From 3cf441f1406fe9a74aa142343819c1d2c0ac29d2 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 21 Jul 2026 15:23:07 +0530
Subject: [PATCH 01/14] fix(release): update the release script

---
 .github/workflows/cd-production.yml | 2 +-
 .github/workflows/cd-staging.yml    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cd-production.yml b/.github/workflows/cd-production.yml
index 01970ce..ddb3870 100644
--- a/.github/workflows/cd-production.yml
+++ b/.github/workflows/cd-production.yml
@@ -31,7 +31,7 @@ jobs:
           INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
           BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
         run: |
-          DEPLOY_CMD="cd ${BUILD_DIRECTORY} && git fetch --tags origin && git checkout --force ${{ github.sha }} && docker compose build && docker compose run --rm --entrypoint '' backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f"
+          DEPLOY_CMD="cd ${BUILD_DIRECTORY} && git fetch --tags origin && git checkout --force ${{ github.sha }} && docker compose build && docker compose run --rm --entrypoint '' backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f && docker builder prune -af"
 
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \
diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
index 32811a6..875989f 100644
--- a/.github/workflows/cd-staging.yml
+++ b/.github/workflows/cd-staging.yml
@@ -30,7 +30,7 @@ jobs:
           INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
           BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
         run: |
-          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard origin/main && docker compose build && docker compose run --rm --entrypoint \\\"\\\" backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f\"'
+          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard origin/main && docker compose build && docker compose run --rm --entrypoint \\\"\\\" backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f && docker builder prune -af\"'
 
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \

From a31eb12905fc81fd134acfa15882c12f90c0cfea Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 28 Jul 2026 12:55:47 +0530
Subject: [PATCH 02/14] feat(release): move docker image to ecr and pull form
 there

---
 .github/workflows/cd-production.yml | 52 ++++++++++++++++-------------
 .github/workflows/cd-staging.yml    | 49 +++++++++++++++------------
 2 files changed, 56 insertions(+), 45 deletions(-)

diff --git a/.github/workflows/cd-production.yml b/.github/workflows/cd-production.yml
index ec019ad..de2451e 100644
--- a/.github/workflows/cd-production.yml
+++ b/.github/workflows/cd-production.yml
@@ -3,7 +3,7 @@ name: Deploy Kaapi Guardrails to EC2 Production
 on:
   push:
     tags:
-      - "v*" # Deploy only when tags like v1.0.0, v2.1.0, etc., are created
+      - "v[0-9]+.[0-9]+.[0-9]+" # Deploy only when tags like v1.0.0, v2.1.0, etc., are created
 
 concurrency:
   group: guardrail-production-ec2-deploy
@@ -25,13 +25,29 @@ jobs:
           role-to-assume: ${{ secrets.EC2_DEPLOY_ROLE_ARN }}
           aws-region: ${{ secrets.AWS_REGION }}
 
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build and Push Docker Image
+        env:
+          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-prod-repo
+          IMAGE_TAG: ${{ github.ref_name }}
+        run: |
+          docker build -t $REGISTRY/$REPOSITORY:$IMAGE_TAG ./backend
+          docker push $REGISTRY/$REPOSITORY:$IMAGE_TAG
+
       - name: Trigger deploy on EC2 via SSM
         id: ssm
         env:
           INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
           BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-prod-repo
+          IMAGE_TAG: ${{ github.ref_name }}
         run: |
-          DEPLOY_CMD="cd ${BUILD_DIRECTORY} && git fetch --tags origin && git checkout --force ${{ github.sha }} && docker compose build && docker compose run --rm --entrypoint '' backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f && docker builder prune -af"
+          DEPLOY_CMD="cd ${BUILD_DIRECTORY} && git fetch --tags origin && git checkout --force ${IMAGE_TAG} && aws ecr get-login-password --region ${{ secrets.AWS_REGION }} | docker login --username AWS --password-stdin ${ECR_REGISTRY} && export ECR_REGISTRY=${ECR_REGISTRY} ECR_REPOSITORY=${ECR_REPOSITORY} IMAGE_TAG=${IMAGE_TAG} && docker compose pull backend && docker compose run --rm --entrypoint '' backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f"
 
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \
@@ -49,6 +65,14 @@ jobs:
           INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
           CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
         run: |
+          get_output() {
+            aws ssm get-command-invocation \
+              --command-id "$CMD_ID" \
+              --instance-id "$INSTANCE_ID" \
+              --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
+              --output json
+          }
+          
           for i in {1..20}; do
             STATUS=$(aws ssm get-command-invocation \
               --command-id "$CMD_ID" \
@@ -60,25 +84,13 @@ jobs:
 
             if [ "$STATUS" = "Success" ]; then
               echo "Deployment completed successfully."
-
-              aws ssm get-command-invocation \
-                --command-id "$CMD_ID" \
-                --instance-id "$INSTANCE_ID" \
-                --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
-                --output json
-
+              get_output
               exit 0
             fi
 
             if [ "$STATUS" = "Failed" ] || [ "$STATUS" = "Cancelled" ] || [ "$STATUS" = "TimedOut" ]; then
               echo "Deployment failed."
-
-              aws ssm get-command-invocation \
-                --command-id "$CMD_ID" \
-                --instance-id "$INSTANCE_ID" \
-                --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
-                --output json
-
+              get_output
               exit 1
             fi
 
@@ -86,11 +98,5 @@ jobs:
           done
 
           echo "Deployment timed out after waiting too long."
-
-          aws ssm get-command-invocation \
-            --command-id "$CMD_ID" \
-            --instance-id "$INSTANCE_ID" \
-            --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
-            --output json
-
+          get_output
           exit 1
\ No newline at end of file
diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
index 4becdd1..20a83c9 100644
--- a/.github/workflows/cd-staging.yml
+++ b/.github/workflows/cd-staging.yml
@@ -24,13 +24,28 @@ jobs:
           role-to-assume: ${{ secrets.EC2_DEPLOY_ROLE_ARN }}
           aws-region: ${{ secrets.AWS_REGION }}
 
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build and Push Docker Image
+        env:
+          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-staging-repo
+        run: |
+          docker build -t $REGISTRY/$REPOSITORY:latest ./backend
+          docker push $REGISTRY/$REPOSITORY:latest
+
       - name: Trigger deploy on EC2 via SSM
         id: ssm
         env:
           INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
           BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-staging-repo
+          IMAGE_TAG: latest
         run: |
-          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard origin/main && docker compose build && docker compose run --rm --entrypoint \\\"\\\" backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f && docker builder prune -af\"'
+          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard origin/main && aws ecr get-login-password --region '"${{ secrets.AWS_REGION }}"' | docker login --username AWS --password-stdin '"${ECR_REGISTRY}"' && export ECR_REGISTRY='"${ECR_REGISTRY}"' ECR_REPOSITORY='"${ECR_REPOSITORY}"' IMAGE_TAG='"${IMAGE_TAG}"' && docker compose pull backend && docker compose run --rm --entrypoint \\\"\\\" backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f\"'
 
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \
@@ -48,6 +63,14 @@ jobs:
           INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
           CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
         run: |
+          get_output() {
+            aws ssm get-command-invocation \
+              --command-id "$CMD_ID" \
+              --instance-id "$INSTANCE_ID" \
+              --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
+              --output json
+          }
+          
           for i in {1..20}; do
             STATUS=$(aws ssm get-command-invocation \
               --command-id "$CMD_ID" \
@@ -59,25 +82,13 @@ jobs:
 
             if [ "$STATUS" = "Success" ]; then
               echo "Deployment completed successfully."
-
-              aws ssm get-command-invocation \
-                --command-id "$CMD_ID" \
-                --instance-id "$INSTANCE_ID" \
-                --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
-                --output json
-
+              get_output
               exit 0
             fi
 
             if [ "$STATUS" = "Failed" ] || [ "$STATUS" = "Cancelled" ] || [ "$STATUS" = "TimedOut" ]; then
               echo "Deployment failed."
-
-              aws ssm get-command-invocation \
-                --command-id "$CMD_ID" \
-                --instance-id "$INSTANCE_ID" \
-                --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
-                --output json
-
+              get_output
               exit 1
             fi
 
@@ -85,11 +96,5 @@ jobs:
           done
 
           echo "Deployment timed out after waiting too long."
-
-          aws ssm get-command-invocation \
-            --command-id "$CMD_ID" \
-            --instance-id "$INSTANCE_ID" \
-            --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
-            --output json
-
+          get_output
           exit 1
\ No newline at end of file

From 25f064206557e3f50cc5d98f5d2e5e6c2733781f Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 28 Jul 2026 17:25:05 +0530
Subject: [PATCH 03/14] fix(*): test the deployment script

---
 .github/workflows/cd-staging.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
index 20a83c9..9098df5 100644
--- a/.github/workflows/cd-staging.yml
+++ b/.github/workflows/cd-staging.yml
@@ -2,7 +2,7 @@ name: Deploy Kaapi Guardrails Staging To EC2
 
 on:
   push:
-    branches: [main]
+    branches: [feat/move-docker-image-to-ecr]
 
 concurrency:
   group: guardrail-staging-ec2-deploy

From 3d4fffd65053895202107464651b343999258362 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 28 Jul 2026 17:27:49 +0530
Subject: [PATCH 04/14] fix(test): test the workflow

---
 .github/workflows/cd-staging.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
index 9098df5..0526788 100644
--- a/.github/workflows/cd-staging.yml
+++ b/.github/workflows/cd-staging.yml
@@ -18,6 +18,9 @@ jobs:
       contents: read
 
     steps:
+      - name: Checkout the repo
+        uses: actions/checkout@v7
+
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
         with:

From 50989045a95a4142c91c18d517067e55546cc7bb Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 28 Jul 2026 18:11:47 +0530
Subject: [PATCH 05/14] fix(build): update docker compose

---
 docker-compose.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 2cb47ce..6c11e7a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,7 +9,7 @@ secrets:
 services:
 
   prestart:
-    image: '${DOCKER_IMAGE_BACKEND?Variable not set}:${TAG-latest}'
+    image: '${ECR_REGISTRY}/${ECR_REPOSITORY}:${IMAGE_TAG:-latest}'
     container_name: kaapi-guardrails-prestart
     entrypoint: []
     build:
@@ -25,7 +25,7 @@ services:
     profiles: ["prestart"]
 
   backend:
-    image: '${DOCKER_IMAGE_BACKEND?Variable not set}:${TAG-latest}'
+    image: '${ECR_REGISTRY}/${ECR_REPOSITORY}:${IMAGE_TAG:-latest}'
     container_name: kaapi-guardrails-backend
     restart: always
     build:

From fdc254c0ec532322afa17453abade9062c443180 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 28 Jul 2026 18:35:38 +0530
Subject: [PATCH 06/14] fix(test): test the workflow

---
 .github/workflows/cd-staging.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
index 0526788..f490f29 100644
--- a/.github/workflows/cd-staging.yml
+++ b/.github/workflows/cd-staging.yml
@@ -48,7 +48,7 @@ jobs:
           ECR_REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-staging-repo
           IMAGE_TAG: latest
         run: |
-          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard origin/main && aws ecr get-login-password --region '"${{ secrets.AWS_REGION }}"' | docker login --username AWS --password-stdin '"${ECR_REGISTRY}"' && export ECR_REGISTRY='"${ECR_REGISTRY}"' ECR_REPOSITORY='"${ECR_REPOSITORY}"' IMAGE_TAG='"${IMAGE_TAG}"' && docker compose pull backend && docker compose run --rm --entrypoint \\\"\\\" backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f\"'
+          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && aws ecr get-login-password --region '"${{ secrets.AWS_REGION }}"' | docker login --username AWS --password-stdin '"${ECR_REGISTRY}"' && export ECR_REGISTRY='"${ECR_REGISTRY}"' ECR_REPOSITORY='"${ECR_REPOSITORY}"' IMAGE_TAG='"${IMAGE_TAG}"' && docker compose pull backend && docker compose run --rm --entrypoint \\\"\\\" backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f\"'
 
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \

From e0cce5292761594d1ac8a7cdfdf0797752f27c96 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 28 Jul 2026 18:48:02 +0530
Subject: [PATCH 07/14] fix(*): change the branch name

---
 .github/workflows/cd-staging.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
index f490f29..308cc03 100644
--- a/.github/workflows/cd-staging.yml
+++ b/.github/workflows/cd-staging.yml
@@ -2,7 +2,7 @@ name: Deploy Kaapi Guardrails Staging To EC2
 
 on:
   push:
-    branches: [feat/move-docker-image-to-ecr]
+    branches: [main]
 
 concurrency:
   group: guardrail-staging-ec2-deploy
@@ -48,7 +48,7 @@ jobs:
           ECR_REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-staging-repo
           IMAGE_TAG: latest
         run: |
-          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && aws ecr get-login-password --region '"${{ secrets.AWS_REGION }}"' | docker login --username AWS --password-stdin '"${ECR_REGISTRY}"' && export ECR_REGISTRY='"${ECR_REGISTRY}"' ECR_REPOSITORY='"${ECR_REPOSITORY}"' IMAGE_TAG='"${IMAGE_TAG}"' && docker compose pull backend && docker compose run --rm --entrypoint \\\"\\\" backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f\"'
+          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard main && aws ecr get-login-password --region '"${{ secrets.AWS_REGION }}"' | docker login --username AWS --password-stdin '"${ECR_REGISTRY}"' && export ECR_REGISTRY='"${ECR_REGISTRY}"' ECR_REPOSITORY='"${ECR_REPOSITORY}"' IMAGE_TAG='"${IMAGE_TAG}"' && docker compose pull backend && docker compose run --rm --entrypoint \\\"\\\" backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f\"'
 
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \

From 3fbeeb198fc2f038ba897fc26448d112de17cc65 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 28 Jul 2026 18:49:42 +0530
Subject: [PATCH 08/14] fix(release): added the checkout steps

---
 .github/workflows/cd-production.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/cd-production.yml b/.github/workflows/cd-production.yml
index de2451e..2370cde 100644
--- a/.github/workflows/cd-production.yml
+++ b/.github/workflows/cd-production.yml
@@ -19,6 +19,11 @@ jobs:
       contents: read
 
     steps:
+      - name: Checkout the repo
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.release.tag_name }}
+
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
         with:

From f46184d58cc8c1fc8521ce39dbcd827ab21dc4dc Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Wed, 29 Jul 2026 19:54:26 +0530
Subject: [PATCH 09/14] fix(release): update the cd-staging script

---
 .github/workflows/cd-staging.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
index 308cc03..3b081ea 100644
--- a/.github/workflows/cd-staging.yml
+++ b/.github/workflows/cd-staging.yml
@@ -48,7 +48,7 @@ jobs:
           ECR_REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-staging-repo
           IMAGE_TAG: latest
         run: |
-          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard main && aws ecr get-login-password --region '"${{ secrets.AWS_REGION }}"' | docker login --username AWS --password-stdin '"${ECR_REGISTRY}"' && export ECR_REGISTRY='"${ECR_REGISTRY}"' ECR_REPOSITORY='"${ECR_REPOSITORY}"' IMAGE_TAG='"${IMAGE_TAG}"' && docker compose pull backend && docker compose run --rm --entrypoint \\\"\\\" backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f\"'
+          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard origin/main && aws ecr get-login-password --region '"${{ secrets.AWS_REGION }}"' | docker login --username AWS --password-stdin '"${ECR_REGISTRY}"' && export ECR_REGISTRY='"${ECR_REGISTRY}"' ECR_REPOSITORY='"${ECR_REPOSITORY}"' IMAGE_TAG='"${IMAGE_TAG}"' && docker compose pull backend && docker compose --profile prestart run --rm prestart && docker compose up -d --remove-orphans && docker image prune -f\"'
 
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \

From 01b7c3d2f0e54e7a38afa6ac90ba9daca13cc371 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Mon, 3 Aug 2026 09:40:56 +0530
Subject: [PATCH 10/14] fix(release): update the prod deployment

---
 .github/workflows/cd-production.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cd-production.yml b/.github/workflows/cd-production.yml
index 2370cde..f2551cf 100644
--- a/.github/workflows/cd-production.yml
+++ b/.github/workflows/cd-production.yml
@@ -52,7 +52,7 @@ jobs:
           ECR_REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-prod-repo
           IMAGE_TAG: ${{ github.ref_name }}
         run: |
-          DEPLOY_CMD="cd ${BUILD_DIRECTORY} && git fetch --tags origin && git checkout --force ${IMAGE_TAG} && aws ecr get-login-password --region ${{ secrets.AWS_REGION }} | docker login --username AWS --password-stdin ${ECR_REGISTRY} && export ECR_REGISTRY=${ECR_REGISTRY} ECR_REPOSITORY=${ECR_REPOSITORY} IMAGE_TAG=${IMAGE_TAG} && docker compose pull backend && docker compose run --rm --entrypoint '' backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f"
+          DEPLOY_CMD="cd ${BUILD_DIRECTORY} && git fetch --tags origin && git checkout --force ${IMAGE_TAG} && aws ecr get-login-password --region ${{ secrets.AWS_REGION }} | docker login --username AWS --password-stdin ${ECR_REGISTRY} && export ECR_REGISTRY=${ECR_REGISTRY} ECR_REPOSITORY=${ECR_REPOSITORY} IMAGE_TAG=${IMAGE_TAG} && docker compose pull backend && docker compose --profile prestart run --rm prestart && docker compose up -d --remove-orphans && docker image prune -f"
 
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \

From e371269f1e663aad960cf673e3fa220bab3073fe Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Mon, 3 Aug 2026 10:01:19 +0530
Subject: [PATCH 11/14] fix(*): formatting

---
 .github/workflows/cd-production.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cd-production.yml b/.github/workflows/cd-production.yml
index f2551cf..417d940 100644
--- a/.github/workflows/cd-production.yml
+++ b/.github/workflows/cd-production.yml
@@ -77,7 +77,7 @@ jobs:
               --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
               --output json
           }
-          
+
           for i in {1..20}; do
             STATUS=$(aws ssm get-command-invocation \
               --command-id "$CMD_ID" \
@@ -104,4 +104,4 @@ jobs:
 
           echo "Deployment timed out after waiting too long."
           get_output
-          exit 1
\ No newline at end of file
+          exit 1

From f70592ad601c80a650f49244aa9e4d938d4cd835 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Mon, 3 Aug 2026 10:09:24 +0530
Subject: [PATCH 12/14] fix(*): formatting

---
 .github/workflows/cd-staging.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
index 3b081ea..19690d4 100644
--- a/.github/workflows/cd-staging.yml
+++ b/.github/workflows/cd-staging.yml
@@ -73,7 +73,7 @@ jobs:
               --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
               --output json
           }
-          
+
           for i in {1..20}; do
             STATUS=$(aws ssm get-command-invocation \
               --command-id "$CMD_ID" \
@@ -100,4 +100,4 @@ jobs:
 
           echo "Deployment timed out after waiting too long."
           get_output
-          exit 1
\ No newline at end of file
+          exit 1

From cd4128b241f0f0fb6f0a02091d86478f9b48b14a Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Mon, 3 Aug 2026 10:35:19 +0530
Subject: [PATCH 13/14] fix(*): update the install guardrails hub script

---
 .../scripts/install_guardrails_from_hub.sh    | 39 +++++++++++++++----
 1 file changed, 32 insertions(+), 7 deletions(-)

diff --git a/backend/scripts/install_guardrails_from_hub.sh b/backend/scripts/install_guardrails_from_hub.sh
index ffeea3a..53414d2 100755
--- a/backend/scripts/install_guardrails_from_hub.sh
+++ b/backend/scripts/install_guardrails_from_hub.sh
@@ -16,18 +16,43 @@ if [[ ! -f "$MANIFEST_FILE" ]]; then
   exit 1
 fi
 
+retry() {
+  local attempts="$1"
+  shift
+  local delay=5
+  local n=1
+
+  until "$@"; do
+    if (( n >= attempts )); then
+      return 1
+    fi
+    echo "Attempt ${n}/${attempts} failed; retrying in ${delay}s..."
+    sleep "$delay"
+    n=$(( n + 1 ))
+    delay=$(( delay * 2 ))
+  done
+}
+
 #######################################
 # Configure Guardrails (non-interactive)
 #######################################
 
 if [[ -n "$GUARDRAILS_HUB_API_KEY" ]]; then
-  echo "Configuring Guardrails CLI..."
-  guardrails configure \
-    --token "$GUARDRAILS_HUB_API_KEY" \
-    $( [[ "$ENABLE_METRICS" == "true" ]] && echo "--enable-metrics" || echo "--disable-metrics" ) \
-    $( [[ "$ENABLE_REMOTE_INFERENCING" == "true" ]] && echo "--enable-remote-inferencing" || echo "--disable-remote-inferencing" )
+  echo "Writing Guardrails configuration..."
+
+  ANON_ID="$( { python3 -c 'import uuid; print(uuid.uuid4())' \
+    || python -c 'import uuid; print(uuid.uuid4())'; } 2>/dev/null \
+    || echo "00000000-0000-0000-0000-000000000000")"
+
+  cat > "${HOME}/.guardrailsrc" <<EOF
+id=${ANON_ID}
+token=${GUARDRAILS_HUB_API_KEY}
+enable_metrics=$( [[ "$ENABLE_METRICS" == "true" ]] && echo true || echo false )
+use_remote_inferencing=$( [[ "$ENABLE_REMOTE_INFERENCING" == "true" ]] && echo true || echo false )
+EOF
+  chmod 600 "${HOME}/.guardrailsrc"
 else
-  echo "GUARDRAILS_HUB_API_KEY is not set; skipping Guardrails CLI configure."
+  echo "GUARDRAILS_HUB_API_KEY is not set; skipping Guardrails configuration."
 fi
 
 
@@ -51,7 +76,7 @@ fi
 
 for SRC in $HUB_SOURCES; do
   echo "Installing Guardrails hub validator: $SRC"
-  if ! guardrails hub install "$SRC"; then
+  if ! retry 4 guardrails hub install "$SRC"; then
     if [[ -z "$GUARDRAILS_HUB_API_KEY" ]]; then
       echo "Skipping hub validator install for $SRC because GUARDRAILS_HUB_API_KEY is not set."
       continue

From 3e8e157e8ba29cc87a14972ee471871f658aa937 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:07:08 +0530
Subject: [PATCH 14/14] fix(*): update the install guardrails hub script

---
 .github/workflows/continuous-integration.yml   | 2 ++
 backend/Dockerfile                             | 2 ++
 backend/scripts/install_guardrails_from_hub.sh | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index 8738d11..c9d6c14 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -9,6 +9,8 @@ on:
 jobs:
   checks:
     runs-on: ubuntu-latest
+    env:
+      NLTK_DISABLE_IMPORT_SECURITY: "1"
     services:
       postgres:
         image: postgres:16
diff --git a/backend/Dockerfile b/backend/Dockerfile
index c6f4a36..eb0c852 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -47,6 +47,8 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 # Install pinned spaCy model in the final environment used at runtime.
 RUN python -m pip install --no-deps "${SPACY_MODEL_WHEEL_URL}"
 
+ENV NLTK_DISABLE_IMPORT_SECURITY=1
+
 # Set HuggingFace cache directory
 ENV HF_HOME=/app/hf_cache
 
diff --git a/backend/scripts/install_guardrails_from_hub.sh b/backend/scripts/install_guardrails_from_hub.sh
index 53414d2..fcc5486 100755
--- a/backend/scripts/install_guardrails_from_hub.sh
+++ b/backend/scripts/install_guardrails_from_hub.sh
@@ -8,6 +8,8 @@ GUARDRAILS_HUB_API_KEY="${GUARDRAILS_HUB_API_KEY:-}"
 ENABLE_METRICS="${ENABLE_METRICS:-false}"
 ENABLE_REMOTE_INFERENCING="${ENABLE_REMOTE_INFERENCING:-true}"
 
+export NLTK_DISABLE_IMPORT_SECURITY=1
+
 BACKEND_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 MANIFEST_FILE="${1:-$BACKEND_DIR/app/core/validators/validators.json}"