fix: make deploy artifacts immutable

.github/workflows/deploy.yml

@@ -109,13 +109,13 @@ jobs:
           aws-region: us-east-1
           application-name: shoc-backend
           environment-name: shoc-backend-dev
-          version-label: ${{ github.sha }}
+          version-label: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
           deployment-package-path: .artifacts/elastic-beanstalk/site.zip
           s3-bucket-name: elasticbeanstalk-us-east-1-396287094661
           create-application-if-not-exists: "false"
           create-environment-if-not-exists: "false"
           create-s3-bucket-if-not-exists: "false"
-          use-existing-application-version-if-available: "true"
+          use-existing-application-version-if-available: "false"
           wait-for-deployment: "true"
           wait-for-environment-recovery: "true"
 

infra/cdk/deploy-dev-stack.ts

@@ -55,7 +55,10 @@ export class DeployDevStack extends cdk.Stack {
       new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,
         actions: ['elasticbeanstalk:CreateApplicationVersion'],
-        resources: [applicationArn],
+        resources: [
+          applicationArn,
+          `arn:aws:elasticbeanstalk:${REGION}:${ACCOUNT_ID}:applicationversion/${APPLICATION_NAME}/*`,
+        ],
       }),
     );