From 4959d4db2b12a13d08b6a9c731c8d7a0c756afae Mon Sep 17 00:00:00 2001
From: eomkyeongmun <eomkyeongmun@github.com>
Date: Mon, 1 Jun 2026 13:28:31 +0900
Subject: [PATCH] =?UTF-8?q?chore:=20ECR=20image=5Ftag=5Fmutability=20MUTAB?=
 =?UTF-8?q?LE=20=E2=86=92=20IMMUTABLE=20(#63)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

동일 태그 덮어쓰기를 막아 배포 이미지 추적성·공급망 안전성 확보.
주의: :latest 재push가 거부되므로 커밋 SHA 태그 전환이 동반되어야 함.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 terraform/ecr.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/terraform/ecr.tf b/terraform/ecr.tf
index 8016929..b6ab79b 100644
--- a/terraform/ecr.tf
+++ b/terraform/ecr.tf
@@ -10,7 +10,7 @@ resource "aws_ecr_repository" "apps" {
   for_each = toset(local.ecr_repos)
 
   name                 = "${var.project_name}-${each.key}"
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE" # 태그 덮어쓰기 금지 (커밋 SHA 태그 전제)
 
   image_scanning_configuration {
     scan_on_push = true