feat(webapp): prebuild the microVM template at deploy finalisation

Optionally prebuild a deployment's microVM template during deploy finalisation when a template builder is configured. The call runs in the background by default, can be awaited with a timeout behind a feature flag, and never fails a deploy. A successful build records the template key on the deployment.

Mono-RevId: 1bee982a567d873ab0171eb27ca4742e491f72ea

Author: 1stvamp

apps/webapp/app/env.server.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { MachinePresetName } from "@trigger.dev/core/v3";
 import {
   parseNaturalLanguageDurationInMs,
   webhookDeliveryRetentionClass,
@@ -31,6 +32,35 @@ const parseDeployBaseImagesEnv = (
   return errors.length > 0 ? z.NEVER : images;
 };
 
+// Parses a CSV of machine preset names (e.g. "small-1x,small-2x") into a
+// non-empty array of MachinePresetName.
+const parseMachinePresetCsv = (raw: string, ctx: z.RefinementCtx): MachinePresetName[] => {
+  const names = raw
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  if (names.length === 0) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "must list at least one machine preset",
+    });
+    return z.NEVER;
+  }
+  const out: MachinePresetName[] = [];
+  for (const name of names) {
+    const parsed = MachinePresetName.safeParse(name);
+    if (!parsed.success) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `unknown machine preset: "${name}"`,
+      });
+      return z.NEVER;
+    }
+    out.push(parsed.data);
+  }
+  return out;
+};
+
 const GithubAppEnvSchema = z.preprocess(
   (val) => {
     const obj = val as any;
@@ -877,6 +907,20 @@ const EnvironmentSchema = z
       .optional()
       .transform((v) => v ?? process.env.DEPLOY_REGISTRY_ECR_DEFAULT_REPOSITORY_POLICY),
 
+    // MicroVM template builder, called at deploy finalisation to prebuild the
+    // deployment image's template. Unset URL skips it.
+    TEMPLATE_BUILDER_URL: z.string().optional(),
+    TEMPLATE_BUILDER_TOKEN: z.string().optional(),
+    // How long wait mode holds finalisation for the builder before carrying on.
+    TEMPLATE_BUILDER_TIMEOUT_MS: z.coerce.number().int().positive().default(60_000),
+    // Machine presets whose shapes are sent with the template request.
+    TEMPLATE_BUILDER_MACHINE_PRESETS: z
+      .string()
+      .default("small-1x")
+      .transform(parseMachinePresetCsv),
+    // Percentage of deploys from orgs without compute that still prebuild in shadow mode.
+    TEMPLATE_BUILDER_SHADOW_ROLLOUT_PCT: z.coerce.number().min(0).max(100).default(0),
+
     DEPLOY_IMAGE_PLATFORM: z.string().default("linux/amd64"),
     DEPLOY_BASE_IMAGES: z
       .string()

apps/webapp/app/v3/featureFlags.ts

@@ -26,7 +26,7 @@ export const FEATURE_FLAG = {
   computeMigrationEnabled: "computeMigrationEnabled",
   computeMigrationFreePercentage: "computeMigrationFreePercentage",
   computeMigrationPaidPercentage: "computeMigrationPaidPercentage",
-  computeMigrationRequireTemplate: "computeMigrationRequireTemplate",
+  computeTemplatePrebuildWait: "computeTemplatePrebuildWait",
   runOpsMintKind: "runOpsMintKind",
   // Grace-linger stamp carried alongside runOpsMintKind on flip. See mintFlipGrace.ts.
   runOpsMintKindPrev: "runOpsMintKindPrev",
@@ -117,9 +117,10 @@ export const FeatureFlagCatalog = {
   [FEATURE_FLAG.computeMigrationEnabled]: z.boolean(),
   [FEATURE_FLAG.computeMigrationFreePercentage]: z.coerce.number().int().min(0).max(100),
   [FEATURE_FLAG.computeMigrationPaidPercentage]: z.coerce.number().int().min(0).max(100),
-  // When on, migrated orgs build their compute template in required mode at deploy
-  // (fails the deploy on error) instead of shadow. Strict boolean (see above).
-  [FEATURE_FLAG.computeMigrationRequireTemplate]: z.boolean(),
+  // When on, deploy finalisation waits (up to a timeout) for the compute template
+  // prebuild instead of firing it in the background. Never fails the deploy.
+  // Global or per org. Strict boolean (see above).
+  [FEATURE_FLAG.computeTemplatePrebuildWait]: z.boolean(),
   // Per-org run-ops-id mint cutover. Defaults to "cuid"; only honored when
   // RUN_OPS_MINT_ENABLED is on AND isSplitEnabled() is true.
   [FEATURE_FLAG.runOpsMintKind]: z.enum(["cuid", "runOpsId"]),

apps/webapp/app/v3/services/finalizeDeploymentV2.server.ts

@@ -16,6 +16,7 @@ import { getEcrAuthToken, isEcrRegistry } from "../getDeploymentImageRef.server"
 import { tryCatch } from "@trigger.dev/core";
 import { getRegistryConfig, type RegistryConfig } from "../registryConfig.server";
 import { ecrImageExists } from "./verifyDeploymentImage.server";
+import { TemplatePrebuildService } from "./templatePrebuild.server";
 
 export class FinalizeDeploymentV2Service extends BaseService {
   public async call(
@@ -94,6 +95,7 @@ export class FinalizeDeploymentV2Service extends BaseService {
       // self-hosted setup). Verify before promoting so we never mark a
       // deployment DEPLOYED when nothing was actually pushed.
       await this.#assertImagePullable(deployment, body);
+      await this.#prebuildTemplate(deployment, id, body, writer);
 
       return finalizeService.call(authenticatedEnv, id, body);
     }
@@ -165,10 +167,36 @@ export class FinalizeDeploymentV2Service extends BaseService {
 
     // Belt and suspenders: confirm the push actually landed before promoting.
     await this.#assertImagePullable(deployment, body);
+    await this.#prebuildTemplate(deployment, id, body, writer);
 
     return finalizeService.call(authenticatedEnv, id, body);
   }
 
+  // Never throws, so a template problem cannot fail the deploy.
+  async #prebuildTemplate(
+    deployment: {
+      id: string;
+      imageReference: string | null;
+      worker: { project: { id: string } } | null;
+    },
+    deploymentFriendlyId: string,
+    body: FinalizeDeploymentRequestBody,
+    writer?: WritableStreamDefaultWriter
+  ): Promise<void> {
+    if (!deployment.imageReference || !deployment.worker) {
+      return;
+    }
+
+    await new TemplatePrebuildService(this._prisma).prebuild({
+      projectId: deployment.worker.project.id,
+      deploymentId: deployment.id,
+      deploymentFriendlyId,
+      imageReference: deployment.imageReference,
+      imageDigest: body.imageDigest,
+      writer,
+    });
+  }
+
   async #assertImagePullable(
     deployment: { imageReference: string | null; type: string | null },
     body: FinalizeDeploymentRequestBody