From da29dcf9837bfa98de8763f21e0ea42233caa228 Mon Sep 17 00:00:00 2001
From: Alexandre Brandizzi <alex_brandizzi@hotmail.com>
Date: Tue, 28 Jul 2026 10:38:38 -0300
Subject: [PATCH] fix: make deploy artifacts immutable

---
 .github/workflows/deploy.yml  | 4 ++--
 infra/cdk/deploy-dev-stack.ts | 5 ++++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 41554a7..5e23077 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -109,13 +109,13 @@ jobs:
           aws-region: us-east-1
           application-name: shoc-backend
           environment-name: shoc-backend-dev
-          version-label: ${{ github.sha }}
+          version-label: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
           deployment-package-path: .artifacts/elastic-beanstalk/site.zip
           s3-bucket-name: elasticbeanstalk-us-east-1-396287094661
           create-application-if-not-exists: "false"
           create-environment-if-not-exists: "false"
           create-s3-bucket-if-not-exists: "false"
-          use-existing-application-version-if-available: "true"
+          use-existing-application-version-if-available: "false"
           wait-for-deployment: "true"
           wait-for-environment-recovery: "true"
 
diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts
index 3e212ed..0137db0 100644
--- a/infra/cdk/deploy-dev-stack.ts
+++ b/infra/cdk/deploy-dev-stack.ts
@@ -55,7 +55,10 @@ export class DeployDevStack extends cdk.Stack {
       new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,
         actions: ['elasticbeanstalk:CreateApplicationVersion'],
-        resources: [applicationArn],
+        resources: [
+          applicationArn,
+          `arn:aws:elasticbeanstalk:${REGION}:${ACCOUNT_ID}:applicationversion/${APPLICATION_NAME}/*`,
+        ],
       }),
     );