hecks 2.6.0 → 2.7.0

data/lib/hecks/projections/deploy/preview/yaml_text.rb

@@ -0,0 +1,48 @@
+require "json"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Preview
+        # Text helpers the preview template's sections share: indentation and the
+        # rendering of a value as a YAML scalar or CloudFormation intrinsic.
+        module YamlText
+          PREVIEW_URL_TOKEN = "{{preview_url}}".freeze
+          PREVIEW_URL_SUB = "https://${PreviewDistribution.DomainName}".freeze
+
+          module_function
+
+          # Indents every non-empty line of a block.
+          #
+          # @param text [String] the block
+          # @param width [Integer] spaces to add
+          # @return [String] the indented block
+          def indent(text, width)
+            pad = " " * width
+            text.each_line.map { |line| line.strip.empty? ? line : "#{pad}#{line}" }.join
+          end
+
+          # Renders one environment or property value as a YAML scalar or intrinsic.
+          #
+          # @param value [String] a literal, optionally holding the `{{preview_url}}` token
+          # @return [String] a double-quoted scalar, or a `!Sub` when the token is present
+          def scalar(value)
+            return JSON.generate(value) unless value.include?(PREVIEW_URL_TOKEN)
+
+            "!Sub #{JSON.generate(value.gsub(PREVIEW_URL_TOKEN, PREVIEW_URL_SUB))}"
+          end
+
+          # Names the logical id of a container's generated secret.
+          #
+          # @param container [Containers::Entry] the container that declares the secret
+          # @param name [String] the environment variable name
+          # @return [String] the logical id, ending in `Secret`
+          def secret_id(container, name)
+            stem = "#{container.logical}#{name.sub(/_ARN\z/, '').split('_').map(&:capitalize).join}"
+            stem.end_with?("Secret") ? stem : "#{stem}Secret"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/preview.rb

@@ -0,0 +1,103 @@
+require_relative "preview/settings"
+require_relative "preview/template"
+require_relative "preview/script"
+
+module Hecks
+  module Projections
+    module Deploy
+      # Per-branch preview stacks for a `deployed_to("AwsFargate")` domain: one
+      # isolated copy of the stack per git branch, created and torn down by a
+      # generated script.
+      #
+      # Opt-in. A domain with no `preview` setting gets exactly the files it
+      # got before; `Fargate.call` asks `requested?` and merges in `call`'s
+      # files only when the answer is yes.
+      #
+      # ## What is generated
+      #
+      # - `preview.yaml`: a separate CloudFormation template, so a preview never
+      #   appears in a change set against the live stack (see `Template`).
+      # - `preview.sh`: `deploy` (create or update), `destroy`, `list`, `url`,
+      #   `name`, `ensure-database` and `login` (see `Script`).
+      # - The database step is a one-shot task declared in `preview.yaml`
+      #   and run by `preview.sh`; there is no separate file, because the
+      #   instance is reachable only from inside the VPC.
+      #
+      # ## Settings
+      #
+      # ```ruby
+      # deployed_to("AwsFargate") do
+      #   region "us-east-1"
+      #   preview do
+      #     containers [{ name: "web", port: 8080, host: true, default: true }]
+      #   end
+      # end
+      # ```
+      #
+      # `preview true` and a block with no settings accept every default. Keys:
+      #
+      # - `prefix`: stack, cluster, service and image repository name prefix.
+      #   Default `<stack_prefix>-<stack>-preview`.
+      # - `alb_prefix`: load balancer name prefix, at most 11 characters.
+      #   Default the first 8 letters of the stack name plus `pv`.
+      # - `owner_stack`: the stack whose VPC, subnets and compute security group
+      #   the preview attaches to. Default the `owner_stack` of a Shared main
+      #   stack, else the main stack.
+      # - `database_stack`: the stack whose outputs name the shared database
+      #   instance. Default `owner_stack`.
+      # - `database_endpoint_output`, `database_secret_output`: the output keys
+      #   holding the instance host and the master secret ARN. Defaults
+      #   `DatabaseEndpoint` and `DatabaseSecretArn`.
+      # - `db_prefix`: a preview's database is `<db_prefix>_pv_<env>`. Default
+      #   the stack name, lowercased, at most 30 characters.
+      # - `protected_databases`: names the database task refuses, added to the
+      #   main database, `postgres` and the two template databases. Default `[]`.
+      # - `protected_branches`: branches `preview.sh` refuses. Default
+      #   `["main", "master"]`.
+      # - `cpu`, `memory`: task size. Default the main stack's.
+      # - `log_retention_days`: a value CloudWatch accepts. Default `7`.
+      # - `session_cookie`: cookie name; sets `HECKS_SESSION_COOKIE` on the host
+      #   and is what `login` writes. Default the host's own default.
+      # - `first_admin`: whether `preview.sh` signs the deployer up and offers
+      #   `login`. Default `true`.
+      # - `signup_path`: the host route the signup posts to. Default `/signups`.
+      # - `landing_path`: the page `login` points the browser at. Default `/`.
+      # - `db_init_image`: image of the database task; needs `sh` and `psql`.
+      #   Default the public Postgres 16 alpine image.
+      # - `containers`: the containers the preview task runs. Default the main
+      #   stack's container list; see `Containers` for the entry keys.
+      #
+      # ## Why a preview mints no era and needs no bastion
+      #
+      # The host mints era 1 itself on an empty database, and the database
+      # task runs inside the VPC, so neither the main stack's bastion nor a
+      # tunnel is involved.
+      module Preview
+        module_function
+
+        # Answers whether a domain opted in to previews.
+        #
+        # @param deploy_settings [Hash{Symbol => Object}] the `deployed_to` settings
+        # @return [Boolean] true when a `preview` setting is present and not `false`
+        def requested?(deploy_settings)
+          value = deploy_settings[:preview]
+          !value.nil? && value != false
+        end
+
+        # Generates the preview files for one domain.
+        #
+        # @param deploy_settings [Hash{Symbol => Object}] the `deployed_to` settings
+        # @param main [Hash{Symbol => Object}] the main stack's facts; see `Settings.build`
+        # @return [Hash{String => String}] `"preview.yaml"` and `"preview.sh"`, or `{}` when
+        #   the domain did not opt in
+        # @raise [ArgumentError] if a preview setting is unknown or malformed
+        def call(deploy_settings:, main:)
+          return {} unless requested?(deploy_settings)
+
+          settings = Settings.build(deploy_settings[:preview], deploy_settings: deploy_settings, main: main)
+          { "preview.yaml" => Template.render(settings), "preview.sh" => Script.render(settings) }
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/scripts/deploy-service.sh.tmpl

@@ -0,0 +1,182 @@
+#!/usr/bin/env bash
+# GENERATED by bin/project_deploy -- re-run it to refresh this file rather
+# than hand-editing. Settings come from the domain's deployed_to("AwsFargate")
+# block; see Hecks::Projections::Deploy::Scripts for each key.
+#
+# Deploys ONE container's freshly built local image to the live ECS service,
+# under a fresh, unique ECR tag.
+#
+#   bash deploy-service.sh <service>
+#
+# Why it exists: `docker push` of a floating tag plus
+# `aws ecs update-service --force-new-deployment` looks like a deploy, but the
+# task definition still names the old tag, so the new image never runs. This
+# script reads the CURRENTLY ACTIVE task definition (the real source of truth,
+# not the template's parameters), pushes the local image under a never-reused
+# tag (<service>-<UTC timestamp>), swaps only that one container's image, and
+# registers and deploys the result. Every other container keeps its image.
+#
+# It then syncs the CloudFormation stack's matching *ImageTag parameter, with
+# --use-previous-template and UsePreviousValue for every other parameter, and
+# checks that only that one parameter changed. The template stays the source of
+# truth for what is live instead of drifting from it.
+#
+# Environment:
+#   LOCAL_IMAGE               local image to push, default <ecr repository>:latest
+#   SETTLE_TIMEOUT_SECS       default 1200, how long to wait for a rollout or stack update
+#   SKIP_POST_DEPLOY_SMOKE=1  passed through to smoke-after-deploy.sh
+set -euo pipefail
+
+#@@SETTINGS@@
+
+#@@SERVICES@@
+
+SERVICE_NAME="${1:?usage: deploy-service.sh <service> (one of: ${SERVICES})}"
+resolve_service "$SERVICE_NAME"
+
+SETTLE_TIMEOUT_SECS="${SETTLE_TIMEOUT_SECS:-1200}"
+LOCAL_IMAGE="${LOCAL_IMAGE:-${ECR_REPOSITORY}:latest}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+ACCOUNT_ID="$(aws sts get-caller-identity --query Account --output text)"
+ECR_HOST="${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com"
+TAG="${SERVICE_NAME}-$(date -u +%Y%m%d%H%M%S)"
+IMAGE_URI="${ECR_HOST}/${ECR_REPOSITORY}:${TAG}"
+SCRATCH_DIR="$(mktemp -d)"
+trap 'rm -rf "$SCRATCH_DIR"' EXIT
+
+# Seconds elapsed since $1 (a value of $SECONDS) exceeds the settle timeout.
+timed_out() { [ $((SECONDS - $1)) -gt "$SETTLE_TIMEOUT_SECS" ]; }
+
+echo "==> tagging ${LOCAL_IMAGE} as ${IMAGE_URI}"
+docker tag "$LOCAL_IMAGE" "$IMAGE_URI"
+
+# A private docker config with no credential helper: a helper that blocks on a
+# keychain prompt hangs forever in any unattended shell.
+echo "==> ecr login"
+DOCKER_CONFIG_DIR="${SCRATCH_DIR}/docker-config"
+mkdir -p "$DOCKER_CONFIG_DIR"
+echo '{}' > "${DOCKER_CONFIG_DIR}/config.json"
+aws ecr get-login-password --region "$REGION" \
+  | docker --config "$DOCKER_CONFIG_DIR" login --username AWS --password-stdin "$ECR_HOST"
+
+echo "==> pushing ${IMAGE_URI}"
+docker --config "$DOCKER_CONFIG_DIR" push "$IMAGE_URI"
+
+echo "==> reading the ACTIVE task definition (the real source of truth)"
+CURRENT_TASKDEF="$(aws ecs describe-services --cluster "$CLUSTER" --services "$ECS_SERVICE" \
+  --region "$REGION" --query 'services[0].taskDefinition' --output text)"
+aws ecs describe-task-definition --task-definition "$CURRENT_TASKDEF" --region "$REGION" \
+  --query 'taskDefinition' --output json > "${SCRATCH_DIR}/current.json"
+
+SERVICE_NAME="$SERVICE_NAME" IMAGE_URI="$IMAGE_URI" python3 - "${SCRATCH_DIR}/current.json" "${SCRATCH_DIR}/new.json" <<'PYEOF'
+import json, os, sys
+
+service_name = os.environ["SERVICE_NAME"]
+image_uri = os.environ["IMAGE_URI"]
+with open(sys.argv[1]) as f:
+    td = json.load(f)
+found = False
+for c in td["containerDefinitions"]:
+    if c["name"] == service_name:
+        c["image"] = image_uri
+        found = True
+if not found:
+    raise SystemExit("no container named %r in the active task definition" % service_name)
+for key in ["taskDefinitionArn", "revision", "status", "requiresAttributes",
+            "compatibilities", "registeredAt", "registeredBy"]:
+    td.pop(key, None)
+with open(sys.argv[2], "w") as f:
+    json.dump(td, f)
+PYEOF
+
+echo "==> registering a new task definition revision (only the ${SERVICE_NAME} image changes)"
+NEW_TASKDEF_ARN="$(aws ecs register-task-definition --region "$REGION" \
+  --cli-input-json "file://${SCRATCH_DIR}/new.json" \
+  --query 'taskDefinition.taskDefinitionArn' --output text)"
+echo "    -> ${NEW_TASKDEF_ARN}"
+
+echo "==> updating the service"
+aws ecs update-service --cluster "$CLUSTER" --service "$ECS_SERVICE" --region "$REGION" \
+  --task-definition "$NEW_TASKDEF_ARN" --query 'service.taskDefinition' --output text
+
+echo "==> waiting for the rollout to settle to a single deployment"
+started=$SECONDS
+while true; do
+  count="$(aws ecs describe-services --cluster "$CLUSTER" --services "$ECS_SERVICE" \
+    --region "$REGION" --query 'length(services[0].deployments)' --output text)"
+  [ "$count" = "1" ] && break
+  if timed_out "$started"; then
+    echo "==> the rollout did not settle within ${SETTLE_TIMEOUT_SECS}s; the service is still deploying" >&2
+    exit 1
+  fi
+  sleep 10
+done
+
+echo "==> done. now running:"
+aws ecs describe-task-definition --task-definition "$NEW_TASKDEF_ARN" --region "$REGION" \
+  --query "taskDefinition.containerDefinitions[?name=='${SERVICE_NAME}'].image" --output text
+
+echo "==> syncing CloudFormation's ${CFN_PARAM_KEY} so the stack stops drifting from reality"
+stack_parameters() {
+  aws cloudformation describe-stacks --stack-name "$STACK" --region "$REGION" \
+    --query 'Stacks[0].Parameters[].[ParameterKey,ParameterValue]' --output json
+}
+stack_parameters > "${SCRATCH_DIR}/params-before.json"
+ALL_PARAM_KEYS="$(aws cloudformation describe-stacks --stack-name "$STACK" --region "$REGION" \
+  --query 'Stacks[0].Parameters[].ParameterKey' --output text)"
+read -r -a PARAM_KEYS <<< "$ALL_PARAM_KEYS"
+CFN_ARGS=()
+found=0
+for key in "${PARAM_KEYS[@]}"; do
+  if [ "$key" = "$CFN_PARAM_KEY" ]; then
+    CFN_ARGS+=("ParameterKey=${key},ParameterValue=${TAG}")
+    found=1
+  else
+    CFN_ARGS+=("ParameterKey=${key},UsePreviousValue=true")
+  fi
+done
+if [ "$found" != "1" ]; then
+  echo "stack ${STACK} has no parameter named ${CFN_PARAM_KEY}; the service is deployed but the stack was not updated" >&2
+  exit 1
+fi
+aws cloudformation update-stack --stack-name "$STACK" --region "$REGION" \
+  --use-previous-template --capabilities CAPABILITY_IAM --parameters "${CFN_ARGS[@]}" \
+  --query 'StackId' --output text
+
+echo "==> waiting for the CloudFormation stack update to settle"
+started=$SECONDS
+while true; do
+  stack_status="$(aws cloudformation describe-stacks --stack-name "$STACK" --region "$REGION" \
+    --query 'Stacks[0].StackStatus' --output text)"
+  case "$stack_status" in
+    UPDATE_COMPLETE) echo "    -> ${stack_status}"; break ;;
+    *ROLLBACK*|*FAILED*)
+      echo "    -> ${stack_status}: the CloudFormation update failed, investigate before relying on it" >&2
+      exit 1 ;;
+  esac
+  if timed_out "$started"; then
+    echo "==> the stack update did not settle within ${SETTLE_TIMEOUT_SECS}s (last: ${stack_status})" >&2
+    exit 1
+  fi
+  sleep 10
+done
+
+echo "==> checking that only ${CFN_PARAM_KEY} changed"
+stack_parameters > "${SCRATCH_DIR}/params-after.json"
+python3 - "${SCRATCH_DIR}/params-before.json" "${SCRATCH_DIR}/params-after.json" "$CFN_PARAM_KEY" "$TAG" <<'PYEOF'
+import json, sys
+
+before = dict(json.load(open(sys.argv[1])))
+after = dict(json.load(open(sys.argv[2])))
+key, tag = sys.argv[3], sys.argv[4]
+changed = sorted(k for k in set(before) | set(after) if before.get(k) != after.get(k))
+if changed != [key] or after.get(key) != tag:
+    raise SystemExit("expected only %s to change to %s, but changed: %s" % (key, tag, changed))
+print("    -> %s is now %s; no other parameter changed" % (key, tag))
+PYEOF
+
+# The deploy itself is done. Finish with the smoke, whose own exit codes (20-23)
+# are distinct from a failed deploy step's. SKIP_POST_DEPLOY_SMOKE=1 skips it.
+echo "==> deploy succeeded"
+bash "${SCRIPT_DIR}/smoke-after-deploy.sh"

data/lib/hecks/projections/deploy/scripts/expected-era.header

@@ -0,0 +1,17 @@
+# The domain eras the post-deploy check accepts as "the era that should be
+# running", one era id per line. Blank lines and lines starting with # are
+# ignored. While no era is listed the check only verifies that the host reports
+# one, and does not compare it.
+#
+# Changing the era on a roll:
+#   1. Add the NEW era id below and merge that BEFORE the roll, so a scheduled
+#      check does not fail the moment the new era boots.
+#   2. Roll. The check then passes on the new era.
+#   3. Once the roll has settled, delete the OLD era id, so a rollback to it, or
+#      a fork of the journal back onto it, fails the check instead of passing.
+#
+# The id is what the host reports at GET /version, the same id the era mint
+# prints. Compare a live host with this file:
+#
+#   bin/check_era https://host.example expected-era
+#   make check-era URL=https://host.example

data/lib/hecks/projections/deploy/scripts/hosting.mk.tmpl

@@ -0,0 +1,54 @@
+# GENERATED by bin/project_deploy -- re-run it to refresh this file rather
+# than hand-editing. Included by the Makefile beside it; settings come from the
+# domain's deployed_to("AwsFargate") block (see
+# Hecks::Projections::Deploy::Scripts for each key).
+#
+# HECKS_ROOT is a checkout of one pinned Hecks release, fetched once into a
+# cache directory, so the domain image is built from the same Hecks on every
+# machine. It replaces any path to a working copy: ROOT below points the
+# Makefile's build and mint-era steps at it. Override HECKS_VERSION to build
+# from another release, or HECKS_ROOT to use a checkout you manage yourself.
+
+HECKS_VERSION   ?= @@RELEASE@@
+HECKS_SOURCE    ?= @@SOURCE@@
+HECKS_CACHE_DIR ?= @@CACHE_DIR@@
+HECKS_ROOT      ?= $(HECKS_CACHE_DIR)/hecks-$(HECKS_VERSION)
+ROOT            := $(HECKS_ROOT)
+SERVICE         ?= @@SERVICE@@
+URL             ?= @@URL@@
+
+.PHONY: hecks-release deploy-service smoke-after-deploy check-era
+
+build: hecks-release
+
+# Fetches the pinned release's tag into HECKS_ROOT unless it is already there,
+# and refuses a checkout that is not exactly that tag.
+hecks-release:
+	@if [ -f "$(HECKS_ROOT)/bin/project_wasm" ]; then \
+		echo "hecks v$(HECKS_VERSION) is already at $(HECKS_ROOT)"; \
+	else \
+		echo "Fetching hecks v$(HECKS_VERSION) from $(HECKS_SOURCE) into $(HECKS_ROOT)..."; \
+		mkdir -p "$(HECKS_CACHE_DIR)" && \
+		git clone --quiet --depth 1 --branch "v$(HECKS_VERSION)" "$(HECKS_SOURCE)" "$(HECKS_ROOT)"; \
+	fi
+	@tag="$$(git -C "$(HECKS_ROOT)" describe --tags --exact-match 2>/dev/null)"; \
+		if [ "$$tag" != "v$(HECKS_VERSION)" ]; then \
+			echo "$(HECKS_ROOT) is at '$$tag', not v$(HECKS_VERSION). Remove it and re-run, or set HECKS_ROOT."; \
+			exit 1; \
+		fi
+
+# Pushes one container's already-built local image under a fresh tag and rolls
+# it out. Build the image first (docker-build); see deploy-service.sh.
+deploy-service:
+	@echo "Deploying $(SERVICE) with deploy-service.sh (pushes its local image, rolls the ECS service)..."
+	bash ./deploy-service.sh $(SERVICE)
+
+# Waits for the last roll to settle, then dispatches and follows the smoke.
+# SKIP_POST_DEPLOY_SMOKE=1 opts out, DRY_RUN=1 dispatches nothing.
+smoke-after-deploy:
+	bash ./smoke-after-deploy.sh
+
+# Compares the era a live host reports at GET /version with expected-era.
+check-era:
+	@test -n "$(URL)" || { echo "usage: make check-era URL=https://host.example"; exit 1; }
+	ruby "$(HECKS_ROOT)/bin/check_era" "$(URL)" expected-era

data/lib/hecks/projections/deploy/scripts/settings.rb

@@ -0,0 +1,114 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Scripts
+        # The `deployed_to("AwsFargate")` settings the hosting scripts read,
+        # with their defaults and the check each value must pass.
+        #
+        # Every value ends up inside a shell script or a Makefile, so each one
+        # is refused unless it matches a conservative pattern for what it names
+        # (a region, a cluster, a GitHub repository). That check is what lets
+        # the renderers write values without per-context escaping.
+        #
+        # The containers, their ECR repositories and image-tag parameters, and
+        # the default cluster and service names are not settings here. They come
+        # from the template generator's own resolved plan
+        # (`Fargate::Settings::Plan`), so a script can only name what the
+        # generated `template.yaml` defines.
+        #
+        # The keys are documented on `Scripts`.
+        class Settings
+          RESOURCE  = /\A[a-zA-Z0-9][a-zA-Z0-9_-]*\z/
+          REGION    = /\A[a-z]{2}(-[a-z]+)+-\d\z/
+          GITHUB_REPO = %r{\A[\w.-]+/[\w.-]+\z}
+          WORKFLOW  = /\A[\w.-]+\.ya?ml\z/
+          REF       = %r{\A[\w./-]+\z}
+          ERA       = /\A[0-9a-zA-Z._-]+\z/
+          RELEASE   = /\Av?\d+\.\d+\.\d+([.-][0-9A-Za-z.-]+)?\z/
+          SOURCE    = %r{\A[\w.@:/~-]+\z}
+          MAKE_PATH = /\A[^\s#]+\z/
+
+          DEFAULT_SOURCE = "https://github.com/heckslabs/hecks.git".freeze
+          DEFAULT_CACHE_DIR = "$(HOME)/.cache/hecks".freeze
+
+          attr_reader :region, :stack, :cluster, :service, :containers, :hecks_release, :hecks_source,
+                      :hecks_cache_dir, :smoke_repo, :smoke_workflow, :smoke_ref, :expected_eras, :public_url
+
+          # Reads and checks every hosting setting.
+          #
+          # @param deploy_settings [Hash{Symbol => Object}] the world's
+          #   `deployed_to("AwsFargate")` settings
+          # @param plan [Fargate::Settings::Plan] the template generator's resolved settings:
+          #   its `layout` holds the containers, its `names` the cluster and service
+          # @param stack_name [String] the CloudFormation stack
+          # @param region [String] the validated AWS region
+          # @raise [ArgumentError] if `hecks_release` is missing, or a value
+          #   does not match the pattern for what it names
+          def initialize(deploy_settings:, plan:, stack_name:, region:)
+            @raw = deploy_settings
+            @region = check(:region, region, REGION)
+            @stack = check(:stack_name, stack_name, RESOURCE)
+            @cluster = check(:ecs_cluster, fetch(:ecs_cluster, plan.names.fetch(:cluster)), RESOURCE)
+            @service = check(:ecs_service, fetch(:ecs_service, plan.names.fetch(:service)), RESOURCE)
+            @containers = plan.layout.all
+            @hecks_release = read_release
+            @hecks_source = check(:hecks_source, fetch(:hecks_source, DEFAULT_SOURCE), SOURCE)
+            @hecks_cache_dir = check(:hecks_cache_dir, fetch(:hecks_cache_dir, DEFAULT_CACHE_DIR), MAKE_PATH)
+            read_smoke
+            @expected_eras = list(:expected_eras, []).each { |era| check(:expected_eras, era, ERA) }
+            @public_url = optional(:public_url, %r{\Ahttps?://[^\s'"$`\\]+\z})
+          end
+
+          private
+
+          def read_release
+            release = fetch(:hecks_release, nil)
+            raise ArgumentError, missing_release_message unless release
+
+            check(:hecks_release, release.to_s, RELEASE).delete_prefix("v")
+          end
+
+          def read_smoke
+            @smoke_repo = optional(:smoke_repo, GITHUB_REPO)
+            @smoke_workflow = optional(:smoke_workflow, WORKFLOW)
+            @smoke_ref = check(:smoke_ref, fetch(:smoke_ref, "main"), REF)
+          end
+
+          def missing_release_message
+            <<~MSG
+              deployed_to("AwsFargate") enables hosting_scripts but names no hecks_release. Pin one, e.g.:
+
+                  deployed_to("AwsFargate") do
+                    ...
+                    hosting_scripts true
+                    hecks_release "2.5.1"
+                  end
+
+              so the domain image is built from a fixed Hecks release, not from a checkout on one machine.
+            MSG
+          end
+
+          def fetch(key, default)
+            @raw.key?(key) ? @raw[key] : default
+          end
+
+          def optional(key, pattern)
+            value = fetch(key, nil)
+            value.nil? ? nil : check(key, value.to_s, pattern)
+          end
+
+          def list(key, default)
+            Array(fetch(key, default)).map(&:to_s)
+          end
+
+          def check(key, value, pattern)
+            return value if value.is_a?(String) && value.match?(pattern)
+
+            raise ArgumentError,
+                  "deployed_to(\"AwsFargate\") #{key} #{value.inspect} is not a valid value (expected #{pattern.inspect})"
+          end
+        end
+      end
+    end
+  end
+end