ecs-deploy.yml

name: ECS Deploy

on:
  workflow_call:
    inputs:
      image_tag:
        description: "Container image tag (unused — kept for workflow_call compat)"
        type: string
        default: ""
      service_name:
        description: "ECS service name (defaults to repo name)"
        type: string
        default: ""
      cluster_name:
        description: "ECS cluster name"
        type: string
        default: "javabin-platform"
      aws_account_id:
        description: "AWS account ID"
        type: string
        default: "553637109631"
      aws_region:
        description: "AWS region"
        type: string
        default: "eu-central-1"

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    name: ECS Deploy
    runs-on: ubuntu-latest
    steps:
      - name: Set session name
        run: echo "SESSION_NAME=$(echo "${GITHUB_ACTOR}-${GITHUB_SHA:0:8}-${GITHUB_RUN_ID}" | head -c 64)" >> "$GITHUB_ENV"

      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.PLATFORM_APP_ID }}
          private-key: ${{ secrets.PLATFORM_APP_PRIVATE_KEY }}
          owner: javaBin

      - name: Checkout platform scripts
        uses: actions/checkout@v6
        with:
          repository: javaBin/platform
          token: ${{ steps.app-token.outputs.token }}
          ref: main
          sparse-checkout: scripts
          path: .platform

      - name: Assume broker role via OIDC
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ inputs.aws_account_id }}:role/javabin-ci-app-broker
          aws-region: ${{ inputs.aws_region }}
          role-session-name: ${{ env.SESSION_NAME }}

      - name: Get deploy credentials from broker
        id: broker
        env:
          PROJECT: javabin
        run: sh .platform/scripts/invoke-ci-broker.sh deploy

      - name: Deploy to ECS
        env:
          SERVICE: ${{ inputs.service_name || format('{0}-{1}', steps.broker.outputs.team, github.event.repository.name) }}
          CLUSTER: ${{ inputs.cluster_name }}
        run: sh .platform/scripts/ecs-deploy.sh