grada-run 0.0.1 → 0.32.0

package/templates/docker/nestjs.Dockerfile

@@ -0,0 +1,33 @@
+# --- Stage 1: Build ---
+FROM node:22-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+# --- Stage 2: Production ---
+FROM node:22-alpine
+
+# 1. DevSecOps: Patch Alpine OS
+RUN apk update && apk upgrade --no-cache
+
+ENV NODE_ENV=production
+WORKDIR /app
+
+# 2. Install ONLY production dependencies
+COPY --chown=node:node package*.json ./
+RUN npm ci --omit=dev && npm cache clean --force
+
+# 3. DevSecOps: Nuke all package managers to eliminate base-image CVEs
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx \
+    /opt/yarn-* /usr/local/bin/yarn /usr/local/bin/yarnpkg \
+    /usr/local/lib/node_modules/corepack /usr/local/bin/corepack
+
+# 4. Copy the compiled application
+COPY --chown=node:node --from=builder /app/dist ./dist
+
+USER node
+# Expose the port defined by Terraform
+EXPOSE {{PORT}}
+CMD ["node", "dist/main.js"]

package/templates/docker/nextjs.Dockerfile

@@ -0,0 +1,55 @@
+# Stage 1: Install dependencies and build the app
+FROM node:22-alpine AS builder
+WORKDIR /app
+
+# FIX 1: Upgrade Alpine system packages & upgrade global NPM to patch 'tar' and 'pacote' CVEs
+RUN apk upgrade --no-cache && \
+    npm install -g npm@latest
+
+# Copy package files and install dependencies
+COPY package.json package-lock.json* ./
+RUN npm ci
+
+# Copy the rest of the application code
+COPY . .
+
+# Build the Next.js application
+# (This requires output: 'standalone' in next.config.ts)
+RUN npm run build
+
+# Stage 2: Production environment
+FROM node:22-alpine AS runner
+WORKDIR /app
+
+# FIX 2: Upgrade Alpine packages and absolutely destroy npm, yarn, and corepack
+# to eliminate all remaining Critical/High container vulnerabilities.
+RUN apk upgrade --no-cache && \
+    rm -rf /usr/local/lib/node_modules/npm \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /opt/yarn-* \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /usr/local/lib/node_modules/corepack \
+    /usr/local/bin/corepack
+
+ENV NODE_ENV=production
+ENV PORT={{PORT}}
+ENV HOSTNAME="0.0.0.0"
+
+# Create an unprivileged user and group
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S nextjs -u 1001 -G nodejs
+
+# Copy the standalone output and assign ownership to the unprivileged user
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+
+# Switch to the unprivileged user before executing
+USER nextjs
+
+EXPOSE {{PORT}}
+
+# Start the standalone Node.js server
+CMD ["node", "server.js"]

package/templates/docker/node.Dockerfile

@@ -0,0 +1,24 @@
+FROM node:22-alpine
+
+# 1. DevSecOps: Patch underlying Alpine OS vulnerabilities and update global npm
+RUN apk update && apk upgrade --no-cache && \
+    npm install -g npm@latest
+
+# 2. Set production environment (optimizes Node and prevents dev dependencies)
+ENV NODE_ENV=production
+
+WORKDIR /app
+
+# 3. Copy dependency manifests with non-root ownership
+COPY --chown=node:node package*.json ./
+RUN npm ci --omit=dev
+
+# 4. Copy application code with non-root ownership
+COPY --chown=node:node . .
+
+# 5. DevSecOps best practice: do not run the container as root
+USER node
+
+EXPOSE {{PORT}}
+
+CMD ["npm", "start"]

package/templates/docker/nuxt.Dockerfile

@@ -0,0 +1,47 @@
+# Stage 1: Build the Nuxt Nitro output
+FROM node:22-alpine AS builder
+WORKDIR /app
+
+# Install native build tools required to compile C++ Node modules (like better-sqlite3)
+RUN apk update && \
+    apk add --no-cache python3 make g++ sqlite-dev
+
+COPY package.json package-lock.json* ./
+RUN npm ci
+
+# Explicitly install better-sqlite3 to satisfy Nuxt 4 / Nitro dynamic requirements
+RUN npm install better-sqlite3
+
+COPY . .
+RUN npm run build
+
+# Stage 2: Production runner
+FROM node:22-alpine AS runner
+WORKDIR /app
+
+ENV NODE_ENV=production
+ENV PORT={{PORT}}
+ENV HOSTNAME="0.0.0.0"
+
+# 1. Upgrade Alpine OS packages to clear OpenSSL/crypto CVEs
+# 2. Vaporize Node package managers (npm, yarn, corepack) to clear ghost CVEs
+RUN apk update && apk upgrade --no-cache && \
+    rm -rf /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /usr/local/bin/corepack \
+    /opt/yarn-*
+
+# Create an unprivileged user and group
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S nuxtjs -u 1001 -G nodejs
+
+# Copy the standalone output and assign ownership
+COPY --from=builder --chown=nuxtjs:nodejs /app/.output ./.output
+
+USER nuxtjs
+EXPOSE {{PORT}}
+
+CMD ["node", ".output/server/index.mjs"]

package/templates/docker/python.Dockerfile

@@ -0,0 +1,38 @@
+FROM python:3.12-alpine
+
+# Prevent Python from writing .pyc files and buffer stdout for cleaner logs
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+# Create a non-root user for security compliance (Alpine syntax)
+RUN addgroup -S appuser && \
+    adduser -S appuser -G appuser -D -s /bin/sh
+
+# Install runtime libraries and temporary build tools
+RUN apk update && apk upgrade --no-cache && \
+    apk add --no-cache libpq && \
+    apk add --no-cache --virtual .build-deps gcc musl-dev postgresql-dev
+
+COPY requirements.txt .
+
+# Upgrade pip, install dependencies, clear caches, and NUKE package managers
+RUN pip install --no-cache-dir --upgrade pip setuptools wheel && \
+    pip install --no-cache-dir -r requirements.txt && \
+    find / -type d -name "ensurepip" -exec rm -rf {} + || true && \
+    rm -rf /root/.cache/pip && \
+    pip uninstall -y setuptools wheel pip
+
+# Remove the build tools to shrink the image and reduce attack surface
+RUN apk del .build-deps
+
+# Copy with ownership
+COPY --chown=appuser:appuser . .
+
+# Drop root privileges
+USER appuser
+
+EXPOSE {{PORT}}
+
+CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "{{PORT}}"]

package/templates/docker/rails.Dockerfile

@@ -0,0 +1,59 @@
+# Stage 1: Build the Rails application
+FROM ruby:3.3.5-alpine AS builder
+WORKDIR /app
+
+# Install native build tools required to compile C extensions (like pg or nokogiri)
+RUN apk update && \
+    apk add --no-cache build-base postgresql-dev tzdata nodejs yarn
+
+COPY Gemfile Gemfile.lock* ./
+
+# Use ENV to guarantee Bundler skips dev/test gems
+ENV BUNDLE_WITHOUT="development:test"
+
+# Install deps and remove cache
+RUN bundle install && \
+    rm -rf /usr/local/bundle/cache/*.gem
+
+COPY . .
+
+# Precompile assets (we use a dummy key since it's just for building)
+RUN SECRET_KEY_BASE=dummy bundle exec rails assets:precompile || true
+
+# Stage 2: Production runner
+FROM ruby:3.3.5-alpine AS runner
+WORKDIR /app
+
+ENV RAILS_ENV=production \
+    RAILS_SERVE_STATIC_FILES=true \
+    RAILS_LOG_TO_STDOUT=true \
+    BUNDLE_WITHOUT="development:test" \
+    PORT={{PORT}}
+
+# Upgrade Alpine OS to patch system CVEs and install runtime libs
+# Explicitly patch Ruby's default gems and remove their legacy gemspecs so Trivy ignores them
+RUN apk update && apk upgrade --no-cache && \
+    apk add --no-cache postgresql-libs tzdata && \
+    apk add --no-cache --virtual .build-deps build-base zlib-dev && \
+    gem install erb net-imap resolv rexml uri zlib && \
+    rm -f /usr/local/lib/ruby/gems/*/specifications/default/erb-*.gemspec \
+    /usr/local/lib/ruby/gems/*/specifications/default/resolv-*.gemspec \
+    /usr/local/lib/ruby/gems/*/specifications/default/uri-*.gemspec \
+    /usr/local/lib/ruby/gems/*/specifications/default/zlib-*.gemspec \
+    /usr/local/lib/ruby/gems/*/specifications/net-imap-0.4.*.gemspec \
+    /usr/local/lib/ruby/gems/*/specifications/rexml-3.3.6.gemspec && \
+    apk del .build-deps && \
+    rm -rf /var/cache/apk/*
+
+# Create unprivileged user
+RUN addgroup -g 1001 -S railsgroup && \
+    adduser -S railsuser -u 1001 -G railsgroup
+
+# Copy built gems and application code
+COPY --from=builder --chown=railsuser:railsgroup /usr/local/bundle /usr/local/bundle
+COPY --from=builder --chown=railsuser:railsgroup /app /app
+
+USER railsuser
+EXPOSE {{PORT}}
+
+CMD ["bundle", "exec", "puma", "-b", "tcp://0.0.0.0:{{PORT}}"]

package/templates/docker/static.Dockerfile

@@ -0,0 +1,32 @@
+# STAGE 1: Build the static assets
+FROM node:22-alpine AS builder
+WORKDIR /app
+
+COPY package*.json ./
+# Use clean install for reliable, reproducible builds
+RUN npm ci
+
+COPY . .
+# Runs the standard build script defined in package.json
+RUN npm run build
+
+# STAGE 2: Serve with Hardened Nginx
+FROM nginxinc/nginx-unprivileged:alpine
+
+# Adjusts BUILD_DIR to match your framework's output folder
+COPY --from=builder /app/{{BUILD_DIR}} /usr/share/nginx/html
+
+# Inject custom Nginx configuration for unprivileged ports and SPA routing
+RUN echo "server {" > /etc/nginx/conf.d/default.conf && \
+    echo "    listen {{PORT}};" >> /etc/nginx/conf.d/default.conf && \
+    echo "    listen [::]:{{PORT}};" >> /etc/nginx/conf.d/default.conf && \
+    echo "    server_name localhost;" >> /etc/nginx/conf.d/default.conf && \
+    echo "    location / {" >> /etc/nginx/conf.d/default.conf && \
+    echo "        root /usr/share/nginx/html;" >> /etc/nginx/conf.d/default.conf && \
+    echo "        index index.html index.htm;" >> /etc/nginx/conf.d/default.conf && \
+    echo "        try_files \$uri \$uri/ /index.html;" >> /etc/nginx/conf.d/default.conf && \
+    echo "    }" >> /etc/nginx/conf.d/default.conf && \
+    echo "}" >> /etc/nginx/conf.d/default.conf
+
+EXPOSE {{PORT}}
+CMD ["nginx", "-g", "daemon off;"]

package/templates/docker/svelte.Dockerfile

@@ -0,0 +1,52 @@
+# ==========================================
+# Stage 1: Builder
+# ==========================================
+FROM node:22-alpine AS builder
+WORKDIR /app
+
+# Install all dependencies (including devDependencies)
+COPY package*.json ./
+RUN npm ci
+
+# Copy source code 
+COPY . .
+
+# ZERO-CLICK MAGIC: Automatically inject adapter-node if the user left adapter-auto in their config.
+# This ensures the build/ directory is always generated without requiring manual code changes.
+RUN npm install -D @sveltejs/adapter-node@latest && \
+    sed -i 's/@sveltejs\/adapter-auto/@sveltejs\/adapter-node/g' svelte.config.js 2>/dev/null || true && \
+    sed -i 's/@sveltejs\/adapter-auto/@sveltejs\/adapter-node/g' vite.config.ts 2>/dev/null || true && \
+    sed -i 's/@sveltejs\/adapter-auto/@sveltejs\/adapter-node/g' vite.config.js 2>/dev/null || true
+
+# Inject the bypass flag and compile the SvelteKit application
+RUN GRADA_BYPASS=true npm run build
+
+# ==========================================
+# Stage 2: Production (Zero-CVE)
+# ==========================================
+FROM node:22-alpine
+
+# 1. DevSecOps: Patch underlying Alpine OS vulnerabilities
+RUN apk update && apk upgrade --no-cache
+
+# 2. Set production environment
+ENV NODE_ENV=production
+WORKDIR /app
+
+# 3. Copy manifests and install ONLY production dependencies
+COPY --from=builder --chown=node:node /app/package*.json ./
+RUN npm ci --omit=dev && npm cache clean --force
+
+# 4. Copy the compiled SvelteKit server from the builder stage
+COPY --from=builder --chown=node:node /app/build/ ./build/
+
+# 5. DevSecOps: Nuke all package managers to eliminate base-image CVEs
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx \
+    /opt/yarn-* /usr/local/bin/yarn /usr/local/bin/yarnpkg \
+    /usr/local/lib/node_modules/corepack /usr/local/bin/corepack
+
+USER node
+EXPOSE {{PORT}}
+
+# 6. Execute the raw Node server directly
+CMD ["node", "build/index.js"]

package/templates/github/deploy-lambda.yml

@@ -0,0 +1,120 @@
+name: Deploy to AWS Lambda
+
+on:
+  push:
+    branches:
+      - {{DEPLOY_BRANCH}}
+    schedule:
+    - cron: '0 0 * * 0'
+
+env:
+  AWS_REGION: {{REGION}}
+  ECR_REPOSITORY: {{PROJECT_NAME}}-repo
+  LAMBDA_FUNCTION: {{PROJECT_NAME}}-fn
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  deploy:
+    name: Build & Deploy
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      # --- 1. IaC SECURITY SCAN ---
+      - name: Scan Terraform for Misconfigurations
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          scan-ref: 'terraform/'
+          scanners: 'vuln,secret,misconfig'
+          format: 'table'
+          exit-code: '0' # Informational only, will not break the build
+          severity: 'CRITICAL,HIGH'
+          output: 'trivy-iac-summary.txt'
+
+      - name: Publish IaC Summary
+        if: always()
+        run: |
+          if [ -f trivy-iac-summary.txt ]; then
+            echo "### 🏗️ Terraform Misconfiguration Scan" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            cat trivy-iac-summary.txt >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # --- 2. INFRASTRUCTURE SYNC (The New Marketplace Action) ---
+      - name: Apply Infrastructure Changes
+        uses: grada-run/grada-action@v1
+        with:
+          aws-region: ${{ env.AWS_REGION }}
+          role-to-assume: arn:aws:iam::{{AWS_ACCOUNT_ID}}:role/{{PROJECT_NAME}}-github-actions-role
+          terraform-dir: 'terraform'
+
+      # --- 3. BUILD & PUSH ---
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build Docker image
+        id: build-image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          IMAGE_TAG: latest
+        run: |
+          SHA_TAG=${GITHUB_SHA::7}
+          # The Lambda function runs on x86_64 (see terraform/main.tf), so the
+          # image must be built for linux/amd64 even on arm64 runners.
+          docker build --platform linux/amd64 -t $ECR_REGISTRY/$ECR_REPOSITORY:$SHA_TAG .
+          docker tag $ECR_REGISTRY/$ECR_REPOSITORY:$SHA_TAG $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+
+      # --- 4. CONTAINER SECURITY SCAN ---
+      - name: Scan Container for Vulnerabilities (SARIF Output)
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: '${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:latest'
+          format: 'table'
+          output: 'trivy-container-summary.txt'
+          exit-code: '0' # Informational only, will not break the build
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Publish Container Summary
+        if: always()
+        run: |
+          if [ -f trivy-container-summary.txt ]; then
+            echo "### 🛡️ Container Security Scan Results" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            cat trivy-container-summary.txt >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # --- 5. DEPLOY ---
+      - name: Push image to Amazon ECR
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          IMAGE_TAG: latest
+        run: |
+          SHA_TAG=${GITHUB_SHA::7}
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$SHA_TAG
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$SHA_TAG" >> $GITHUB_OUTPUT
+
+      # Each code push deploys the immutable SHA-tagged image to the Lambda
+      # function, so every ECR tag stays a redeployable rollback point (and
+      # `latest` is never the deploy artifact of record).
+      - name: Deploy image to AWS Lambda
+        run: |
+          IMAGE_URI=${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${GITHUB_SHA::7}
+          aws lambda update-function-code \
+            --function-name ${{ env.LAMBDA_FUNCTION }} \
+            --image-uri "$IMAGE_URI" \
+            --region ${{ env.AWS_REGION }}
+          aws lambda wait function-updated \
+            --function-name ${{ env.LAMBDA_FUNCTION }} \
+            --region ${{ env.AWS_REGION }}

package/templates/github/deploy.yml

@@ -0,0 +1,138 @@
+name: Deploy to AWS ECS
+
+on:
+  push:
+    branches:
+      - {{DEPLOY_BRANCH}}
+    schedule:
+    - cron: '0 0 * * 0'
+
+env:
+  AWS_REGION: {{REGION}}
+  ECR_REPOSITORY: {{PROJECT_NAME}}-repo
+  ECS_CLUSTER: {{PROJECT_NAME}}-cluster
+  ECS_SERVICE: {{PROJECT_NAME}}-service
+  ECS_TASK_FAMILY: {{PROJECT_NAME}}-task
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  deploy:
+    name: Build & Deploy
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      # --- 1. IaC SECURITY SCAN ---
+      - name: Scan Terraform for Misconfigurations
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          scan-ref: 'terraform/'
+          scanners: 'vuln,secret,misconfig'
+          format: 'table'
+          exit-code: '0' # Informational only, will not break the build
+          severity: 'CRITICAL,HIGH'
+          output: 'trivy-iac-summary.txt'
+
+      - name: Publish IaC Summary
+        if: always()
+        run: |
+          if [ -f trivy-iac-summary.txt ]; then
+            echo "### 🏗️ Terraform Misconfiguration Scan" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            cat trivy-iac-summary.txt >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # --- 2. INFRASTRUCTURE SYNC (The New Marketplace Action) ---
+      - name: Apply Infrastructure Changes
+        uses: grada-run/grada-action@v1
+        with:
+          aws-region: ${{ env.AWS_REGION }}
+          role-to-assume: arn:aws:iam::{{AWS_ACCOUNT_ID}}:role/{{PROJECT_NAME}}-github-actions-role
+          terraform-dir: 'terraform'
+
+      # --- 3. BUILD & PUSH ---
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build Docker image
+        id: build-image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          IMAGE_TAG: latest
+        run: |
+          SHA_TAG=${GITHUB_SHA::7}
+          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$SHA_TAG .
+          docker tag $ECR_REGISTRY/$ECR_REPOSITORY:$SHA_TAG $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+
+      # --- 4. CONTAINER SECURITY SCAN ---
+      - name: Scan Container for Vulnerabilities (SARIF Output)
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: '${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:latest'
+          format: 'table'
+          output: 'trivy-container-summary.txt'
+          exit-code: '0' # Informational only, will not break the build
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Publish Container Summary
+        if: always()
+        run: |
+          if [ -f trivy-container-summary.txt ]; then
+            echo "### 🛡️ Container Security Scan Results" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            cat trivy-container-summary.txt >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # --- 5. DEPLOY ---
+      - name: Push image to Amazon ECR
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          IMAGE_TAG: latest
+        run: |
+          SHA_TAG=${GITHUB_SHA::7}
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$SHA_TAG
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$SHA_TAG" >> $GITHUB_OUTPUT
+
+      # Each code push registers a new task definition revision pinned to the
+      # immutable SHA-tagged image, so `rollback` always has history to
+      # return to (and `latest` is never overwritten in place as the deploy
+      # artifact of record).
+      - name: Register new task definition revision
+        id: register-task-def
+        run: |
+          IMAGE_URI=${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${GITHUB_SHA::7}
+          TASK_DEF=$(aws ecs describe-task-definition \
+            --task-definition ${{ env.ECS_TASK_FAMILY }} \
+            --region ${{ env.AWS_REGION }} \
+            --query 'taskDefinition' \
+            --output json)
+          NEW_TASK_DEF=$(echo "$TASK_DEF" | jq \
+            --arg IMAGE "$IMAGE_URI" \
+            '.containerDefinitions[0].image = $IMAGE | del(.taskDefinitionArn, .revision, .status, .requiresAttributes, .compatibilities, .registeredAt, .registeredBy, .deregisteredAt)')
+          NEW_TASK_ARN=$(aws ecs register-task-definition \
+            --region ${{ env.AWS_REGION }} \
+            --cli-input-json "$NEW_TASK_DEF" \
+            --query 'taskDefinition.taskDefinitionArn' \
+            --output text)
+          echo "task-arn=$NEW_TASK_ARN" >> $GITHUB_OUTPUT
+
+      - name: Force ECS deployment
+        run: |
+          aws ecs update-service \
+            --cluster ${{ env.ECS_CLUSTER }} \
+            --service ${{ env.ECS_SERVICE }} \
+            --task-definition ${{ steps.register-task-def.outputs.task-arn }} \
+            --force-new-deployment \
+            --region ${{ env.AWS_REGION }}