fix: correct and refactor GitHub workflows

[afaryy]

Summary

• fix the database migration workflow by removing the invalid --enable-execute-command false AWS CLI argument
• extract long inline shell blocks from database migration, ECS deploy, ECS rollback, service bootstrap, image publication, and Terraform target selection into local composite actions
• preserve existing controls: workflow_dispatch where required, main-only dispatch, sandbox environment, OIDC, immutable digest/source-commit verification, service-scoped deploy, and known-good rollback

Local actions added

• .github/actions/verify-ecr-image: verifies an ECR digest and matching sha-<source_commit> tag
• .github/actions/resolve-ecs-service: maps backend/frontend to the approved service, task family, container, target group, repository, and smoke URL
• .github/actions/run-ecs-database-migration: registers and runs the one-off private ECS Fargate Alembic migration task
• .github/actions/deploy-ecs-service: registers a digest-pinned task definition, updates one ECS service, verifies health, and restores the predecessor on failed verification
• .github/actions/rollback-ecs-service: restores the selected ECS service to its immediately preceding known-good task-definition revision
• .github/actions/resolve-service-bootstrap-target: maps backend/frontend bootstrap to the approved Terraform service root and image digest variable
• .github/actions/resolve-terraform-root: maps approved Terraform workflow targets to fixed root directories
• .github/actions/select-image-components: selects backend/frontend image publication from push changes or manual component input
• .github/actions/publish-ecr-image: pushes a locally built image to its ECR repository and writes the digest handoff artifact file

Root cause fixed

aws ecs run-task treats --enable-execute-command as a boolean flag. Passing false creates an unknown positional option and fails before the migration task can start. ECS Exec remains disabled by omitting the flag.

Validation

• workflow and local action YAML parse
• static workflow/action control checks
• composite action marker checks
• git diff --check

Not included

• no application code changes
• no CloudFormation changes
• no Terraform code changes
• no AWS resource changes
• no deployment, rollback, migration, image publish, or Terraform run

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud