Declare moved_from for renamed immutable inputs

[devin-ai-integration]

Summary

ENG-5084: module versions that renamed or merged immutable inputs currently can't be upgraded to — IMMUTABLE_INPUT_CHANGED fires even when the resolved Terraform is a no-op. The platform side adds a declarative moved_from list (flightcontrolhq/flightcontrol#6750); this declares it on the two definitions that hit the problem.

• rvn-acm-certificate 0.4.1 — domains ← domain_name, subject_alternative_names (the 0.4.0 breaking change from the ticket).
• rvn-ecs-nlb 0.3.2 — listeners ← the former flat single-listener inputs (listener_port, listener_protocol, container_port and tls_target_protocol were immutable; the tls_* ones are listed too since they moved into the same object array).

Both are patch bumps: no Terraform or input behavior changes, only metadata that lets existing instances upgrade in place instead of being destroyed and recreated (new certificate ARN, ALB listener repoint, fresh DNS validation).

I scanned the definition history for other cross-version immutable input renames; the rest of the hits were same-version dev churn or $include partial extractions, not published renames.

module-schema.json gets the field too, though it's already noted as a stale snapshot of the Flightcontrol schema.

Verified with ravion-modules validate / compile and the tools test suite. make publish-local-dev could not run here — it requires the local dev API at localhost:8080.

Link to Devin session: https://app.devin.ai/sessions/ccb6dfc1435b4b6ea8002216c7ec2f66
Requested by: @flybayer

Greptile Summary

Adds metadata enabling upgrades across renamed immutable inputs.

• Declares the former flat listener inputs as predecessors of the ECS NLB listeners input and releases version 0.3.2.
• Declares the former certificate domain inputs as predecessors of domains and releases version 0.4.1.
• Adds moved_from to the input variants represented by the repository’s schema snapshot.

Confidence Score: 5/5

The PR appears safe to merge with no concrete changed-code failure identified.

The predecessor IDs match the historical renamed inputs, and the metadata-only patch releases do not alter Terraform behavior or current input mappings.

Important Files Changed

Filename	Overview
compute/ecs_service/rvn-ecs-nlb-definition.yml	Adds a complete mapping from the former flat listener fields to listeners and bumps the patch release.
security/acm_certificate/rvn-acm-certificate-definition.yml	Maps both former certificate domain fields to domains and bumps the patch release.
module-schema.json	Documents and permits moved_from on the input variants represented by this stale schema snapshot.

_{Reviews (1): Last reviewed commit: "Declare moved_from for renamed immutable..." | Re-trigger Greptile}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

Ravion Module Publish Plan

Dry run only. No Ravion API mutations were made.

Module	Current Version	New Version	Description
rvn-acm-certificate	0.4.0	0.4.1	Allow existing certificates to upgrade to the domains input without being recreated.
rvn-ecs-nlb	0.3.1	0.3.2	Allow existing services to upgrade to the listeners input without being recreated.

Diffs

rvn-acm-certificate 0.4.0 -> 0.4.1

--- remote
+++ compiled
     id: domains
     immutable: true
     label: Domains
+    moved_from:
+      - domain_name
+      - subject_alternative_names
     placeholder: api.example.com
     required: true
     type: string_array
@@
 
   - [AWS Certificate Manager DNS validation](https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html)
   - [AWS Certificate Manager certificates for CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html)
-  - [Source module](https://github.com/flightcontrolhq/modules/tree/rvn-acm-certificate@0.4.0/security/acm_certificate)
+  - [Source module](https://github.com/flightcontrolhq/modules/tree/rvn-acm-certificate@0.4.1/security/acm_certificate)
 stack:
   pipelines:
     change:
@@
         base_path: security/acm_certificate
         branch: main
         execution_environment_id: << module.input.execution_environment_id >>
-        ref: rvn-acm-certificate@0.4.0
+        ref: rvn-acm-certificate@0.4.1
         repo: https://github.com/flightcontrolhq/modules
         stack_id: <<stack.id>>
         terraform_variables:

rvn-ecs-nlb 0.3.1 -> 0.3.2

--- remote
+++ compiled
     item_title:
       template: "{listener_protocol} {listener_port}"
     label: Listeners
+    moved_from:
+      - listener_port
+      - listener_protocol
+      - container_port
+      - tls_certificate
+      - tls_ssl_policy
+      - tls_alpn_policy
+      - tls_target_protocol
     required: true
     type: object_array
   - add_button_label: Add CIDR block
@@
 
   The module is intentionally focused on Layer 4 services behind a Network Load Balancer. Use ECS Web Service for HTTP host and path routing through an Application Load Balancer.
 
-  Terraform source: [flightcontrolhq/modules/compute/ecs_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-nlb@0.3.1/compute/ecs_service)
+  Terraform source: [flightcontrolhq/modules/compute/ecs_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-nlb@0.3.2/compute/ecs_service)
 
   ## Use cases
 
@@
         base_path: compute/ecs_service
         branch: main
         execution_environment_id: << module.input.execution_environment_id >>
-        ref: rvn-ecs-nlb@0.3.1
+        ref: rvn-ecs-nlb@0.3.2
         repo: https://github.com/flightcontrolhq/modules
         stack_id: <<stack.id>>
         terraform_variables: