feat(vercel): automatic version skew protection at connect + atomic deployments deprecation

[0ski]

Connecting a Vercel project now writes TRIGGER_AUTOMATIC_SKEW_VERSION_PROTECTION=1
(plain, create-if-absent only - an existing value, including "0", is never
touched; presence is target-containment aware, branch-scoped records do not
count, a truncated env listing skips the write). The onboarding wizard no
longer offers automatic atomic deployments (default off); the settings row is
labelled Deprecated and enabling it requires confirming a dialog that points
to task version skew protection and the docs (TRI-13001).

[changeset-bot]

⚠️ No Changeset found

Latest commit: aa84e5f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The Vercel integration now synchronizes a version-skew protection environment variable across standard and custom environments. Atomic deployments default to disabled, remain hidden during onboarding, and display deprecation guidance in settings. Enabling atomic deployments requires confirmation and conditionally disables automatic custom-domain assignment. Reservation rules and tests cover the new environment variable. A changelog entry documents the updated behavior.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the main changes but omits the required issue reference, checklist, testing, changelog, and screenshots sections.	Add the required template sections, including the issue reference, checklist, testing steps, changelog entry, and screenshots or an explicit statement that none apply.
Docstring Coverage	⚠️ Warning	Docstring coverage is 6.25% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 16 functions across 10 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes automatic version skew protection and the deprecation of automatic atomic deployments.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch oskar/feat-vercel-skew-protection

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Observability map

As of aa84e5f.

19/100 over 445 measured of 462 entry points (base 19, no change)

What this PR changed

route	base	head	now failing
/resources/orgs/:organizationSlug/projects/:projectParam/env/:envParam/vercel	0	50	error-classification

FIX FIRST

• /api/v1/projects/:projectRef/envvars (sensitive) - auth-boundary, request-context
• /auth/sso (sensitive) - auth-boundary, request-context
• /_app/orgs/:organizationSlug/settings/team (sensitive) - error-classification, auth-scope, request-context

AUDIT 3 of 50 sensitive mutations record an actor. 47 without one.
CONTEXT 23 of 445 entry points name a tenant on a failure path. 343 appear only here, 39 of them sensitive, in the JSON rather than the fix list.

What the score is made of

CHECKS
  error-classification  180 applicable, 102 pass,   0 sole, global without it 12
  auth-boundary          62 applicable,  57 pass,   0 sole, global without it 16
  auth-scope             19 applicable,  17 pass,   0 sole, global without it 19
  request-context       445 applicable,  23 pass, 243 sole, global without it 64
  audit-trail            50 applicable,   3 pass,   0 sole, not in the score

The score and findings here are report-only and never gate the merge. Separately, a required test suite keeps this tool's symbol and route lists in sync with the code they name, and can fail a pull request that renames or removes a symbol they reference, or that adds the first route with a segment they anticipate. Each failure names the list to edit. The rules and their reasons: internal-packages/observability-map/README.md.

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@fa83f20

trigger.dev

npm i https://pkg.pr.new/trigger.dev@fa83f20

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@fa83f20

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@fa83f20

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@fa83f20

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@fa83f20

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@fa83f20

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@fa83f20

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@fa83f20

commit: fa83f20

[coderabbitai]

🧹 Nitpick comments (1)

apps/webapp/app/components/primitives/Badge.tsx (1)

21-29: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add the required crumbs marker.

The changed component has no // @Crumbs marker or `// `#region` `@crumbs block. Add one before merge so the instrumentation can be removed by agentcrumbs strip.

As per coding guidelines, **/*: Add crumbs as you write code — not just when debugging.

Source: Coding guidelines

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2e0e7c6e-8da2-4b19-9fef-82c11f3110c2

📥 Commits

Reviewing files that changed from the base of the PR and between fa83f20 and 182055b.

📒 Files selected for processing (1)

• apps/webapp/app/components/primitives/Badge.tsx

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

📜 Review details

⏰ Context from checks skipped due to timeout. (33)

• GitHub Check: report
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (24, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (23, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (20, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (14, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (16, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (18, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (1, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (4, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (17, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (3, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (2, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (13, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (6, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (22, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (21, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (19, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (10, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (11, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (15, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (12, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (7, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (5, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (9, 24)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (8, 24)
• GitHub Check: obsmap / 🧪 Unit Tests: Observability Map
• GitHub Check: e2e-webapp / 🧪 E2E Tests: Webapp (1, 2)
• GitHub Check: e2e-webapp / 🧪 E2E Tests: Webapp (2, 2)
• GitHub Check: typecheck / typecheck
• GitHub Check: runops-guard / runops-guard
• GitHub Check: fk-cascade-guard / fk-cascade-guard
• GitHub Check: code-quality / code-quality
• GitHub Check: Analyze (javascript-typescript)

🧰 Additional context used

📓 Path-based instructions (6)

**/*.{ts,tsx}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

**/*.{ts,tsx}: Use types over interfaces for TypeScript
Avoid using enums; prefer string unions or const objects instead

**/*.{ts,tsx}: Prefer static imports over dynamic imports. Only use dynamic import() when:

• Circular dependencies cannot be resolved otherwise
• Code splitting is genuinely needed for performance
• The module must be loaded conditionally at runtime

Files:

• apps/webapp/app/components/primitives/Badge.tsx

{packages/core,apps/webapp}/**/*.{ts,tsx}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Use zod for validation in packages/core and apps/webapp

Files:

• apps/webapp/app/components/primitives/Badge.tsx

**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Use function declarations instead of default exports

Files:

• apps/webapp/app/components/primitives/Badge.tsx

apps/webapp/**/*.{ts,tsx}

📄 CodeRabbit inference engine (.cursor/rules/webapp.mdc)

apps/webapp/**/*.{ts,tsx}: Access environment variables through the env export of env.server.ts instead of directly accessing process.env
Use subpath exports from @trigger.dev/core package instead of importing from the root @trigger.dev/core path

Files:

• apps/webapp/app/components/primitives/Badge.tsx

apps/webapp/app/**/*.{ts,tsx}

📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)

apps/webapp/app/**/*.{ts,tsx}: For dashboard changes, visually verify the running Remix app with Chrome DevTools MCP, using snapshots, screenshots, interaction, and console-message checks as appropriate.
Use useCallback and useMemo only for context provider values, expensive derived data used as a dependency, or stable references required by dependency arrays; do not wrap ordinary event handlers or trivial computations.
Use named constants for sentinel or placeholder values instead of scattering raw string literals across comparisons.

Files:

• apps/webapp/app/components/primitives/Badge.tsx

**/*

📄 CodeRabbit inference engine (AGENTS.md)

**/*: Add crumbs as you write code — not just when debugging. Mark lines with
// @Crumbs or wrap blocks in `// `#region` `@crumbs. They stay on the
branch throughout development and are stripped by agentcrumbs strip
before merge.
Do not invent new namespaces — pick from this table or ask first.
Do not flag // @Crumbs markers, `#region `@crumbs blocks, or agentcrumbs
imports in reviews. These are temporary debug instrumentation stripped
before merge. Data logged in crumbs (IDs, names, values) never reaches
production.

Files:

• apps/webapp/app/components/primitives/Badge.tsx