Automating Deployment with GitHub Actions: CI/CD Guide

Manually pushing code, logging in, pulling repositories, and building Docker images every single time becomes tedious and error-prone. This article explores how to implement a fully automated deployment pipeline covering code changes, testing, containerization, and production deployment upon every GitHub push.

Building upon our previous architecture where AWS EC2 instances reside safely inside a private subnet (10.0.10.0/24) behind an Application Load Balancer, we face three primary challenges when trying to automate this workflow.

• Problem 1: The server is unreachable directly. There is no public IP, no open port 22, and no bastion host for GitHub Actions to SSH into.
• Problem 2: The deployment involves a multi-container Docker Compose stack featuring four interdependent services: PostgreSQL, Backend, Frontend, and Nginx requiring strict health checks.
• Problem 3: No persistent credentials stored in GitHub Secrets, mitigating the security risk of long-lived access keys leaking.

Stock photo for illustration only, not from the actual event

The solution relies on three AWS services: IAM OIDC, Systems Manager (SSM), and Terraform. The CD workflow requests an OIDC token from GitHub's token service, presents it to AWS STS to receive temporary credentials valid for one hour, and uses the AWS CLI to dispatch an SSM command to the EC2 instance executing git pull and docker compose up.