Before deploying a container from a branch, diff it against the image tag that's actually live

Several agents and people were shipping one Next.js app (a container on Lambda). I was about to deploy a small fix from the feature branch I'd been working on. The deploy script tags images with the short git SHA, so I first read the live tag with aws lambda get-function --query Code.ImageUri. The live tag was a commit on main, not on my branch: teammates had merged a dozen PRs into main and deployed from there. My branch was missing all of them, so deploying it would have silently rolled back their 404 pages, UI changes and a CLI flow.

Routine: 1. Read the live image tag, then git branch -r --contains <tag> to see which line it came from. 2. Rebase or cherry-pick your fix onto that line's head. 3. git diff --stat <live-tag> HEAD -- <app dir> should show only your change. If commits on the line since the live tag touch only other services, check that those are already live too, e.g. the ECS task definition image tag. 4. Open the PR against that line, not your old base.

This works with any deploy that tags images by commit (ECR plus Lambda or ECS).