@fjall/components-infrastructure 3.11.0 → 4.1.0

package/dist/lib/patterns/aws/devSubstrate.d.ts

@@ -38,6 +38,18 @@ export interface IDevSubstrateProps {
      * account where the repo was provisioned out-of-band.
      */
     readonly adoptSlotEcr?: boolean;
+    /**
+     * When `true`, adopt an already-existing slot build-cache ECR repository
+     * (`fjall-dev-<appKebab>-slots-cache`) by reference instead of creating one.
+     * Independent of {@link adoptSlotEcr} on purpose: an app whose slots repo
+     * predates the build-cache feature runs the substrate in slot-adopt mode, yet
+     * its cache repo does NOT exist and MUST be created on the next redeploy —
+     * coupling the two would import a non-existent cache repo and the slot builds
+     * would stay permanently uncached. The producer probes each repo's existence
+     * separately (webapp `shouldAdoptSlotEcr` / `shouldAdoptCacheEcr`). Defaults to
+     * `false`: create the cache repo with the untagged-image lifecycle rule.
+     */
+    readonly adoptCacheEcr?: boolean;
     /**
      * Deploy phase for the R2 two-step cert-hang guard. `"zone"` synthesises the
      * `devDomain` zone + cross-account NS delegation only; `"full"` additionally

package/dist/lib/patterns/aws/devSubstrate.js

@@ -1,13 +1,14 @@
 import { CfnOutput, Duration, Stack, Tags } from "aws-cdk-lib";
 import { Port } from "aws-cdk-lib/aws-ec2";
 import { Cluster } from "aws-cdk-lib/aws-ecs";
-import { Repository, TagMutability } from "aws-cdk-lib/aws-ecr";
+import { Repository, TagMutability, TagStatus } from "aws-cdk-lib/aws-ecr";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
 import { PublicHostedZone } from "aws-cdk-lib/aws-route53";
 import { LoadBalancerTarget } from "aws-cdk-lib/aws-route53-targets";
 import { SqsDestination } from "aws-cdk-lib/aws-s3-notifications";
 import { Construct } from "constructs";
+import { buildCacheRepositoryName, CACHE_REPO_UNTAGGED_RETENTION_DAYS } from "@fjall/util/docker";
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -249,6 +250,31 @@ export class DevSubstrate extends Construct {
                 // first same-branch recreate (BUG-22).
                 tagMutability: TagMutability.MUTABLE
             });
+        // Buildx registry cache for slot builds, named by the same helper as the app
+        // path's `<repo>-cache` so `fjall dev up` derives this URI from the slot repo's
+        // without a second wire field. Adopt is gated on its OWN `adoptCacheEcr` flag,
+        // NOT `adoptSlotEcr`: an app whose slots repo predates the cache feature
+        // redeploys in slot-adopt mode with no cache repo yet — coupling the two would
+        // import a non-existent repo and slot builds would stay permanently uncached.
+        const slotCacheRepositoryName = buildCacheRepositoryName(slotEcrRepositoryName);
+        if (props.adoptCacheEcr === true) {
+            Repository.fromRepositoryName(this, `${slotEcrId}Cache`, slotCacheRepositoryName);
+        }
+        else {
+            const slotCacheRepository = new Ecr(this, `${slotEcrId}Cache`, {
+                repositoryName: slotCacheRepositoryName,
+                // buildx overwrites the per-repo cache manifest tag on every export.
+                tagMutability: TagMutability.MUTABLE
+            });
+            // Each `mode=max` export orphans the previous manifest's blobs. The
+            // dev-deploy role holds no BatchDeleteImage or PutLifecyclePolicy, so this
+            // rule is the ONLY reclaim path — without it the cache grows without bound
+            // in a customer's dev account. An adopted repo keeps its existing policy.
+            slotCacheRepository.addLifecycleRule({
+                tagStatus: TagStatus.UNTAGGED,
+                maxImageAge: Duration.days(CACHE_REPO_UNTAGGED_RETENTION_DAYS)
+            });
+        }
         return {
             vpc,
             slotSecurityGroup,

package/dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs

@@ -4,9 +4,17 @@
  *
  * Re-invocation safety: ECS hook responses do NOT carry state between
  * IN_PROGRESS invocations. On every invocation we reconstruct the
- * deterministic startedBy tag from the event's targetServiceRevisionArn and
- * use ListTasks to find an existing running migration. RunTask fires only on
- * the first invocation.
+ * deterministic startedBy tag from the event's
+ * executionDetails.targetServiceRevisionArn and use ListTasks to find an
+ * existing running migration. RunTask fires only on the first invocation.
+ *
+ * Event contract: the target revision ARN is nested under `executionDetails`
+ * and the `executionId` is top-level — see AWS "Lambda hooks for Amazon ECS
+ * service deployments" (developerguide/lambda-lifecycle-hooks.html). Reading
+ * the revision ARN from the wrong level collapses the startedBy tag to a
+ * shared constant across every deploy, so ListTasks can adopt another
+ * deployment's task (cross-deploy race). A missing revision ARN therefore
+ * FAILS the hook loudly rather than proceeding with a shared tag.
  *
  * CommonJS rather than ESM because Code.fromInline lands the source as
  * `index.js`, which Lambda treats as CommonJS by default.
@@ -37,6 +45,26 @@ function startedByTag(targetServiceRevisionArn) {
   return `fjall-migrate-${suffix}`.slice(0, 36);
 }
 
+// The revision ARN is nested under executionDetails in the ECS lifecycle-hook
+// event; the top-level fallback tolerates a future/legacy shape without
+// reopening the shared-tag race (nested is read first).
+function extractTargetServiceRevisionArn(event) {
+  const nested =
+    event &&
+    event.executionDetails &&
+    event.executionDetails.targetServiceRevisionArn;
+  const topLevel = event && event.targetServiceRevisionArn;
+  return nested || topLevel || undefined;
+}
+
+// executionId is top-level in the AWS contract; nested fallback is defensive.
+function extractExecutionId(event) {
+  const topLevel = event && event.executionId;
+  const nested =
+    event && event.executionDetails && event.executionDetails.executionId;
+  return topLevel || nested || undefined;
+}
+
 function buildContainerOverrides(
   name,
   command,
@@ -97,12 +125,20 @@ async function pollTaskUntilStopped(client, clusterArn, taskArn, sleep) {
 }
 
 async function runHandler(event, deps) {
+  const targetServiceRevisionArn = extractTargetServiceRevisionArn(event);
+  if (!targetServiceRevisionArn) {
+    return {
+      hookStatus: "FAILED",
+      reason:
+        "Lifecycle event missing executionDetails.targetServiceRevisionArn"
+    };
+  }
   const client = (deps && deps.client) || getDefaultClient();
   const sleep = deps && deps.sleep;
   const config = JSON.parse(
     (deps && deps.migrateConfig) || process.env.MIGRATE_CONFIG
   );
-  const startedBy = startedByTag(event && event.targetServiceRevisionArn);
+  const startedBy = startedByTag(targetServiceRevisionArn);
 
   const existingTaskArn = await findExistingTaskArn(
     client,
@@ -158,12 +194,8 @@ exports.handler = async (event) => {
     JSON.stringify({
       msg: "lifecycle-hook-invoked",
       targetServiceRevisionArn:
-        (event && event.targetServiceRevisionArn) || "(missing)",
-      executionId:
-        (event &&
-          event.executionDetails &&
-          event.executionDetails.executionId) ||
-        "(missing)"
+        extractTargetServiceRevisionArn(event) || "(missing)",
+      executionId: extractExecutionId(event) || "(missing)"
     })
   );
   try {
@@ -182,6 +214,8 @@ exports.handler = async (event) => {
 
 exports._internals = {
   startedByTag,
+  extractTargetServiceRevisionArn,
+  extractExecutionId,
   buildContainerOverrides,
   findExistingTaskArn,
   pollTaskUntilStopped,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "3.11.0",
+  "version": "4.1.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^3.11.0",
-    "@fjall/util": "^3.11.0",
+    "@fjall/generator": "^4.1.0",
+    "@fjall/util": "^4.1.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "a15125ea026d52428ff5433d098699899695ca3f"
+  "gitHead": "09dee795753839b82aedbb7d0cef1c5ef283df55"
 }