_ROLE_TO_ASSUME — managed outside the repo): codepipeline:ListPipelineExecutions/GetPipelineExecution/ListActionExecutions, codedeploy:GetDeployment/ListDeploymentTargets/GetDeploymentTarget, and ecr:BatchGetImage (for the no-op app-image check — staging/prod roles already have it via the image verify step; the dev role needs it added).
• Set each role's MaxSessionDuration >= the job's role-duration-seconds (5400s prod/staging, 2400s dev), since the poll can outlast the default 1h session.
• Set one TRIGGER_ACCESS_TOKEN repo secret (a Trigger.dev PAT — user-scoped, works for dev/staging/prod). It replaces the per-env token, so DEV_TRIGGER_ACCESS_TOKEN can be deleted. Then disable the Trigger.dev git integration for the envs moved into CI.

Type of Change

• New feature (CI/CD)

Testing

• wait-for-ecs-cutover.sh run against real completed dev and staging deployments: correctly resolved digest → pipeline execution → CodeDeploy deployment → AllowTraffic (exit 0), rejected a stale execution when the since-epoch was after its start, and timed out cleanly on an unmatched digest (exit 1).
• actionlint clean (only pre-existing custom-runner-label warnings); bun run lint and bun run check:api-validation:strict pass; YAML validated.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 28, 2026 3:01am

[cursor]

PR Summary

Medium Risk
Changes production deploy orchestration and can block or delay Trigger.dev promotion for up to ~70 minutes; requires new AWS IAM permissions and longer OIDC session duration on deploy roles.

Overview
Aligns Trigger.dev task promotion with ECS blue/green traffic cutover so the app and background tasks don’t drift during long deploy bakes (especially prod).

Deploy jobs for dev, staging, and prod now upload task versions with --skip-promotion. New promote-trigger / promote-trigger-dev jobs call trigger.dev promote only after wait-for-ecs-cutover.sh sees CodeDeploy AllowTraffic succeed on every ECS target. Correlation uses the app image digest (CodePipeline ECR source) plus a retag/push epoch so an older pipeline run with the same digest can’t satisfy the gate.

The docker-build composite action now exports the pushed image digest. promote-images records retag_epoch and whether the app deploy tag actually changed (digest compare via ECR); build-dev does the same for :dev via a dev-cutover-meta artifact when there is no promote-images step. If the app image didn’t change, promotion runs immediately instead of polling.

Trigger auth moves to a single TRIGGER_ACCESS_TOKEN; deploy output is parsed to capture the correct version id for promotion.

^{Reviewed by Cursor Bugbot for commit e8c2a0b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR promotes Trigger.dev tasks alongside the ECS traffic cutover. The main changes are:

• Deploys task versions without immediately promoting them.
• Correlates image pushes with CodePipeline and CodeDeploy executions.
• Waits for successful traffic cutover across all ECS deployment targets.
• Promotes immediately when the application image is unchanged.
• Adds separate deployment and promotion flows for dev, staging, and production.

Confidence Score: 5/5

The updated changes look safe to merge.

• The latest fixes reject stale historical executions using the retag epoch.
• Promotion waits for successful AllowTraffic on every returned ECS target.
• Workflow callers consistently pass the required digest and epoch metadata.

Important Files Changed

Filename	Overview
.github/scripts/wait-for-ecs-cutover.sh	Adds polling that resolves an image digest to its pipeline execution, deployment, and completed traffic cutover.
.github/workflows/ci.yml	Adds environment-specific Trigger.dev deployment, cutover metadata, and promotion jobs.

_{Reviews (9): Last reviewed commit: "fix(ci): require promote-images + deploy..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4b9c850. Configure here.}