deploy.yml

name: Deploy to AWS

on:
  push:
    branches: [develop]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ap-northeast-2

      - name: Login to ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push image
        env:
          ECR_URL: ${{ secrets.ECR_REPOSITORY_URL }}
        run: |
          docker build -t $ECR_URL:latest -t $ECR_URL:${{ github.sha }} .
          docker push $ECR_URL:latest
          docker push $ECR_URL:${{ github.sha }}

      - name: Trigger redeploy on EC2 via SSM
        run: |
          COMMAND_ID=$(aws ssm send-command \
            --instance-ids ${{ secrets.EC2_INSTANCE_ID }} \
            --document-name AWS-RunShellScript \
            --parameters 'commands=["/usr/local/bin/deploy.sh"]' \
            --query 'Command.CommandId' --output text)

          echo "Command ID: $COMMAND_ID"

          aws ssm wait command-executed \
            --command-id $COMMAND_ID \
            --instance-id ${{ secrets.EC2_INSTANCE_ID }}

          aws ssm get-command-invocation \
            --command-id $COMMAND_ID \
            --instance-id ${{ secrets.EC2_INSTANCE_ID }} \
            --query 'StandardOutputContent' --output text