Anatomy of a workflow

name: Build and Deploy

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:  # manual trigger

env:
  AWS_REGION: eu-west-2

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # for OIDC
      contents: read
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsRole
          aws-region: ${{ env.AWS_REGION }}
      
      - name: Build Docker image
        run: |
          docker build -t myapp:${{ github.sha }} .
      
      - name: Push to ECR
        run: |
          aws ecr get-login-password | docker login --username AWS --password-stdin $ECR_REGISTRY
          docker tag myapp:${{ github.sha }} $ECR_REGISTRY/myapp:${{ github.sha }}
          docker push $ECR_REGISTRY/myapp:${{ github.sha }}

  deploy:
    needs: build  # wait for build to complete
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    environment: production  # uses environment protection rules
    
    steps:
      - name: Deploy
        run: echo "Deploying..."