[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker/dockerfile	syntax	minor	1.28 → 1.29

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 1 to add, 0 to change, 1 to destroy.

Plan output

Acquiring state lock. This may take a few moments...

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.ecr.aws_ecr_lifecycle_policy.this must be replaced
-/+ resource "aws_ecr_lifecycle_policy" "this" {
      ~ id          = "cupcake-cupcake-backend" -> (known after apply)
      ~ policy      = jsonencode(
          ~ {
              ~ rules = [
                    {
                        action       = {
                            type = "expire"
                        }
                        description  = "Keep last 5 semver releases"
                        rulePriority = 1
                        selection    = {
                            countNumber   = 5
                            countType     = "imageCountMoreThan"
                            tagPrefixList = [
                                "v",
                            ]
                            tagStatus     = "tagged"
                        }
                    },
                  ~ {
                      ~ selection    = {
                          ~ tagPrefixList = [
                                "main-",
                              - "master-",
                            ]
                            # (3 unchanged attributes hidden)
                        }
                        # (3 unchanged attributes hidden)
                    },
                    {
                        action       = {
                            type = "expire"
                        }
                        description  = "Expire untagged images after 1 day(s)"
                        rulePriority = 3
                        selection    = {
                            countNumber = 1
                            countType   = "sinceImagePushed"
                            countUnit   = "days"
                            tagStatus   = "untagged"
                        }
                    },
                    # (1 unchanged element hidden)
                ]
            } # forces replacement
        )
      ~ registry_id = "553637109631" -> (known after apply)
        # (1 unchanged attribute hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Plan replaces one ECR lifecycle policy (module.ecr.aws_ecr_lifecycle_policy.this) to drop the "master-" tag prefix from the image-retention rule; no other resources change.

• ✅ [routine] The ECR lifecycle policy for cupcake-cupcake-backend is destroyed and recreated because the policy JSON changed. The only semantic change is removing "master-" from the tagPrefixList of the rule that keeps tagged images with prefix "main-" (rulePriority 2 in the policy, description-less rule). The "Keep last 5 semver releases" rule and the untagged-expiry rule are unchanged.
• 💥 [destruction] Replacement is a delete-then-create of a lifecycle policy only; it does not touch the ECR repository or any images. There is a brief window where no lifecycle policy is attached, so cleanup will not run during that window. Images tagged with "master-" will no longer be protected by the matching rule and may be expired on the next lifecycle run, so confirm that no pipeline or deployment still relies on master-prefixed tags.
• 💰 [cost] Removing the master- prefix may cause more images to be eligible for expiry, which slightly lowers ECR storage cost. No new billable resources are created.
• 🔒 [security] No IAM, security group, public access, or encryption changes appear in the plan.