ci(ecr): auto-apply canonical image lifecycle policy on prod ECR push #19

2026-06-22T01:18:41Z

core-devops commented

2026-06-22 01:18:41 +00:00

Auto-apply + maintain the canonical prod ECR image lifecycle policy from publish-image.yml (already runs with prod-ECR push creds), so the prod ECR storage bill (~$56/mo, acct 153263036946) stops growing. Adds a shared, idempotent, fail-soft scripts/ensure-ecr-lifecycle.sh (SSOT JSON in that one file, byte-identical to the molecule-core copy: expire untagged after 1 day; keep last 10 tagged for sha-/v/latest/staging/main) called after the image push. Only declares policy (no deletes; ECR's lifecycle engine does expiry). shellcheck clean, YAML parses, fail-soft verified.

🤖 Generated with Claude Code

Auto-apply + maintain the canonical prod ECR image lifecycle policy from publish-image.yml (already runs with prod-ECR push creds), so the prod ECR storage bill (~$56/mo, acct 153263036946) stops growing. Adds a shared, idempotent, fail-soft scripts/ensure-ecr-lifecycle.sh (SSOT JSON in that one file, byte-identical to the molecule-core copy: expire untagged after 1 day; keep last 10 tagged for sha-/v/latest/staging/main) called after the image push. Only declares policy (no deletes; ECR's lifecycle engine does expiry). shellcheck clean, YAML parses, fail-soft verified. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

core-devops added 1 commit 2026-06-22 01:18:42 +00:00

ci(ecr): auto-apply canonical image lifecycle policy on prod ECR push

CI / validate (push) Successful in 1m42s

Details

CI / validate (pull_request) Successful in 2m4s

Details

a57c032d3a

The prod ECR repo molecule-ai/workspace-template-gemini-cli had its lifecycle
policy set out-of-band (no IaC), contributing to the growing prod ECR
storage bill (~$56/mo, account 153263036946). publish-image.yml already
authenticates to prod ECR + pushes, so apply the lifecycle policy right
after the push. ECR's lifecycle engine then expires old images on its
schedule — this only DECLARES policy, no deletes happen here.

- scripts/ensure-ecr-lifecycle.sh: shared, idempotent, fail-soft helper
  (always exit 0 so a policy error never breaks a publish). Byte-identical
  to the molecule-core copy; canonical policy JSON is SSOT in this one
  file: expire untagged after 1 day; keep last 10 tagged for
  sha-/v/latest/staging/main prefixes.
- publish-image.yml: call the helper after the build & push step.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

molecule-code-reviewer approved these changes 2026-06-22 01:23:57 +00:00

molecule-code-reviewer left a comment

Reviewed: additive post-push ensure-ecr-lifecycle step, fail-soft (never breaks publish), canonical policy SSOT, lints pass. Durable prod-ECR cost guard. LGTM.

core-security approved these changes 2026-06-22 01:23:58 +00:00

core-security left a comment

Reviewed: additive post-push ensure-ecr-lifecycle step, fail-soft (never breaks publish), canonical policy SSOT, lints pass. Durable prod-ECR cost guard. LGTM.

core-devops scheduled this pull request to auto merge when all checks succeed 2026-06-22 01:23:59 +00:00

core-devops merged commit d6a778bac6 into main

2026-06-22 01:24:00 +00:00

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-ai-workspace-template-gemini-cli#19