OUT-4184: auto-deploy to Trigger.dev on merge to main

[SandipBajracharya]

What

Adds a self-contained GitHub Actions workflow (.github/workflows/deploy.yml) that auto-deploys to Trigger.dev's production environment on every merge to main, gated behind the existing Tests + Code Quality checks.

Part of OUT-4184 (applies the QuickBooks pattern to the Dropbox integration).

How it works

On push to main, four check jobs run — lint (pnpm lint), typecheck (pnpm typecheck), unit-tests (pnpm test), integration-tests (pnpm test:integration) — and deploy (needs: [all four]) runs pnpm trigger:deploy only if all pass. The check jobs mirror code-quality.yml / test.yml (pnpm 10.15, Node 22, same setup), so the deploy gate is self-contained.

Sentry sourcemaps

The deploy job sets VERCEL_ENV=production, which flips the isProd branch in trigger.config.ts and uploads Sentry sourcemaps for readable production stack traces. It passes SENTRY_ORG, SENTRY_PROJECT, SENTRY_AUTH_TOKEN, NEXT_PUBLIC_SENTRY_DSN, plus TRIGGER_ACCESS_TOKEN and TRIGGER_PROJECT_ID.

⚠️ Required before this can succeed

The repo's Production GitHub Environment exists but is empty. Add all six secrets (TRIGGER_ACCESS_TOKEN, TRIGGER_PROJECT_ID, SENTRY_ORG, SENTRY_PROJECT, SENTRY_AUTH_TOKEN, NEXT_PUBLIC_SENTRY_DSN) or the deploy will fail fast (they are z.parsed in trigger.config.ts). The deploy job declares environment: Production so it can read them.

Also in this PR

• code-quality.yml / test.yml: trigger changed to pull_request only (was push + pull_request). This removes the duplicate push+PR runs on PR branches; merges to main are now checked by deploy.yml. Tradeoff: a branch with commits but no open PR no longer gets checks until a PR is opened.
• All actions pinned to full commit SHAs across the three workflows (mutable tags can be moved after a compromise; the deploy job handles production secrets).
• package.json: added trigger:deploy script mirroring trigger:dev.

Not covered

• This gates the Trigger.dev task deploy only. If Vercel auto-deploys the Next.js app on push to main, that path is separate and unaffected.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dropbox-integration	Ready	Preview	Sep 15, 2026 9:37am UTC

[linear-code]

OUT-4184

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

Summary

Adds a GitHub Actions workflow that checks every merge to main before deploying Trigger.dev tasks to production. It also moves existing checks to pull requests only, pins action versions to commit SHAs, and adds the deploy script.

• Runs linting, type checks, unit tests, and integration tests before deployment.
• Passes production Trigger.dev and Sentry settings to the deploy command.
• Prevents older deployment runs from publishing over newer commits.

Diagram

sequenceDiagram
    participant GitHub
    participant Checks as Four check jobs
    participant Queue as Deploy queue
    participant Branch as main
    participant Trigger as Trigger.dev
    GitHub->>Checks: Push to main
    par lint
        Checks->>Checks: pnpm lint
    and typecheck
        Checks->>Checks: pnpm typecheck
    and unit tests
        Checks->>Checks: pnpm test
    and integration tests
        Checks->>Checks: pnpm test:integration
    end
    alt all checks pass
        Checks->>Queue: Queue deploy without cancellation
        Queue->>Branch: Fetch current branch tip
        alt commit is current tip
            Queue->>Trigger: pnpm trigger:deploy
            Trigger-->>GitHub: Deploy result
        else newer commit exists
            Queue-->>GitHub: Skip stale deploy
        end
    else any check fails
        Checks-->>GitHub: Do not deploy
    end

Loading

_{Reviews (3) · Last reviewed commit: "fix(OUT-4184): skip deploy when a newer ..."}

[SandipBajracharya]

@greptileai review

[SandipBajracharya]

@greptileai review again

[priosshrsth]

LGTM