deploy.yml

name: Deploy vertex-demo to EC2

permissions:
  id-token: write  # Required for OIDC authentication
  contents: read   # Required to check out the repo

on:
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Assume AWS IAM Role
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: eu-west-2
          role-session-name: GitHubActionsDeploy

      - name: Verify AWS Credentials
        run: aws sts get-caller-identity

      - name: Log in to Amazon ECR
        run: |
          aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ secrets.ECR_REPOSITORY }}

      - name: Verify ECR Repository Exists
        run: |
          aws ecr describe-repositories --repository-names $(echo ${{ secrets.ECR_REPOSITORY }} | awk -F'/' '{print $NF}') --region eu-west-2

      - name: Build and Push Docker Image
        run: |
          docker build -t isaric-vertex .
          docker tag isaric-vertex:latest ${{ secrets.ECR_REPOSITORY }}:latest
          docker push ${{ secrets.ECR_REPOSITORY }}:latest

      - name: Create private key file
        run: |
          echo "${{ secrets.EC2_PRIVATE_KEY }}" > private_key.pem
          chmod 600 private_key.pem

      - name: SSH into EC2 and Deploy Container
        run: |
          ssh -o StrictHostKeyChecking=no -i private_key.pem ec2-user@${{ secrets.EC2_HOST }} << 'EOF'
          set -euo pipefail
      
          export AWS_ACCESS_KEY_ID=$(aws configure get aws_access_key_id)
          export AWS_SECRET_ACCESS_KEY=$(aws configure get aws_secret_access_key)
          export AWS_SESSION_TOKEN=$(aws configure get aws_session_token)

          aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ secrets.ECR_REPOSITORY }}

          docker stop isaric-vertex || true
          docker rm isaric-vertex || true

          docker system prune -af

          docker pull ${{ secrets.ECR_REPOSITORY }}:latest
      
          docker run -d --restart unless-stopped --name isaric-vertex -p 8050:8050 ${{ secrets.ECR_REPOSITORY }}:latest

          EOF

      - name: Cleanup private key
        run: rm -f private_key.pem