feat(ci): extend lockstep Trigger.dev promotion to dev (preview branch)

Author: TheodoreSpeaks

.github/workflows/ci.yml

@@ -127,7 +127,19 @@ jobs:
         env:
           ECR_REPO: ${{ matrix.ecr_repo_secret == 'ECR_APP' && secrets.ECR_APP || matrix.ecr_repo_secret == 'ECR_MIGRATIONS' && secrets.ECR_MIGRATIONS || matrix.ecr_repo_secret == 'ECR_REALTIME' && secrets.ECR_REALTIME || matrix.ecr_repo_secret == 'ECR_PII' && secrets.ECR_PII || '' }}
 
+      # App leg only: capture the digest the :dev tag currently points at, BEFORE
+      # this build overwrites it, so promote-trigger-dev can tell whether the app
+      # image actually changed (a no-op :dev push triggers no ECS deploy).
+      - name: Capture previous :dev app digest
+        id: prevdigest
+        if: matrix.ecr_repo_secret == 'ECR_APP'
+        run: |
+          REF="${{ steps.login-ecr.outputs.registry }}/${{ steps.ecr-repo.outputs.name }}:dev"
+          PREV=$(docker buildx imagetools inspect "$REF" 2>/dev/null | awk '/^Digest:/{print $2; exit}' || true)
+          echo "digest=${PREV}" >> "$GITHUB_OUTPUT"
+
       - name: Build and push
+        id: build
         uses: useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2
         with:
           context: .
@@ -138,15 +150,105 @@ jobs:
           provenance: false
           sbom: false
 
-  # Dev: deploy Trigger.dev background tasks to the preview "dev-sim" branch.
-  # Gated after migrate-dev for the same reason as build-dev — the new task
-  # code runs against the dev DB, so the schema must be pushed first.
+      # App leg only: publish the metadata promote-trigger-dev needs to correlate
+      # this push to its dev ECS deploy and decide whether to wait. Dev has no
+      # promote-images job, so this stands in for its retag_epoch/app_image_changed
+      # outputs. The epoch is recorded just after the :dev push (the pipeline trigger).
+      - name: Publish dev cutover metadata
+        if: matrix.ecr_repo_secret == 'ECR_APP'
+        run: |
+          mkdir -p dev-meta
+          NEW="${{ steps.build.outputs.digest }}"
+          PREV="${{ steps.prevdigest.outputs.digest }}"
+          echo "$NEW" > dev-meta/digest.txt
+          date +%s > dev-meta/retag_epoch.txt
+          if [ -n "$NEW" ] && [ "$NEW" = "$PREV" ]; then
+            echo "false" > dev-meta/app_image_changed.txt
+            echo "ℹ️ :dev already points at ${NEW}; no ECS dev deploy will be triggered."
+          else
+            echo "true" > dev-meta/app_image_changed.txt
+          fi
+
+      - name: Upload dev cutover metadata
+        if: matrix.ecr_repo_secret == 'ECR_APP'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: dev-cutover-meta
+          path: dev-meta/
+          retention-days: 1
+
+  # Dev: build & upload the Trigger.dev task version WITHOUT promoting it
+  # (--skip-promotion) to the preview "dev-sim" branch. promote-trigger-dev flips
+  # it at the dev ECS traffic cutover. Gated after migrate-dev so the schema is
+  # pushed before the new task version can run against the dev DB.
   deploy-trigger-dev:
     name: Deploy Trigger.dev (Dev)
     needs: [migrate-dev]
     if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
+    outputs:
+      version: ${{ steps.deploy.outputs.version }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.13
+
+      - name: Cache Bun dependencies
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: |
+            ~/.bun/install/cache
+            node_modules
+            **/node_modules
+          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Deploy to Trigger.dev (skip promotion)
+        id: deploy
+        working-directory: ./apps/sim
+        env:
+          TRIGGER_ACCESS_TOKEN: ${{ secrets.DEV_TRIGGER_ACCESS_TOKEN }}
+          TRIGGER_PROJECT_ID: ${{ secrets.TRIGGER_PROJECT_ID }}
+        run: |
+          set -eo pipefail
+          if [ -z "$TRIGGER_ACCESS_TOKEN" ] || [ -z "$TRIGGER_PROJECT_ID" ]; then
+            echo "ERROR: DEV_TRIGGER_ACCESS_TOKEN and TRIGGER_PROJECT_ID repo secrets must both be set" >&2
+            exit 1
+          fi
+          bunx trigger.dev@4.4.3 deploy --env preview --branch dev-sim --skip-promotion 2>&1 | tee deploy.log
+          VERSION=$(sed -E 's/\x1b\[[0-9;]*m//g' deploy.log | grep -oE '20[0-9]{6}\.[0-9]+' | tail -n1 || true)
+          if [ -z "$VERSION" ]; then
+            echo "ERROR: could not parse deployed version from deploy output" >&2
+            exit 1
+          fi
+          echo "Captured deployed version: $VERSION"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+  # Dev: promote the skip-promoted preview version at the dev ECS traffic cutover.
+  # Dev has no promote-images gate (build-dev pushes :dev directly), so the digest,
+  # trigger epoch, and app-image-changed signal come from build-dev's artifact.
+  # trigger.dev supports promoting a specific preview branch: promote --env preview
+  # --branch dev-sim.
+  promote-trigger-dev:
+    name: Promote Trigger.dev (Dev)
+    needs: [build-dev, deploy-trigger-dev]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    # Dev bake is 5 min; the poll budget (30 min) and session (40 min) are sized for
+    # that with margin, well short of the prod path's 70/90.
+    timeout-minutes: 40
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -170,17 +272,51 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
-      - name: Deploy to Trigger.dev
+      - name: Download dev cutover metadata
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: dev-cutover-meta
+          path: dev-meta
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6
+        with:
+          role-to-assume: ${{ secrets.DEV_AWS_ROLE_TO_ASSUME }}
+          aws-region: ${{ secrets.DEV_AWS_REGION }}
+          role-duration-seconds: 2400
+
+      - name: Wait for ECS traffic cutover
+        env:
+          OVERALL_TIMEOUT: "1800"
+        run: |
+          set -eo pipefail
+          CHANGED=$(cat dev-meta/app_image_changed.txt)
+          if [ "$CHANGED" != "true" ]; then
+            echo "App image unchanged — no dev ECS deploy triggered; promoting immediately."
+            exit 0
+          fi
+          DIGEST=$(cat dev-meta/digest.txt)
+          EPOCH=$(cat dev-meta/retag_epoch.txt)
+          bash .github/scripts/wait-for-ecs-cutover.sh sim-dev-us-east-1-app-deployment "$DIGEST" "$EPOCH"
+
+      - name: Promote Trigger.dev version
         working-directory: ./apps/sim
         env:
           TRIGGER_ACCESS_TOKEN: ${{ secrets.DEV_TRIGGER_ACCESS_TOKEN }}
           TRIGGER_PROJECT_ID: ${{ secrets.TRIGGER_PROJECT_ID }}
+          VERSION: ${{ needs.deploy-trigger-dev.outputs.version }}
         run: |
+          set -eo pipefail
           if [ -z "$TRIGGER_ACCESS_TOKEN" ] || [ -z "$TRIGGER_PROJECT_ID" ]; then
             echo "ERROR: DEV_TRIGGER_ACCESS_TOKEN and TRIGGER_PROJECT_ID repo secrets must both be set" >&2
             exit 1
           fi
-          bunx trigger.dev@4.4.3 deploy --env preview --branch dev-sim
+          if [ -z "$VERSION" ]; then
+            echo "ERROR: no deployed version passed from deploy-trigger-dev" >&2
+            exit 1
+          fi
+          echo "Promoting Trigger.dev version $VERSION (preview / dev-sim)"
+          bunx trigger.dev@4.4.3 promote "$VERSION" --env preview --branch dev-sim
 
   # Main/staging: build & upload the Trigger.dev task version WITHOUT promoting it
   # (--skip-promotion). New runs keep executing the OLD promoted version until