3a. GitHub OIDC provider + role (Terraform)

hcl

resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = ["6938fd4d98bab03faadb97b34396831e3780aea1"]
}

resource "aws_iam_role" "github_actions" {
  assume_role_policy = jsonencode({
    Statement = [{
      Effect    = "Allow"
      Principal = { Federated = aws_iam_openid_connect_provider.github.arn }
      Action    = "sts:AssumeRoleWithWebIdentity"
      Condition = {
        StringEquals = { "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com" }
        StringLike   = { "token.actions.githubusercontent.com:sub" = "repo:<org>/documind-*:*" }
      }
    }]
  })
}

3b. Workflow (.github/workflows/deploy.yml, each app repo)

yaml

permissions: { id-token: write, contents: read }
jobs:
  build-and-push:
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with: { role-to-assume: arn:aws:iam::<account-id>:role/documind-dev-github-actions-role, aws-region: us-east-1 }
      - uses: aws-actions/amazon-ecr-login@v2
        id: ecr-login
      - run: |
          docker build -t ${{ steps.ecr-login.outputs.registry }}/documind-backend:${{ github.sha }} .
          docker push ${{ steps.ecr-login.outputs.registry }}/documind-backend:${{ github.sha }}
      - uses: actions/checkout@v4
        with: { repository: <org>/documind-gitops, token: ${{ secrets.GITOPS_REPO_TOKEN }}, path: gitops }
      - run: |
          cd gitops
          sed -i "s|documind-backend:.*|documind-backend:${{ github.sha }}|" manifests/backend/rollout.yaml
          git config user.name "github-actions" && git config user.email "[email protected]"
          git add manifests/backend/rollout.yaml
          git commit -m "chore: deploy backend ${{ github.sha }}" && git push

GITOPS_REPO_TOKEN - GitHub PAT with write access to documind-gitops, added as a repo secret.

Push to main → build → ECR → gitops patch → ArgoCD sync → Rollout canary.

image.png