CI/CD Automation

Automate builds with GitHub Actions

Choose Your Method

Method	When to Use	Setup Effort
Manual builds	Small teams, infrequent deploys	Low
DockerHub + GitHub	Using DockerHub, simpler setup	Medium
ECR + GitHub OIDC	Using ECR, no stored credentials	Higher

For manual builds, see Deploy - AWS Setup. ECR tokens expire after 12 hours.

PR Validation

Every PR runs automatic validation. The workflow is in .github/workflows/validate.yml:

# Runs on every PR
on:
  pull_request:

This checks formatting, tests, and types before merging.

DockerHub with GitHub

Build and push images on GitHub release. Workflow: .github/workflows/docker-images.yml

1. Create Docker Access Token

   Go to Docker Hub Settings → Security and create an access token.

   
2. Add GitHub Secrets

   In your GitHub repo, go to Settings → Secrets and variables → Actions.

   Add these secrets:

   Name	Value
   DOCKERHUB_USERNAME	Your Docker Hub username
   DOCKERHUB_TOKEN	The access token from Step 1

   Add this variable:

   Name	Value
   DOCKERHUB_NAMESPACE	Your Docker Hub namespace (usually your username)

   
3. Trigger a Release

   gh release create v0.1.0 --title "v0.1.0" -n ""
   

   The workflow builds and pushes your-namespace/agentos-template:dev and :prd tags.

   

ECR with GitHub OIDC

Build and push to ECR using OpenID Connect. No IAM access keys stored in GitHub.

Workflow: .github/workflows/ecr-images.yml

Set Up OIDC Provider

1. Add OIDC Identity Provider

   1. Open IAM Console → Identity providers → Add provider
   2. Provider type: OpenID Connect
   3. Provider URL: https://token.actions.githubusercontent.com
   4. Click Get thumbprint
   5. Audience: sts.amazonaws.com

   
2. Create IAM Role

   1. After adding the provider, click Assign role → Create a new role

   

   2. Select Create a new role

   

   3. Confirm Web identity is selected as trusted entity, Identity provider shows GitHub, and Audience is sts.amazonaws.com

   

   4. Add permission: AmazonEC2ContainerRegistryPowerUser
   5. Role name: GithubActionsRole
   6. Copy the Role ARN (format: arn:aws:iam::[ACCOUNT_ID]:role/GithubActionsRole)

   
3. Update Workflow File

   Edit .github/workflows/ecr-images.yml:

   env:
     ECR_REPO: [ACCOUNT_ID].dkr.ecr.us-east-1.amazonaws.com
     AWS_ROLE: arn:aws:iam::[ACCOUNT_ID]:role/GithubActionsRole
     AWS_REGION: us-east-1
   
4. Change Trigger to Release

   The workflow defaults to workflow_dispatch (manual trigger). To trigger on release:

   on:
     release:
       types: [published]
   

   If using ECR, disable the DockerHub workflow by changing its trigger:

   # In docker-images.yml
   on: workflow_dispatch
   
5. Trigger Build

   gh release create v0.1.0 --title "v0.1.0" -n ""
   

   Or trigger manually:

   gh workflow run ecr-images.yml
   

   

Why OIDC? GitHub Actions requests a temporary token from AWS instead of using stored credentials. More secure, no credential rotation needed.

After CI/CD Builds

After a new image is pushed, update your ECS deployment:

Full Options

ag infra patch --env prd --infra aws --name service

ag infra patch prd:aws::service

This triggers a new deployment with the latest image.