@fjall/components-infrastructure 3.11.0 → 4.0.0

package/dist/lib/patterns/aws/devSubstrate.js

@@ -1,13 +1,14 @@
 import { CfnOutput, Duration, Stack, Tags } from "aws-cdk-lib";
 import { Port } from "aws-cdk-lib/aws-ec2";
 import { Cluster } from "aws-cdk-lib/aws-ecs";
-import { Repository, TagMutability } from "aws-cdk-lib/aws-ecr";
+import { Repository, TagMutability, TagStatus } from "aws-cdk-lib/aws-ecr";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
 import { PublicHostedZone } from "aws-cdk-lib/aws-route53";
 import { LoadBalancerTarget } from "aws-cdk-lib/aws-route53-targets";
 import { SqsDestination } from "aws-cdk-lib/aws-s3-notifications";
 import { Construct } from "constructs";
+import { buildCacheRepositoryName, CACHE_REPO_UNTAGGED_RETENTION_DAYS } from "@fjall/util/docker";
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -249,6 +250,30 @@ export class DevSubstrate extends Construct {
                 // first same-branch recreate (BUG-22).
                 tagMutability: TagMutability.MUTABLE
             });
+        // Buildx registry cache for slot builds, named by the same helper as the app
+        // path's `<repo>-cache` so `fjall dev up` derives this URI from the slot
+        // repo's without a second wire field. Adopts on the same flag: both repos are
+        // RETAIN, so a rolled-back create leaves BOTH behind, and a create-only cache
+        // repo would fail the very retry `adoptSlotEcr` exists to rescue.
+        const slotCacheRepositoryName = buildCacheRepositoryName(slotEcrRepositoryName);
+        if (props.adoptSlotEcr === true) {
+            Repository.fromRepositoryName(this, `${slotEcrId}Cache`, slotCacheRepositoryName);
+        }
+        else {
+            const slotCacheRepository = new Ecr(this, `${slotEcrId}Cache`, {
+                repositoryName: slotCacheRepositoryName,
+                // buildx overwrites the per-repo cache manifest tag on every export.
+                tagMutability: TagMutability.MUTABLE
+            });
+            // Each `mode=max` export orphans the previous manifest's blobs. The
+            // dev-deploy role holds no BatchDeleteImage or PutLifecyclePolicy, so this
+            // rule is the ONLY reclaim path — without it the cache grows without bound
+            // in a customer's dev account. An adopted repo keeps its existing policy.
+            slotCacheRepository.addLifecycleRule({
+                tagStatus: TagStatus.UNTAGGED,
+                maxImageAge: Duration.days(CACHE_REPO_UNTAGGED_RETENTION_DAYS)
+            });
+        }
         return {
             vpc,
             slotSecurityGroup,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "3.11.0",
+  "version": "4.0.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^3.11.0",
-    "@fjall/util": "^3.11.0",
+    "@fjall/generator": "^4.0.0",
+    "@fjall/util": "^4.0.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "a15125ea026d52428ff5433d098699899695ca3f"
+  "gitHead": "14031063ccd2685e390b70f6a3f4efe2bac7ced9"
 }