fix(ci): reliable digest reads for no-op detection, robust version parse, pre-push dev epoch

Author: TheodoreSpeaks

.github/workflows/ci.yml

@@ -215,15 +215,18 @@ jobs:
         env:
           ECR_REPO: ${{ matrix.ecr_repo_secret == 'ECR_APP' && secrets.ECR_APP || matrix.ecr_repo_secret == 'ECR_MIGRATIONS' && secrets.ECR_MIGRATIONS || matrix.ecr_repo_secret == 'ECR_REALTIME' && secrets.ECR_REALTIME || matrix.ecr_repo_secret == 'ECR_PII' && secrets.ECR_PII || '' }}
 
-      # App leg only: capture the digest the :dev tag currently points at, BEFORE
-      # this build overwrites it, so promote-trigger-dev can tell whether the app
-      # image actually changed (a no-op :dev push triggers no ECS deploy).
-      - name: Capture previous :dev app digest
+      # App leg only: stamp the trigger epoch and capture the :dev digest BEFORE the
+      # build/push overwrites it. Stamping the epoch pre-build (not after the push,
+      # like it was) guarantees it precedes the :dev push that triggers the pipeline,
+      # so the dev ECS execution's startTime can't land before the epoch and get
+      # rejected by the cutover poll. The digest read uses the ECR API so an absent
+      # tag ("None", first deploy → changed) is distinct from a read error.
+      - name: Capture pre-build :dev state
         id: prevdigest
         if: matrix.ecr_repo_secret == 'ECR_APP'
         run: |
-          REF="${{ steps.login-ecr.outputs.registry }}/${{ steps.ecr-repo.outputs.name }}:dev"
-          PREV=$(docker buildx imagetools inspect "$REF" 2>/dev/null | awk '/^Digest:/{print $2; exit}' || true)
+          echo "epoch=$(date +%s)" >> "$GITHUB_OUTPUT"
+          PREV="$(aws ecr batch-get-image --repository-name "${{ steps.ecr-repo.outputs.name }}" --image-ids imageTag=dev --query 'images[0].imageId.imageDigest' --output text 2>/dev/null)" || PREV="__ERR__"
           echo "digest=${PREV}" >> "$GITHUB_OUTPUT"
 
       - name: Build and push
@@ -239,16 +242,22 @@ jobs:
       # App leg only: publish the metadata promote-trigger-dev needs to correlate
       # this push to its dev ECS deploy and decide whether to wait. Dev has no
       # promote-images job, so this stands in for its retag_epoch/app_image_changed
-      # outputs. The epoch is recorded just after the :dev push (the pipeline trigger).
+      # outputs. The epoch and prev digest come from the pre-build step above.
       - name: Publish dev cutover metadata
         if: matrix.ecr_repo_secret == 'ECR_APP'
         run: |
           mkdir -p dev-meta
           NEW="${{ steps.build.outputs.digest }}"
           PREV="${{ steps.prevdigest.outputs.digest }}"
+          if [ -z "$NEW" ]; then
+            echo "ERROR: build did not report an image digest" >&2
+            exit 1
+          fi
           echo "$NEW" > dev-meta/digest.txt
-          date +%s > dev-meta/retag_epoch.txt
-          if [ -n "$NEW" ] && [ "$NEW" = "$PREV" ]; then
+          echo "${{ steps.prevdigest.outputs.epoch }}" > dev-meta/retag_epoch.txt
+          # PREV=__ERR__ (read failed) falls through to changed=true (wait) — the safe
+          # direction. A real no-op is detected when the read succeeds and matches.
+          if [ "$PREV" != "__ERR__" ] && [ "$NEW" = "$PREV" ]; then
             echo "false" > dev-meta/app_image_changed.txt
             echo "ℹ️ :dev already points at ${NEW}; no ECS dev deploy will be triggered."
           else
@@ -311,7 +320,16 @@ jobs:
             exit 1
           fi
           bunx trigger.dev@4.4.3 deploy --env preview --branch dev-sim --skip-promotion 2>&1 | tee deploy.log
-          VERSION=$(sed -E 's/\x1b\[[0-9;]*m//g' deploy.log | grep -oE '20[0-9]{6}\.[0-9]+' | tail -n1 || true)
+          # Anchor on the "version" keyword and take the FIRST match: with
+          # --skip-promotion the CLI can print the unchanged current version AFTER
+          # the one it just deployed, and dashboard URLs carry other IDs — so a bare
+          # last-match could promote the wrong version. Fall back to a bare
+          # first-match only if no version-labelled line is present.
+          CLEAN=$(sed -E 's/\x1b\[[0-9;]*m//g' deploy.log)
+          VERSION=$(printf '%s\n' "$CLEAN" | grep -oiE 'version[[:space:]]+v?20[0-9]{6}\.[0-9]+' | grep -oE '20[0-9]{6}\.[0-9]+' | head -n1 || true)
+          if [ -z "$VERSION" ]; then
+            VERSION=$(printf '%s\n' "$CLEAN" | grep -oE '20[0-9]{6}\.[0-9]+' | head -n1 || true)
+          fi
           if [ -z "$VERSION" ]; then
             echo "ERROR: could not parse deployed version from deploy output" >&2
             exit 1
@@ -484,7 +502,16 @@ jobs:
           fi
           bunx trigger.dev@4.4.3 deploy --env "$TRIGGER_ENV" --skip-promotion 2>&1 | tee deploy.log
           # Extract the deployed version (e.g. 20260715.2) tied to THIS invocation.
-          VERSION=$(sed -E 's/\x1b\[[0-9;]*m//g' deploy.log | grep -oE '20[0-9]{6}\.[0-9]+' | tail -n1 || true)
+          # Anchor on the "version" keyword and take the FIRST match: with
+          # --skip-promotion the CLI can print the unchanged current version AFTER
+          # the one it just deployed, and dashboard URLs carry other IDs — so a bare
+          # last-match could promote the wrong version. Fall back to a bare
+          # first-match only if no version-labelled line is present.
+          CLEAN=$(sed -E 's/\x1b\[[0-9;]*m//g' deploy.log)
+          VERSION=$(printf '%s\n' "$CLEAN" | grep -oiE 'version[[:space:]]+v?20[0-9]{6}\.[0-9]+' | grep -oE '20[0-9]{6}\.[0-9]+' | head -n1 || true)
+          if [ -z "$VERSION" ]; then
+            VERSION=$(printf '%s\n' "$CLEAN" | grep -oE '20[0-9]{6}\.[0-9]+' | head -n1 || true)
+          fi
           if [ -z "$VERSION" ]; then
             echo "ERROR: could not parse deployed version from deploy output" >&2
             exit 1
@@ -728,11 +755,20 @@ jobs:
           # retag is a no-op, ECR fires no push event, and no ECS app deploy runs.
           # promote-trigger reads this to promote immediately instead of waiting for
           # a cutover that will never happen.
-          get_digest() { docker buildx imagetools inspect "$1" 2>/dev/null | awk '/^Digest:/{print $2; exit}'; }
-          APP_REF="${REGISTRY}/${{ secrets.ECR_APP }}"
-          NEW_APP_DIGEST="$(get_digest "${APP_REF}:${{ github.sha }}")"
-          PREV_APP_DIGEST="$(get_digest "${APP_REF}:${ECR_TAG}" || true)"
-          if [ -n "$NEW_APP_DIGEST" ] && [ "$NEW_APP_DIGEST" = "$PREV_APP_DIGEST" ]; then
+          #
+          # Read digests via the ECR API, which cleanly returns "None" for an absent
+          # tag (first deploy → changed) vs a non-zero exit on a real read error. On
+          # a read error we fall through to changed=true (wait) — the safe direction
+          # (old tasks stay current, job fails visibly) rather than promoting early.
+          APP_REPO="${{ secrets.ECR_APP }}"
+          ecr_digest() { aws ecr batch-get-image --repository-name "$1" --image-ids imageTag="$2" --query 'images[0].imageId.imageDigest' --output text 2>/dev/null; }
+          NEW_APP_DIGEST="$(ecr_digest "$APP_REPO" "${{ github.sha }}")" || NEW_APP_DIGEST="__ERR__"
+          PREV_APP_DIGEST="$(ecr_digest "$APP_REPO" "${ECR_TAG}")" || PREV_APP_DIGEST="__ERR__"
+          if [ "$NEW_APP_DIGEST" = "__ERR__" ] || [ "$NEW_APP_DIGEST" = "None" ] || [ -z "$NEW_APP_DIGEST" ]; then
+            echo "ERROR: could not resolve the new app image digest for ${{ github.sha }}" >&2
+            exit 1
+          fi
+          if [ "$PREV_APP_DIGEST" != "__ERR__" ] && [ "$NEW_APP_DIGEST" = "$PREV_APP_DIGEST" ]; then
             echo "app_image_changed=false" >> "$GITHUB_OUTPUT"
             echo "ℹ️ App deploy tag ${ECR_TAG} already points at ${NEW_APP_DIGEST}; no ECS app deploy will be triggered."
           else