feat(ci): add unified deployment pipeline with preflight checks and rollback support

.github/PULL_REQUEST_TEMPLATE.md

@@ -25,6 +25,23 @@ A visual demonstration is strongly recommended, for both the original and new ch
 - [ ] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). If N/A, write N/A here and check the checkbox.
 - [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works.
 
+## Migration Type
+
+<!-- Required if this PR changes packages/prisma/migrations/. See MIGRATION_POLICY.md. -->
+
+- [ ] N/A - no Prisma migration changes
+- [ ] EXPAND - backward-compatible schema change
+- [ ] DATA-BACKFILL - data movement/backfill with validation plan
+- [ ] CONTRACT - cleanup/destructive migration with explicit approval
+
+Rollback compatibility:
+
+<!-- Explain how the current deployed app and rollback target remain compatible with the resulting schema. -->
+
+Backfill / cleanup plan:
+
+<!-- Required for DATA-BACKFILL or CONTRACT. Include owner, validation query, batching/failure handling, and approval. -->
+
 ## How should this be tested?
 
 <!-- Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration. Write details that help to start the tests -->

.github/workflows/api-deploy.yml

@@ -1,17 +1,24 @@
 name: Build Connector API, Push Docker Image, Deploy to EC2
+# DEPRECATED — Auto-deploy on PR merge is deprecated.
+# Deployment is now managed by .github/workflows/deploy-all.yml
+# which provides unified staging/production deployment for all services (Web + API + Worker).
+# The `pull_request` trigger below will be removed in a future release.
+# Use `workflow_dispatch` for manual deployments, or rely on deploy-all.yml for automated deploys.
+#
+# Deprecated triggers will be removed in Phase 12.
 
 on:
-  pull_request:
-    types:
-      - closed
-    branches:
-      - main
-      - develop
-    paths:
-      - "apps/connector/**"
-      - "packages/**"
-      - "infra/docker/connector/**"
-      - ".github/workflows/api-deploy.yml"
+  # pull_request:
+  #   types:
+  #     - closed
+  #   branches:
+  #     - main
+  #     - develop
+  #   paths:
+  #     - "apps/connector/**"
+  #     - "packages/**"
+  #     - "infra/docker/connector/**"
+  #     - ".github/workflows/api-deploy.yml"
   workflow_dispatch:
     inputs:
       branch:
@@ -315,10 +322,11 @@ jobs:
           push: true
           build-args: |
             GIT_HASH=${{ steps.hash.outputs.GIT_HASH }}
-            SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-            SENTRY_ORG=${{ secrets.SENTRY_ORG }}
-            SENTRY_PROJECT=${{ steps.key_values.outputs.SENTRY_PROJECT }}
             # SENTRY_UPLOAD_STRICT=true
+          secrets: |
+            sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+            sentry_org=${{ secrets.SENTRY_ORG }}
+            sentry_project=${{ steps.key_values.outputs.SENTRY_PROJECT }}
           tags: |
             ${{ steps.login-ecr.outputs.registry }}/${{ steps.key_values.outputs.REPO_NAME }}:${{ steps.hash.outputs.GIT_HASH }}
             ${{ steps.login-ecr.outputs.registry }}/${{ steps.key_values.outputs.REPO_NAME }}:latest