3. CI/CD with GitHub Actions

# Create IAM user
aws iam create-user --user-name github-actions-deploy

# Create access key for programmatic access
aws iam create-access-key --user-name github-actions-deploy

# Save the AccessKeyId and SecretAccessKey from output
# You'll need these for GitHub Secrets

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:PutImage",
        "ecr:InitiateLayerUpload",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeTaskDefinition",
        "ecs:RegisterTaskDefinition",
        "ecs:UpdateService",
        "ecs:DescribeServices"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "arn:aws:iam::*:role/ecsTaskExecutionRole"
    }
  ]
}

# Create the policy from the JSON file
aws iam create-policy \
    --policy-name GitHubActionsDeployPolicy \
    --policy-document file://github-actions-policy.json

# Get your AWS account ID
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

# Attach the policy to the user
aws iam attach-user-policy \
    --user-name github-actions-deploy \
    --policy-arn arn:aws:iam::${ACCOUNT_ID}:policy/GitHubActionsDeployPolicy

# Verify the policy is attached
aws iam list-attached-user-policies \
    --user-name github-actions-deploy

name: Deploy to AWS ECS

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

env:
  AWS_REGION: us-east-1
  ECR_REPOSITORY: news-api
  ECS_SERVICE: news-api-service
  ECS_CLUSTER: news-api-cluster
  ECS_TASK_DEFINITION: news-api-task
  CONTAINER_NAME: news-api

jobs:
  test:
    name: Run Tests
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Set up Python 3.11
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      
      - name: Cache pip dependencies
        uses: actions/cache@v3
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-
      
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install pytest pytest-cov
      
      - name: Run tests with coverage
        run: |
          pytest --cov=app --cov-report=term-missing
      
      - name: Check test coverage threshold
        run: |
          coverage report --fail-under=70

  build-and-deploy:
    name: Build and Deploy
    needs: test
    runs-on: ubuntu-latest
    # Only run on pushes to main (not on pull requests)
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1
      
      - name: Build, tag, and push image to Amazon ECR
        id: build-image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          # Build Docker image
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:latest .
          
          # Push both tags to ECR
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:latest
          
          # Output image URI for next step
          echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
      
      - name: Download current task definition
        run: |
          aws ecs describe-task-definition \
            --task-definition ${{ env.ECS_TASK_DEFINITION }} \
            --query taskDefinition > task-definition.json
      
      - name: Update task definition with new image
        id: task-def
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: task-definition.json
          container-name: ${{ env.CONTAINER_NAME }}
          image: ${{ steps.build-image.outputs.image }}
      
      - name: Deploy to Amazon ECS
        uses: aws-actions/amazon-ecs-deploy-task-definition@v1
        with:
          task-definition: ${{ steps.task-def.outputs.task-definition }}
          service: ${{ env.ECS_SERVICE }}
          cluster: ${{ env.ECS_CLUSTER }}
          wait-for-service-stability: true
      
      - name: Verify deployment
        run: |
          echo "Deployment completed successfully!"
          echo "Image deployed: ${{ steps.build-image.outputs.image }}"
          
          # Get service status
          aws ecs describe-services \
            --cluster ${{ env.ECS_CLUSTER }} \
            --services ${{ env.ECS_SERVICE }} \
            --query 'services[0].{Status:status,Running:runningCount,Desired:desiredCount}' \
            --output table
      
      - name: Post deployment notification
        if: success()
        run: |
          echo "✅ Deployment successful!"
          echo "Commit: ${{ github.sha }}"
          echo "Deployed by: ${{ github.actor }}"
      
      - name: Deployment failure notification
        if: failure()
        run: |
          echo "❌ Deployment failed!"
          echo "Check the logs above for details"

# Make a small code change to trigger deployment
echo "# Deployment test" >> README.md

# Commit and push to main branch
git add README.md
git commit -m "Test CI/CD pipeline"
git push origin main

# Check ECS service is running new tasks
aws ecs describe-services \
    --cluster news-api-cluster \
    --services news-api-service \
    --query 'services[0].{Running:runningCount,Desired:desiredCount,TaskDef:taskDefinition}' \
    --output table

# Check task definition image matches Git SHA
aws ecs describe-task-definition \
    --task-definition news-api-task \
    --query 'taskDefinition.containerDefinitions[0].image'

# Result should show: ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/news-api:abc123
# where abc123 is your Git commit SHA

# Get your ALB DNS name
aws elbv2 describe-load-balancers \
    --names news-api-alb \
    --query 'LoadBalancers[0].DNSName' \
    --output text

# Test the API
curl http://YOUR-ALB-DNS/docs
# Should return your FastAPI documentation page

# Test an endpoint (requires an API key, covered in Chapter 26)
curl -H "Authorization: Bearer YOUR_KEY" http://YOUR-ALB-DNS/articles
# Should return articles from your database