From your laptop to
an EC2 box, seven
steps, no SSH.

name: deploy-to-aws
on:
  push: { branches: [main] }
  pull_request:

permissions:
  id-token: write
  contents: read

env:
  AWS_REGION: ap-south-1
  ECR: 4155.dkr.ecr.ap-south-1.amazonaws.com/app

jobs:
  build:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - uses: shivammathur/setup-php@v2
        with: { php-version: 8.3 }
      - run: composer install --no-dev -o
      - run: vendor/bin/phpunit --testdox
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::4155:role/gha-deploy
          aws-region: ap-south-1
      - uses: aws-actions/amazon-ecr-login@v2
      - run: docker build -t app .
      - run: docker push app

  deploy:
    needs: build
    environment: production
    runs-on: ubuntu-24.04
    steps:
      - run: aws ssm send-command --targets Key=tag:App,Values=web
      - run: curl -fsS https://app.example.com/health

pipeline {
  agent { label 'linux-1' }

  environment {
    AWS_REGION = 'ap-south-1'
    ECR        = '4155.dkr.ecr.ap-south-1.amazonaws.com/app'
    EC2_HOST   = '10.0.2.14'
  }

  triggers { githubPush() }

  stages {
    stage('Build') {
      steps {
        sh 'composer install --no-dev -o'
        sh 'docker build -t app .'
      }
    }
    stage('Test') {
      steps { sh 'vendor/bin/phpunit --log-junit reports/junit.xml' }
      post { always { junit 'reports/junit.xml' } }
    }
    stage('Push to ECR') {
      steps {
        withAWS(role: 'jenkins-deploy', region: 'ap-south-1') {
          sh 'docker push app'
        }
      }
    }
    stage('Approve') {
      when { branch 'main' }
      steps { input message: 'Deploy to production?', ok: 'Ship it' }
    }
    stage('Deploy') {
      steps {
        sshagent(['ec2-deploy-key']) {
          sh 'ssh ubuntu@10.0.2.14 docker compose up -d'
        }
      }
    }
  }

  post {
    failure { sh 'ssh ubuntu@10.0.2.14 ./rollback.sh' }
    always  { cleanWs() }
  }
}