[waleedlatif1]

Summary

• promote-app-image.sh decided whether the app deploy tag moved by reading the tag right after retagging it. That read can still return the previous image, so a moved tag was reported as unchanged. trigger-promote then checked the wrong pipeline execution: it refused to promote when a new execution had already started. If the read had lagged until before the execution started, it could instead have matched the previous execution and promoted Trigger.dev tasks before the app cut over
• The script now computes the digest the retag will push from imagetools create --dry-run before moving the tag. The dry run prints the exact manifest plus a trailing newline, so its hash is the pushed digest. After the move it waits up to a minute for the tag to resolve to that digest, failing loudly if it never does, then compares the predicted digest with the previous one

Type of Change

• Bug fix

Testing

• Against the registry: the dry-run hash of a real staging retag equals the digest the registry stored for that retag
• Script run in a Linux container with stubbed docker/aws: a stale read that catches up reports changed=true with the new digest; a genuinely unchanged retag reports changed=false; a tag that never resolves fails with exit 1; a first push with no previous tag reports changed=true
• The pre-fix script on the stale-read case reports changed=false with the previous digest, reproducing the failure
• bash -n

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Ignored	Preview	Oct 28, 2026 7:04pm UTC

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The latest changes appear safe to merge, with no new blocking issues found.

Summary

The PR predicts the app image digest before moving the deploy tag, then waits for ECR to return that digest before reporting promotion outputs.

• CI confirms the promoted app image digest before reporting the tag change.

_{Reviews (2) · Last reviewed commit: "fix(ci): bound the promoted-tag wait by ..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}