fix(deploy): adapt build env vars flow to reused deployments and scoped auth

Two adaptations to changes that landed on main:

- the version-skew ack guard now runs after the reused-deployment early
  return, since an externally reused deployment builds nothing and never
  stores build env vars
- the build-env-vars endpoint uses the same scoped api key auth as the
  sibling deployment route, which migrated to authenticateApiKeyWithScope

Author: myftija

apps/webapp/app/routes/api.v1.deployments.$deploymentId.build-env-vars.ts

@@ -3,7 +3,7 @@ import { type GetDeploymentBuildEnvVarsResponseBody } from "@trigger.dev/core/v3
 import { z } from "zod";
 import { prisma } from "~/db.server";
 import { env } from "~/env.server";
-import { authenticateApiRequest } from "~/services/apiAuth.server";
+import { authenticateApiKeyWithScope } from "~/services/apiAuth.server";
 import { logger } from "~/services/logger.server";
 import { decryptSecret, EncryptedSecretValueSchema } from "~/services/secrets/secretStore.server";
 import { FINAL_DEPLOYMENT_STATUSES } from "~/v3/services/failDeployment.server";
@@ -25,15 +25,19 @@ export async function loader({ request, params }: LoaderFunctionArgs) {
   }
 
   try {
-    // Next authenticate the request
-    const authenticationResult = await authenticateApiRequest(request);
+    // Same auth as the sibling GET deployment route: env-key principals with
+    // read scope on deployments, no JWT.
+    const authResult = await authenticateApiKeyWithScope(request, {
+      action: "read",
+      resource: { type: "deployments" },
+    });
 
-    if (!authenticationResult) {
+    if (!authResult.ok) {
       logger.info("Invalid or missing api key", { url: request.url });
-      return json({ error: "Invalid or Missing API key" }, { status: 401 });
+      return json({ error: authResult.error }, { status: authResult.status });
     }
 
-    const authenticatedEnv = authenticationResult.environment;
+    const authenticatedEnv = authResult.authentication.environment;
 
     const { deploymentId } = parsedParams.data;
 

packages/cli-v3/src/commands/deploy.ts

@@ -1547,9 +1547,37 @@ async function handleNativeBuildServerDeploy({
 
   const deployment = initializeDeploymentResult.data;
 
+  const rawDeploymentLink = `${dashboardUrl}/projects/v3/${config.project}/deployments/${deployment.shortCode}`;
+  const rawTestLink = `${dashboardUrl}/projects/v3/${config.project}/test?environment=${
+    options.env === "prod" ? "prod" : "stg"
+  }`;
+
+  if (deployment.outcome === "existing") {
+    $deploymentSpinner.stop(`Version ${deployment.version} was already deployed`);
+
+    setDeploymentGithubActionsOutput({
+      version: deployment.version,
+      shortCode: deployment.shortCode,
+      rawDeploymentLink,
+      rawTestLink,
+      needsPromotion: !deployment.isPromoted,
+    });
+
+    warnAboutSkippedBuild(options.externalId, deployment.isPromoted);
+
+    outro(
+      `Version ${deployment.version} was already deployed for --external-id ${options.externalId} — nothing to build ${
+        isLinksSupported ? `| ${cliLink("View deployment", rawDeploymentLink)}` : rawDeploymentLink
+      }`
+    );
+
+    return;
+  }
+
   // Version-skew guard: an older server silently strips unknown fields, so if we sent
   // build env vars and the server didn't ack storing them, the remote build would run
-  // without them and fail in a confusing way. Fail fast instead.
+  // without them and fail in a confusing way. Fail fast instead. Deliberately after
+  // the outcome=existing return: a reused deployment builds nothing, so no ack is due.
   if (
     options.localBundle &&
     bundleBuildEnvVars &&
@@ -1579,33 +1607,6 @@ async function handleNativeBuildServerDeploy({
     throw new OutroCommandError(`Deployment failed`);
   }
 
-  const rawDeploymentLink = `${dashboardUrl}/projects/v3/${config.project}/deployments/${deployment.shortCode}`;
-  const rawTestLink = `${dashboardUrl}/projects/v3/${config.project}/test?environment=${
-    options.env === "prod" ? "prod" : "stg"
-  }`;
-
-  if (deployment.outcome === "existing") {
-    $deploymentSpinner.stop(`Version ${deployment.version} was already deployed`);
-
-    setDeploymentGithubActionsOutput({
-      version: deployment.version,
-      shortCode: deployment.shortCode,
-      rawDeploymentLink,
-      rawTestLink,
-      needsPromotion: !deployment.isPromoted,
-    });
-
-    warnAboutSkippedBuild(options.externalId, deployment.isPromoted);
-
-    outro(
-      `Version ${deployment.version} was already deployed for --external-id ${options.externalId} — nothing to build ${
-        isLinksSupported ? `| ${cliLink("View deployment", rawDeploymentLink)}` : rawDeploymentLink
-      }`
-    );
-
-    return;
-  }
-
   const exposedDeploymentLink = isLinksSupported
     ? cliLink(chalk.bold(rawDeploymentLink), rawDeploymentLink)
     : chalk.bold(rawDeploymentLink);