Hi folks 👋 I'm wondering if anyone has any tips on how I might effectively go about using the crosswalk ecr package to build an image, and subsequently pull it as a cacheFrom during CICD? I've the below code, but on an immutable repository (required because of FSBP controls on ECR) I get issues when pushing (though the hash digest shouldn't have changed) and if I use a unique value (say a commit sha) for the image tag I end up creating a new resource every deploy as the URN changes. Is there something really easy and obvious i've missed 😅

const cacheFrom = aws.ssm
      .getParameter({
        name: `/tempo-image/${slug}`,
      })
      .then(result => [result.value])
      .catch(reason => {
        const empty: Array<pulumi.Output<string>> = []
        pulumi.log.warn(
          `An error occurred whilst fetching SSM param, not setting an image to use as a cache. ${reason}`
        )
        return empty
      })

    const image = new awsx.ecr.Image(
      'tempo',
      {
        cacheFrom,
        repositoryUrl,
        context: './image',
        platform: 'linux/arm64',
      },
      { replaceOnChanges: ['repoDigest'] }
    )

    new aws.ssm.Parameter('tempo-image', {
      type: 'String',
      value: image.imageUri,
      name: `/tempo-image/${slug}`,
    })