Summary

• The staging deploy workflow's cancel-in-progress: true concurrency group kills the GitHub Actions job on a new push, but does not cancel the cdk deploy CloudFormation update already underway , CFN keeps applying it until it reaches a terminal state on its own.
• The next queued deploy run then starts immediately and its cdk deploy collides with the still-running update: ValidationError: Stack:...CedarAwsStagingEnvironmentStack... is in UPDATE_IN_PROGRESS state and can not be updated.
• This is exactly what happened today: PR #2723's deploy was cancelled mid-update at 18:32 UTC by PR #2726/#2727's push, CloudFormation kept applying that update until 18:37:46, and PR #2727's Deploy AWS Staging run (started ~18:43) failed on the collision. The stack itself reached UPDATE_COMPLETE fine , only the next workflow run failed.
• Adds cedar_wait_for_stack_stable to aws/scripts/deploy-utils.sh, which polls the stack status and waits for any *_IN_PROGRESS state to clear (up to 15 min) before proceeding. Wired into deploy_stack() in aws/scripts/deploy-surface.sh, which is the single call site used by both the bootstrap and main deploy paths.

Test plan

• bash -n syntax check on both edited scripts
• Verified live CedarAwsStagingEnvironmentStack is currently UPDATE_COMPLETE (no residual stuck state)
• Next staging deploy run exercises the new wait , confirm no regression via Actions logs

🤖 Generated with Claude Code

https://claude.ai/code/session_01BWvDYfrsL4PAK3iqd3AzQU

Greptile Summary

The PR adds a CloudFormation stabilization gate before both bootstrap and normal CDK deployments.

• Polls the target environment stack while its status ends in _IN_PROGRESS.
• Waits up to 15 minutes by default, polling every 15 seconds.
• Covers both deploy_stack call paths through the shared helper.
• The new poll currently misclassifies AWS API failures as successful stability checks.

Confidence Score: 4/5

The PR should not merge until the stability check distinguishes a genuinely absent stack from AWS API failures that leave stability unconfirmed.

A failed status query currently returns success, allowing CDK deployment to begin while the target stack may still be updating and thereby preserving the collision path this change is intended to prevent.

Files Needing Attention: aws/scripts/deploy-utils.sh

Important Files Changed

Flowchart

### Issue 1
aws/scripts/deploy-utils.sh:67-70
**AWS Errors Bypass Waiting**

If `describe-stacks` fails because of a transient AWS API or network error while the stack is still updating, `|| true` turns the failure into an empty status and the next condition treats it as stable. The deployment then starts without confirming stability and can hit the same CloudFormation update collision this guard is intended to prevent. Distinguish an expected stack-not-found response from operational failures, and fail or retry the latter.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: ["fix(deploy): wait for CloudFor}