Summary

Decouple the Fargate migrations init container image from the application image. This adds optional tracecat_migrations_image and tracecat_migrations_image_tag variables at the root and ECS module layers, resolves them with fallbacks to the existing backend image settings, and wires the API migrations container to the resolved migration image.

The default behavior is unchanged: if the new variables are unset, migrations continue to use tracecat_image:tracecat_image_tag.

Impact

This enables the same app-only rollback pattern used in the Helm chart: keep migrations on a version that understands the current Alembic database revision while rolling the app containers back to an older image tag.

Validation

• terraform fmt -check -recursive deployments/fargate
• terraform -chdir=deployments/fargate validate
• uv run ruff check deployments/fargate
• git diff --check
• repo pre-commit hooks during commit

Summary by cubic

Decouple the Fargate migrations init container image from the app image to allow pinning migrations while rolling back app versions. Default behavior is unchanged if new variables are not set.

• New Features
  • Added optional tracecat_migrations_image and tracecat_migrations_image_tag at root and ECS module.
  • Fallbacks to tracecat_image and tracecat_image_tag when unset.
  • API migrations container now uses the resolved migrations image/tag.
  • Exported tracecat_migrations_image and tracecat_migrations_image_tag as outputs.
  • Updated README with usage and rollback guidance.

^{Written for commit 9cae3d0. Summary will update on new commits.}