[github-actions]

Summary

10 new features, 15 improvements, 11 bug fixes.

Breaking changes

• OIDC workload identity now uses an organization-specific issuer URL; update your external service's identity provider and trust policies to use the issuer shown on your environment's OpenID Connect (OIDC) page.

Highlights

• Add opt-in AWS session tags with awsCredentialProvider({ sessionTags: true }) for task-level IAM restrictions and attribute-based permissions. Tags come from the verified run identity. Update the role trust policy to allow sts:TagSession before enabling them; existing integrations remain untagged. (c8ae1ffb5)

Improvements

• Logins made with trigger.dev login or the MCP server now stop working after 7 days without use. When that happens, the CLI and the MCP server start a new login instead of failing with an auth error, and in CI the CLI says to log in again. Self-hosted instances can change the window with CLI_LOGIN_IDLE_TIMEOUT_DAYS, or set it to 0 to turn it off for new logins. Logins made before this change aren't affected. (c8ee9e309)

• Add infisicalAccessToken at @trigger.dev/sdk/oidc/infisical to authenticate tasks with Infisical using OIDC instead of stored credentials. Supports US, EU, and self-hosted instances, custom audiences, and Infisical organization scoping. (63b58f329)

• Deploy from GitHub Actions using Trusted publishing and GitHub OIDC without storing a Trigger.dev API key. These deployments run entirely on the build server and do not grant the CLI access to environment variables. (9aafe6989)

• Use GitHub Actions trusted publishing with preview archive and promote, without storing API keys. Preview deploys for closed or merged pull requests now archive their branch. preview archive also supports Preview environment API keys through TRIGGER_ACCESS_TOKEN. (d9172638a)

  Failed Preview archive operations now exit with an error for API-key and personal-token authentication too, including automatic cleanup during deploys. CI cleanup jobs that previously passed despite an archive failure will now fail. Concurrent cleanup jobs succeed when another job has already archived the same branch generation.

• Add a bundled agent skill for integrating Trigger.dev with Convex, including transactional triggering, Realtime progress, recovery, and scoped-token safety. Install it manually from the package; it is not part of the CLI skills installer. (9422dc65d)

• Self-hosted supervisors that run tasks in microVMs can now have a finished run's suspend snapshots deleted from shared storage, instead of leaving them behind. The server-only checkpoint client gains a deleteSnapshots call for this. (95f4cbbad)

• Browser realtime subscriptions now resume reliably after the tab is hidden and shown again. This comes from upgrading @electric-sql/client to 1.3.0, which also lets apps that depend on 1.3.0 share a single copy with the SDK. (3900d8906)

• Use run credentials for run results, rescheduling, schedules, and environment-variable operations inside tasks. Run credentials remain limited to the current environment: shared schedules cannot be changed, and parent environment variables cannot be written. (cd58c750b)

• chat.agent now accepts only two kinds of message from a chat client: user messages, and answers to tool calls the agent made. A tool approval or tool output is merged onto the stored call it answers and runs with the input from the agent's own history, so a client can't add tool calls or change a call's input. chat.headStart drops tool calls from the history the client sends, and upsertIncomingMessage only adds user messages. (44feaaff6)

• Create public tokens without scopes from inside tasks using run credentials, without requiring an environment secret key. (306d960ca)

Bug fixes

• Fix logs and spans with large numeric object keys failing to ingest and dropping the rest of their batch. (99a626aa3)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• API keys can have custom access: combine access presets or set a level for each area, such as Runs or Deployments, optionally limited to selected tasks. Edit access changes what an existing key can do without rotating it, and the API keys page marks keys whose access differs from their preset today.
• New API keys can expire on a custom date. Pick Custom date in the Expires menu and choose a day from the calendar; the key stops working at the end of that day in your local time zone.
• Restrict an API key to a list of IP addresses so requests using it from anywhere else are rejected. Set the list when creating a key or edit it later from the API keys page, which now also shows the IP address each key was last used from.
• Organizations can save custom API key access as a preset and reuse it when creating keys in any project. Saved presets appear under Your presets in the access picker, and organization Owners and Admins can save and delete them.
• Click an API key to see its access, when it last used each area, and its details in a side panel. From there you can narrow a key to what it used in the last 30 days, without changing its secret.
• Alerts can be grouped: select alerts in the list and create a group that raises when any or all of them fire, with its own channels and expiry. Members keep evaluating but notify only through the group. Groups can also be created through the API, with their members in one call.
• Health alerts can now watch a chosen subset of checks — flow, execution and liveness — instead of all three.
• Email the owner of a dashboard-created personal access token 7 days before it expires, and again when it has, so a CI deploy using it doesn't break by surprise. Set PERSONAL_ACCESS_TOKEN_EXPIRY_EMAILS_ENABLED=false to turn them off.
• Personal access tokens created on the dashboard now expire after the lifetime you choose (30, 90 or 365 days by default). Requests made with an expired token get an error that says when it expired and where to create a new one. Existing tokens keep working as before.
• Alerts now require at least one channel (email, Slack or webhook). The option to notify the Dashboard Agent chat has been removed.
• Choose an API key's expiry from presets or a calendar in one picker, with date previews and expiration at the end of the chosen day in UTC.
• The API keys page shows when each key expires and when it was revoked, and the "How to set env vars" dialog no longer displays your secret key. Custom access is now a table of levels for each area, and options a key can't use are shown disabled with the reason.
• The Environment variables page now filters by environment, opening on the environment you're in, with a picker for preview branches. Deleting a variable asks for confirmation first.
• The side menu has a new Security section, just above Manage, that groups API keys, Environment variables, Trusted publishing and OIDC.
• Alerts: Admins and Developers can delete alerts; health metric charts use straight segments.
• Alert charts and alert evaluation are no longer limited by the plan's query period.
• Project JWT minting now rejects expiration times longer than 24 hours.
• Dashboard sessions past their deadline now end on their next request, including background data requests and form submissions, not only on page navigation.
• Restore duration wait details and the Skip waitpoint action in the dashboard.
• Fix the Logs page redirecting to Tasks when Logs is visible in the sidebar.
• Fix a new project's first deploys failing with "Failed to get deployment image ref" when two of them start at the same time.
• Triggering a task with a payload over the offload threshold from inside a running task works again. Run-scoped tokens and restricted API keys upload offloaded payloads into their own namespace and may only trigger with payloads they uploaded, while pointers at other runs' stored payloads or outputs are still rejected.
• Stop runs that wait a long time for capacity from being requeued and started a second time while their first start is still pending.
• Long GitHub organization and repository names on the Trusted publishing page now stay on one line and truncate, with the full name shown on hover.

Raw changeset output

Releases

@trigger.dev/build@4.8.4

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.8.4

trigger.dev@4.8.4

Patch Changes

• Logins made with trigger.dev login or the MCP server now stop working after 7 days without use. When that happens, the CLI and the MCP server start a new login instead of failing with an auth error, and in CI the CLI says to log in again. Self-hosted instances can change the window with CLI_LOGIN_IDLE_TIMEOUT_DAYS, or set it to 0 to turn it off for new logins. Logins made before this change aren't affected. (c8ee9e309)

• Add infisicalAccessToken at @trigger.dev/sdk/oidc/infisical to authenticate tasks with Infisical using OIDC instead of stored credentials. Supports US, EU, and self-hosted instances, custom audiences, and Infisical organization scoping. (63b58f329)

• Deploy from GitHub Actions using Trusted publishing and GitHub OIDC without storing a Trigger.dev API key. These deployments run entirely on the build server and do not grant the CLI access to environment variables. (9aafe6989)

• Use GitHub Actions trusted publishing with preview archive and promote, without storing API keys. Preview deploys for closed or merged pull requests now archive their branch. preview archive also supports Preview environment API keys through TRIGGER_ACCESS_TOKEN. (d9172638a)

  Failed Preview archive operations now exit with an error for API-key and personal-token authentication too, including automatic cleanup during deploys. CI cleanup jobs that previously passed despite an archive failure will now fail. Concurrent cleanup jobs succeed when another job has already archived the same branch generation.

• Updated dependencies:

  • @trigger.dev/core@4.8.4
  • @trigger.dev/build@4.8.4
  • @trigger.dev/schema-to-json@4.8.4

@trigger.dev/convex@4.8.4

Patch Changes

• Add a bundled agent skill for integrating Trigger.dev with Convex, including transactional triggering, Realtime progress, recovery, and scoped-token safety. Install it manually from the package; it is not part of the CLI skills installer. (9422dc65d)

@trigger.dev/core@4.8.4

Patch Changes

• Self-hosted supervisors that run tasks in microVMs can now have a finished run's suspend snapshots deleted from shared storage, instead of leaving them behind. The server-only checkpoint client gains a deleteSnapshots call for this. (95f4cbbad)

• Browser realtime subscriptions now resume reliably after the tab is hidden and shown again. This comes from upgrading @electric-sql/client to 1.3.0, which also lets apps that depend on 1.3.0 share a single copy with the SDK. (3900d8906)

• Add opt-in AWS session tags with awsCredentialProvider({ sessionTags: true }) for task-level IAM restrictions and attribute-based permissions. Tags come from the verified run identity. Update the role trust policy to allow sts:TagSession before enabling them; existing integrations remain untagged. (c8ae1ffb5)

• Use run credentials for run results, rescheduling, schedules, and environment-variable operations inside tasks. Run credentials remain limited to the current environment: shared schedules cannot be changed, and parent environment variables cannot be written. (cd58c750b)

• Deploy from GitHub Actions using Trusted publishing and GitHub OIDC without storing a Trigger.dev API key. These deployments run entirely on the build server and do not grant the CLI access to environment variables. (9aafe6989)

• Use GitHub Actions trusted publishing with preview archive and promote, without storing API keys. Preview deploys for closed or merged pull requests now archive their branch. preview archive also supports Preview environment API keys through TRIGGER_ACCESS_TOKEN. (d9172638a)

  Failed Preview archive operations now exit with an error for API-key and personal-token authentication too, including automatic cleanup during deploys. CI cleanup jobs that previously passed despite an archive failure will now fail. Concurrent cleanup jobs succeed when another job has already archived the same branch generation.

• Fix logs and spans with large numeric object keys failing to ingest and dropping the rest of their batch. (99a626aa3)

@trigger.dev/linear@4.8.4

Patch Changes

• Updated dependencies:
  • @trigger.dev/sdk@4.8.4
  • @trigger.dev/core@4.8.4

@trigger.dev/python@4.8.4

Patch Changes

• Updated dependencies:
  • @trigger.dev/sdk@4.8.4
  • @trigger.dev/core@4.8.4
  • @trigger.dev/build@4.8.4

@trigger.dev/react-hooks@4.8.4

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.8.4

@trigger.dev/redis-worker@4.8.4

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.8.4

@trigger.dev/rsc@4.8.4

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.8.4

@trigger.dev/schema-to-json@4.8.4

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.8.4

@trigger.dev/slack@4.8.4

Patch Changes

• Updated dependencies:
  • @trigger.dev/sdk@4.8.4
  • @trigger.dev/core@4.8.4

@trigger.dev/sdk@4.8.4

Patch Changes

• chat.agent now accepts only two kinds of message from a chat client: user messages, and answers to tool calls the agent made. A tool approval or tool output is merged onto the stored call it answers and runs with the input from the agent's own history, so a client can't add tool calls or change a call's input. chat.headStart drops tool calls from the history the client sends, and upsertIncomingMessage only adds user messages. (44feaaff6)
• Add infisicalAccessToken at @trigger.dev/sdk/oidc/infisical to authenticate tasks with Infisical using OIDC instead of stored credentials. Supports US, EU, and self-hosted instances, custom audiences, and Infisical organization scoping. (63b58f329)
• Add opt-in AWS session tags with awsCredentialProvider({ sessionTags: true }) for task-level IAM restrictions and attribute-based permissions. Tags come from the verified run identity. Update the role trust policy to allow sts:TagSession before enabling them; existing integrations remain untagged. (c8ae1ffb5)
• Use run credentials for run results, rescheduling, schedules, and environment-variable operations inside tasks. Run credentials remain limited to the current environment: shared schedules cannot be changed, and parent environment variables cannot be written. (cd58c750b)
• Create public tokens without scopes from inside tasks using run credentials, without requiring an environment secret key. (306d960ca)
• Updated dependencies:
  • @trigger.dev/core@4.8.4

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e3e14377-ad9d-4430-9a11-476282fdef72

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[devin-ai-integration]

Note

Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[github-actions]

🧭 Helm Chart Prerelease Published

Version: 4.8.4-pr5089.47ec9d7

Install:

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.8.4-pr5089.47ec9d7"

⚠️ This is a prerelease for testing. Do not use in production.