deploy.yml

name: Full Infra Deployment with OIDC

on:
  push:
    branches:
      - main

permissions:
  id-token: write   # REQUIRED for OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::011664843975:role/github-permissions
          aws-region: ap-south-1

      - name: Verify identity 
        run: aws sts get-caller-identity
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.7.3  # or latest stable

      - name: Terraform Init
        working-directory: terraform
        run: terraform init

      - name: Terraform Apply
        working-directory: terraform
        run: terraform apply -auto-approve
        env:
          TF_VAR_db_password: ${{ secrets.DB_PASSWORD }}
          TF_VAR_db_password: ${{ secrets.DB_PASSWORD }}
          TF_VAR_key_name: ${{ secrets.EC2_KEY_NAME }}