Deploys: affected-only + parallel CI builds + exact-tag verification (deploy-affected-parallel)

2026-08-02 · PR #203 · runs 30775759423 (first, cold) + 30776487936 (dispatch, warm)

A staging push used to rebuild and redeploy every backend through Fly's single shared remote builder — ~an hour of serialized wall clock per push, plus the recorded 2026-06 stale-cache incident class (concurrent builds of the shared Dockerfile silently reusing each other's images).

Now:

• Affected-only — scripts/deploy-affected.mjs derives the touched apps from turbo's dependency graph; the matrix shrinks to them. Fail-OPEN on anything that could change how builds work (workflow/docker/root config) or any detector failure. [deploy-all] token + workflow_dispatch are the escape hatches.
• Parallel CI builds, exact-tag deploys — per-app GHA build jobs with isolated cache scopes push registry.fly.io/<app>:<git-sha>; flyctl deploy --image references the exact tag. The shared builder is retired; the stale-image class is structurally unrepresentable.
• Self-verifying — every deploy job fails loudly unless the app's active image tag equals the pipeline sha.

Measured: full 8-app matrix 16m15s cold / 9m03s warm (builds 21–46s each); migrator-first ordering held; every sha verification green. Guide: deployment.