---
name: ecr-repository
description: >
  Creates or extends ECR repository configurations in the terraform-infra
  monorepo under shared/prod/ecr/repos/. Use this skill whenever the user
  mentions creating, adding, or setting up an ECR repository or container
  registry — even if they say "ECR image", "container image repo",
  or just name a service and ask to "set up ECR for it". Handles three
  cases automatically: (A) brand-new directory with no prior Terraform,
  (B) appending a name to an existing multi-repo list, and (C) converting a
  single-repo setup to a list and generating the moved.tf needed to protect
  the existing resource.
---

# ECR Repository

All ECR repos in this monorepo live under `shared/prod/ecr/repos/`. Each
directory holds Terraform that manages one logical group of repositories via
the `terraform-ecr` module.

- S3 backend bucket: `shared-orcd-terraform-state`

---

## Step 0 — Fetch latest versions

**Skip this step for Scenario B** (appending to an existing list requires no new files).

Fetch the current latest versions of:

**terraform-ecr:** Fetch the latest release tag from `theorchard/terraform-ecr`.

**terraform-default-tags:** Fetch the latest release tag from `theorchard/terraform-default-tags`.

**Terraform:** Fetch the latest stable GA version:

```bash
curl -s https://releases.hashicorp.com/terraform/ \
  | grep -oP '(?<=terraform/)\d+\.\d+\.\d+(?=/)' \
  | grep -v -E '(alpha|beta|rc)' \
  | sort -V \
  | tail -1
```

If a module version cannot be fetched, check existing repos in `shared/prod/ecr/repos/` for a recent `?ref=` value and inform the user which version was used.

In the templates below, `${ecr_version}`, `${default_tags_version}`, and `${terraform_version}` denote where the actual fetched version strings should be written (e.g. `?ref=2.1.0`, not the placeholder text itself).

---

## Step 1 — Determine the scenario

Check the target directory:

```bash
ls shared/prod/ecr/repos/<dir>/
```

Then read `main.tf` if it exists.

| Situation | Scenario |
|---|---|
| Directory does not exist | **A** — create from scratch |
| Directory exists, `main.tf` uses `for_each` | **B** — append to list |
| Directory exists, `main.tf` uses `repository_name = var.repository_name` (no `for_each`) | **C** — convert to list + add |

---

## Scenario A — New directory

Create `shared/prod/ecr/repos/<dir>/` with three files.

The directory name is usually the service name (e.g. `ows-service`).
Use the modern pattern: `default_tags` module + `for_each` list, even for a
single initial repo. This avoids a future Scenario C migration.

If the user hasn't specified `application_family` or `team_name`, infer them
from context (e.g. "payments team" → `team_name = "payments"`) or ask.

### main.tf

```hcl
module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=${default_tags_version}"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "shared-orcd-terraform-state"
    key     = "shared/ecr/repos/<dir>/terraform.tfstate"  # replace <dir> with the actual directory name
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "repository" {
  source   = "git@github.com:theorchard/terraform-ecr.git//?ref=${ecr_version}"
  for_each = toset(var.ecr_repo_names)

  repository_name = each.value
}
```

### variables.tf

```hcl
variable "aws_region" {
  type        = string
  default     = "us-east-1"
  description = "The AWS region to create the repository in"
}

variable "environment" {
  description = "The environment name"
  type        = string
  default     = "prod"
}

variable "application_family" {
  description = "The application family to which the repository belongs"
  type        = string
}

variable "team_name" {
  description = "The team name to which the repository belongs"
  type        = string
}

variable "ecr_repo_names" {
  description = "List of repository names"
  type        = list(string)
  default     = [
    "actual-repo-name",  # replace with the repo name(s) from the user's request
  ]
}
```

### versions.tf

```hcl
terraform {
  required_version = "${terraform_version}"
}
```

---

## Scenario B — Append to existing list

The directory already has `for_each` wired up. Just add the new name to the
list variable in `variables.tf`. No other files change.

Read the existing `variables.tf` to find the list variable name (it varies —
could be `ecr_repo_names`, `lambda_function_names`, etc.), then append:

```hcl
  default = [
    "existing-name-1",
    "existing-name-2",
    "<new-repo-name>",   # ← add here
  ]
```

---

## Scenario C — Convert single-repo to list, then add

This happens when `main.tf` has `repository_name = var.repository_name`
without `for_each`. You need to:

1. **Capture the original repo name** from the `repository_name` default in
   `variables.tf` — you'll need it for `moved.tf`.

2. **Update `main.tf`** — replace the module block:
   ```hcl
   module "repository" {
     source   = "git@github.com:theorchard/terraform-ecr.git//?ref=${ecr_version}"
     for_each = toset(var.ecr_repo_names)

     repository_name = each.value
   }
   ```

3. **Update `variables.tf`** — replace `repository_name` with `ecr_repo_names`:
   ```hcl
   variable "ecr_repo_names" {
     description = "List of repository names"
     type        = list(string)
     default     = [
       "<original-repo-name>",
       "<new-repo-name>",
     ]
   }
   ```

4. **Create `moved.tf`** — this tells Terraform that `module.repository` is
   now `module.repository["<original-repo-name>"]`, so it updates state
   instead of destroying and recreating the existing ECR repo:
   ```hcl
   moved {
     from = module.repository
     to   = module.repository["<original-repo-name>"]
   }
   ```
   The `from` address must be the bare `module.repository` (no key), because
   that's how Terraform tracked it before `for_each` was introduced.

---

## Step 2 — Run terraform fmt

After writing all files, run:

```bash
cd shared/prod/ecr/repos/<dir> && terraform fmt
```

If `terraform` is not available, note it in the summary and ask the user to
run it manually.

---

## Summary to show the user

After completing the work, tell the user:
- Which scenario was applied (A / B / C)
- Which files were created or modified
- The module versions used (`terraform-ecr`, `terraform-default-tags`) — omit for Scenario B
- The new repo name(s) now tracked
- A reminder that Atlantis will run `terraform plan` when a PR is opened