feat(trigger): add org tags to all trigger job runs

[Marfuen]

Add await tags.add([org:${organizationId}]) to all 25 trigger tasks that receive an organizationId, making it easy to filter and identify which organization a job was run for in the trigger.dev dashboard.

Scheduled/bulk tasks that iterate over all orgs are excluded since they don't have a single organizationId.

Also updates the vendor extraction prompt to prefer company names over product names (e.g. "Anthropic" not "Claude", "OpenAI" not "ChatGPT").

What does this PR do?

• Fixes #XXXX (GitHub issue number)
• Fixes COMP-XXXX (Linear issue number - should be visible at the bottom of the GitHub issue description)

Visual Demo (For contributors especially)

A visual demonstration is strongly recommended, for both the original and new change (video / image - any one).

Video Demo (if applicable):

• Show screen recordings of the issue or feature.
• Demonstrate how to reproduce the issue, the behavior before and after the change.

Image Demo (if applicable):

• Add side-by-side screenshots of the original and updated change.
• Highlight any significant change(s).

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

• Are there environment variables that should be set?
• What are the minimal test data to have?
• What is expected (happy path) to have (input and output)?
• Any other important info that could help to test that PR

Checklist

• I haven't read the contributing guide
• My code doesn't follow the style guidelines of this project
• I haven't commented my code, particularly in hard-to-understand areas
• I haven't checked if my changes generate no new warnings

[cursor]

PR Summary

Medium Risk
Mostly mechanical instrumentation across many Trigger.dev tasks, but it touches a wide set of background jobs and adds a prompt/schema change in onboarding vendor extraction that could alter vendor matching and URL enrichment behavior.

Overview
Adds org-level tagging to Trigger.dev runs. All Trigger.dev tasks that take an organizationId now call await tags.add([org:${organizationId}]), enabling filtering/grouping by org in the Trigger.dev dashboard.

Refines onboarding vendor extraction. The vendor extraction AI schema/prompt now captures both a canonical parent-company vendor_name and the user-provided original_name, and uses either name when applying custom vendor URL overrides to reduce product-vs-company mismatches.

^{Reviewed by Cursor Bugbot for commit 33d726b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	Apr 7, 2026 4:55pm
comp-framework-editor	Ready	Preview, Comment	Apr 7, 2026 4:55pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal	Skipped		Apr 7, 2026 4:55pm

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Tag addition outside documented "never throw" try-catch
  • Moved the tag addition inside the task try-catch so tag errors return a graceful failure.
• ✅ Fixed: Prompt change causes duplicate vendors via name mismatch
  • Added product alias capture and used it to merge custom URLs and dedupe fallback vendor creation.

Or push these changes by commenting:

@cursor push 2404e9b756

Preview (2404e9b756)

diff --git a/apps/api/src/trigger/cloud-security/run-cloud-security-scan.ts b/apps/api/src/trigger/cloud-security/run-cloud-security-scan.ts
--- a/apps/api/src/trigger/cloud-security/run-cloud-security-scan.ts
+++ b/apps/api/src/trigger/cloud-security/run-cloud-security-scan.ts
@@ -20,18 +20,17 @@
     const { connectionId, organizationId, providerSlug, connectionName } =
       payload;
 
-    await tags.add([`org:${organizationId}`]);
+    try {
+      await tags.add([`org:${organizationId}`]);
 
-    logger.info(
-      `Starting cloud security scan for connection: ${connectionName}`,
-      {
-        connectionId,
-        provider: providerSlug,
-        organizationId,
-      },
-    );
-
-    try {
+      logger.info(
+        `Starting cloud security scan for connection: ${connectionName}`,
+        {
+          connectionId,
+          provider: providerSlug,
+          organizationId,
+        },
+      );
       // Verify connection is still active
       const connection = await db.integrationConnection.findUnique({
         where: { id: connectionId },

diff --git a/apps/app/src/trigger/tasks/onboarding/onboard-organization-helpers.ts b/apps/app/src/trigger/tasks/onboarding/onboard-organization-helpers.ts
--- a/apps/app/src/trigger/tasks/onboarding/onboard-organization-helpers.ts
+++ b/apps/app/src/trigger/tasks/onboarding/onboard-organization-helpers.ts
@@ -40,6 +40,7 @@
 
 export type VendorData = {
   vendor_name: string;
+  source_vendor_names?: string[];
   vendor_website: string;
   vendor_description: string;
   category: VendorCategory;
@@ -266,6 +267,7 @@
             type: 'object',
             properties: {
               vendor_name: { type: 'string' },
+              source_vendor_names: { type: 'array', items: { type: 'string' } },
               vendor_website: { type: 'string' },
               vendor_description: { type: 'string' },
               category: { type: 'string', enum: Object.values(VendorCategory) },
@@ -292,7 +294,7 @@
       additionalProperties: false,
     }),
     system:
-      'Extract vendor names from the following questions and answers. Return their name (grammar-correct), website, description, category, inherent probability, inherent impact, residual probability, and residual impact. IMPORTANT: Always use the parent company name, not the product name (e.g. "Anthropic" not "Claude", "OpenAI" not "ChatGPT", "Alphabet" is acceptable as "Google", "Meta" is acceptable as "Meta").',
+      'Extract vendor names from the following questions and answers. Return their name (grammar-correct), website, description, category, inherent probability, inherent impact, residual probability, and residual impact. IMPORTANT: Always use the parent company name, not the product name (e.g. "Anthropic" not "Claude", "OpenAI" not "ChatGPT", "Alphabet" is acceptable as "Google", "Meta" is acceptable as "Meta"). If the answers mention product names, include them in source_vendor_names for that vendor.',
     prompt: questionsAndAnswers.map((q) => `${q.question}\n${q.answer}`).join('\n'),
   });
 
@@ -300,15 +302,31 @@
 
   // Merge custom vendor URLs - user-provided URLs take precedence
   for (const vendor of vendors) {
-    const customUrl = customVendorUrls.get(vendor.vendor_name.toLowerCase());
+    let customUrl = customVendorUrls.get(vendor.vendor_name.toLowerCase());
+    if (!customUrl && vendor.source_vendor_names) {
+      for (const sourceName of vendor.source_vendor_names) {
+        customUrl = customVendorUrls.get(sourceName.toLowerCase());
+        if (customUrl) {
+          break;
+        }
+      }
+    }
     if (customUrl) {
       logger.info(`Using custom URL for vendor ${vendor.vendor_name}: ${customUrl}`);
       vendor.vendor_website = customUrl;
     }
   }
 
-  // Track which vendors were extracted by AI
-  const extractedVendorNames = new Set(vendors.map((v) => v.vendor_name.toLowerCase()));
+  // Track which vendors were extracted by AI (including product aliases)
+  const extractedVendorNames = new Set<string>();
+  for (const vendor of vendors) {
+    extractedVendorNames.add(vendor.vendor_name.toLowerCase());
+    if (vendor.source_vendor_names) {
+      for (const sourceName of vendor.source_vendor_names) {
+        extractedVendorNames.add(sourceName.toLowerCase());
+      }
+    }
+  }
 
   // Ensure ALL vendors from the software field are added (not just custom ones)
   // This catches any vendors the AI failed to extract

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1d77761. Configure here.}

[claudfuen]

🎉 This PR is included in version 3.17.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀