gh-actions-aws-ecr-ecs

GitHub Actions for Docker build and push to Amazon ECR with OIDC (configure-aws-credentials, amazon-ecr-login, docker/build-push-action) and optional ECS deploy (amazon-ecs-render-task-definition, amazon-ecs-deploy-task-definition). Covers date-stamped tags plus latest or latest-dev. Use for GHA container pipelines to AWS ECR/ECS.

---
name: gh-actions-aws-ecr-ecs
description: >-
  GitHub Actions for Docker build and push to Amazon ECR with OIDC
  (configure-aws-credentials, amazon-ecr-login, docker/build-push-action) and
  optional ECS deploy (amazon-ecs-render-task-definition,
  amazon-ecs-deploy-task-definition). Covers date-stamped tags plus latest or
  latest-dev. Use for GHA container pipelines to AWS ECR/ECS.
---

# GitHub Actions: Docker → ECR → ECS

## Build and push

1. **`permissions`** — **`id-token: write`** and **`contents: read`** so **`aws-actions/configure-aws-credentials`** can assume an IAM role via **OIDC** (no long-lived AWS keys in GitHub).
2. **`actions/checkout`** — repo root (or path) for **`context`** / **`file`**.
3. **`aws-actions/configure-aws-credentials`** — **`role-to-assume`** (deploy role ARN trusted by GitHub’s OIDC provider in IAM).
4. **`aws-actions/amazon-ecr-login`** — authenticate Docker to the registry; optional **`id: login-ecr`** if you reference outputs.
5. **Version tag** — write a date stamp to **`GITHUB_OUTPUT`** (see **`gh-actions-date-versioning`**; common format **`%Y.%m.%d-%H%M`**).
6. **`docker/build-push-action`** — **`context`**, **`file`**, **`push: true`**, **`tags:`** (immutable version + **`latest`** for production or **`latest-dev`** for a non-prod branch).

## Deploy to ECS

Add a second job after **`build`**:

1. **`needs: build`** and pass **`${{ needs.build.outputs.version }}`** into the image URI (expose **`outputs.version`** on **`build`** from the version step).
2. **`environment:`** (e.g. **Production**) for approvals and environment-scoped secrets.
3. **`aws-actions/amazon-ecs-render-task-definition`** — committed **task definition JSON**; **`container-name`** matching that file; **`image`** = **`REGISTRY/IMAGE:version`**; optional **`environment-variables:`** multiline **`NAME=${{ secrets.NAME }}`** (never commit secret values).
4. **`aws-actions/amazon-ecs-deploy-task-definition`** — **`task-definition`** from the render step; **`service`**, **`cluster`**; **`wait-for-service-stability: true`** when the job should fail if the service does not stabilize.

## Action versions

**`actions/checkout`**, **`aws-actions/configure-aws-credentials`**, and **`docker/build-push-action`** majors change over time—re-resolve **`uses:`** with **`update-github-actions-versions`** when editing workflows.

## Secrets and IAM

- Prefer **OIDC** + **`role-to-assume`**; scope the role to **ECR push** and **ECS deploy** (and **`iam:PassRole`** when the task execution role is updated by your process).
- GitHub **repository** or **environment** secrets feed **`environment-variables`** in **`render-task-definition`** only when those vars belong in the task. Prefer **ECS task secrets** / **SSM** / **Secrets Manager** in the task definition for runtime secrets when policy requires it.

## YAML

See [reference.md](reference.md).