GeezerVison

Summary

• Deploy Trigger.dev tasks without promotion in development, staging, and production, then promote after the matching ECS traffic cutover is observed on every target.
• Build the app under a commit tag, capture the timestamp immediately before moving its deploy tag, and correlate each environment with the final ECR tag digest, including retags that produce an image index. Development carries the same metadata through an artifact.
• Verify the latest deployment even when the app tag is unchanged, and recheck its identity after cutover. Superseding executions, failed deployments, missing metadata, invalid responses, and AWS access errors stop promotion immediately.
• Use the Trigger CLI's native deployment-version output, align CLI and Bun versions with the current base, and preserve provider selection and explicit dependency-success gates.
• Task uploads and app deployments remain independent; promotion requires both to succeed. A failed task upload leaves the previous task version active.

Rollout prerequisites

• Grant the app deployment roles read access for codepipeline:ListPipelineExecutions, codepipeline:GetPipelineExecution, codepipeline:ListActionExecutions, codedeploy:GetDeployment, codedeploy:ListDeploymentTargets, and codedeploy:GetDeploymentTarget. ECR image reads are also required.
• Permit sessions of at least 5,400 seconds for staging/production and 2,400 seconds for development.
• Make a shared Trigger personal access token and the project reference available to the workflow, and coordinate disabling Trigger's Git auto-deploy integration for these environments.
• Validate a controlled staging run and the promotion/rollback procedure before production rollout. Promotion follows observed traffic cutover; post-cutover rollback requires coordinating the app and task versions.

Type of Change

• New feature (CI/CD)

Testing

• 24 isolated deployment-gate regression tests, wired into CI: push-boundary metadata, stale/superseding execution rejection, all-target cutover, failed/queued deployments, unchanged-image checks, invalid metadata, AWS access failures, and ECR lookup errors.
• Actionlint, YAML parsing, and Bash syntax checks passed.
• Repository lint, all 46 audits (including strict API validation), block-registry validation, and generated-document checks passed.
• Read-only integration checks verified AWS deployment response shapes and ECR digest lookup. No deployment or IAM/secret mutation was performed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing locally
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)