Adds a variable with defaults to allow disabling the default rules.

why

As part of #146 we added custom lifecycle policies. Now there's a problem where our default rules conflict or are forced at certain points in certain orders relative to our custom lifecycle policies. We want to be able to disable them if they don't meet our needs.

references

#146

e.g.

        default_lifecycle_rules_settings:
          untagged_image_rule:
            enabled: false
          remove_old_image_rule:
            enabled: false

        custom_lifecycle_rules: 
          - selection: 
              tagStatus: "tagged"
              countType: "imageCountMoreThan"
              countNumber: 1000
              tagPrefixList: ["prod-"]
            description: "Expire images older than 1000 for all tags starting with prod-"
            action: 
              type: "expire"
          - selection: 
              tagStatus: "tagged"
              countType: "imageCountMoreThan"
              countNumber: 1000
              tagPrefixList: ["staging-"]
            description: "Expire images older than 1000 for all tags starting with staging-"
            action: 
              type: "expire"
          - selection: 
              tagStatus: "tagged"
              countType: "imageCountMoreThan"
              countNumber: 1000
              tagPrefixList: ["dev-"]
            description: "Expire images older than 1000 for all tags starting with dev-"
            action: 
              type: "expire"

results in just the custom_lifecycle_rules being created. No default behavior change

Improvements to selection merging logic:

• Enhanced null-checks and condition handling in main.tf: The selection merging logic now includes a check to ensure that countUnit is only added if it is not null, and the filtering logic for keys like tagPrefixList and tagPatternList has been updated to handle null values more gracefully. (main.tf, main.tfL140-R152)

Refinements to validation logic:

• Validation for tagStatus in variables.tf: Updated the condition to use length(coalesce(...)) for checking tagPrefixList and tagPatternList, ensuring proper handling of null or empty lists. (variables.tf, variables.tfL163-R163)
• Validation for countType in variables.tf: Adjusted the condition to ensure that countUnit is specified when countType is sinceImagePushed, with a clearer error message for improved readability. (variables.tf, variables.tfL193-R195)

• Extension of #143
  • closes #141
  • closes #143

why

Allows supporting Custom Lifecycle Policies for your ECR Repositories

references

• closes #92

why

• Error loading shared library libresolv.so.2 in Go 1.20

References

• https://sweetops.slack.com/archives/G014YEKDH4K/p1746672149263629
• golang/go#59305 (comment)
• cloudposse/terraform-aws-cloudfront-s3-cdn#294

why

• Replace build-harness with atmos for readme genration

References

• DEV-3229 Migrate from build-harness to atmos

what

Adds protected_tags_keep_count and defaults it to 999999

why

A user may want to retain release tags for an extended period, but not indefinitely.

why

• Re-apply .github/settings.yml from org level to get terratest environment
• Migrate to new test account

References

• DEV-388 Automate clean up of test account in new organization
• DEV-387 Update terratest to work on a shared workflow instead of a dispatch action
• DEV-386 Update terratest to use new testing account with GitHub OIDC

why

• Re-apply .github/settings.yml from org level
• Use organization level auto-release settings

references

• DEV-1242 Add protected tags with Repository Rulesets on GitHub

why

• Re-apply .github/settings.yml from org level
• Use organization level auto-release settings

references

• DEV-1242 Add protected tags with Repository Rulesets on GitHub

• the change allows to pass wildcards in protected_tags list

why

• there are use cases when the protected tags are not only prefix defineable and only wildcard can be used like "*prod" or semversion *.*.*

references

• fixes #133

Add support for countType "sinceImagePushed" ECR Lifepolicy rule.

why

• Increase flexibility and usefulness of this module.

references

• Implements #92.

why

• Re-apply .github/settings.yml from org level
• Use organization level auto-release settings

references

• DEV-1242 Add protected tags with Repository Rulesets on GitHub

why

• So we can support commenting on PRs with a link to the release

why

• Reduce nested levels of reusable workflows

why

• The ReviewDog action will comment with line-level suggestions based on linting failures

why

• Support new readme generation workflow.
• Generate banners

• Install latest GitHub Action Workflows

why

• Use shared workflows from cldouposse/.github repository
• Simplify management of workflows from centralized hub of configuration

why

• Programmatically manage GitHub repo settings

why

To have most recent changes of README.md and doc from origin templates

why

• Upstream template changed in the .github repo
• Work better with repository rulesets
• Modernize look & feel

• Allow to use ECR replication
• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_replication_configuration

Closes #99

what

Add a principal list (principals_pull_though_access) which are allowed to use specific repositories as pull through cache (import images from upstream). This holds for repositories where one of the strings in prefixes_pull_through_repositories is a prefix of the repository name.

why

We are using ecr-public pull through cache and we want also new images to be downloaded automatically to the cache. Allowed principals for respective repos can use it with the newly introduced variables.

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

what

• add scanning_configuration as child module

why

• support scan_type settings
• should be deployed as a per-account global, rather than per-ecr-repo

Notes

• fixes #90

what

• Add the ability to have organizations as trustees (read-only) for the ECR repository

why

• As described in #82 , it's sometimes useful to allow an entire organization to consume images from a centralized repository

references

• closes #82