# Copyright 2026 Google LLC
# SPDX-License-Identifier: Apache-2.0
#
# Deploy to AWS App Runner.
#
# STATUS: DISABLED (manual trigger only).
#
# Prerequisites:
# 1. Create an ECR repository for the container image.
# 2. Create an App Runner service (or let this workflow create one).
# 3. Configure OIDC identity provider for GitHub Actions:
# https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html
# 4. Set these repository secrets:
# - AWS_ROLE_ARN — IAM role ARN with ECR push + App Runner deploy permissions
# - AWS_REGION — e.g. us-east-1
# - AWS_ECR_REPOSITORY — ECR repository name (e.g. genkit-endpoints)
# - GEMINI_API_KEY — Gemini API key for the deployed service
name: Deploy to AWS App Runner
on:
workflow_dispatch:
inputs:
service_name:
description: 'App Runner service name'
required: true
default: 'genkit-endpoints'
defaults:
run:
working-directory: py/samples/web-endpoints-hello
permissions:
contents: read
id-token: write
jobs:
deploy:
name: Build & Deploy
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
aws-region: ${{ secrets.AWS_REGION }}
- name: Login to Amazon ECR
id: ecr
uses: aws-actions/amazon-ecr-login@v2
- name: Build and push container image
env:
REGISTRY: ${{ steps.ecr.outputs.registry }}
REPOSITORY: ${{ secrets.AWS_ECR_REPOSITORY }}
IMAGE_TAG: ${{ github.sha }}
run: |
docker build -f Containerfile -t "$REGISTRY/$REPOSITORY:$IMAGE_TAG" .
docker push "$REGISTRY/$REPOSITORY:$IMAGE_TAG"
echo "image=$REGISTRY/$REPOSITORY:$IMAGE_TAG" >> "$GITHUB_OUTPUT"
- name: Deploy to App Runner
env:
SERVICE_NAME: ${{ inputs.service_name }}
IMAGE_TAG: ${{ github.sha }}
REGISTRY: ${{ steps.ecr.outputs.registry }}
REPOSITORY: ${{ secrets.AWS_ECR_REPOSITORY }}
run: |
aws apprunner update-service \
--service-arn "$(aws apprunner list-services \
--query "ServiceSummaryList[?ServiceName=='$SERVICE_NAME'].ServiceArn" \
--output text)" \
--source-configuration "{
\"ImageRepository\": {
\"ImageIdentifier\": \"$REGISTRY/$REPOSITORY:$IMAGE_TAG\",
\"ImageRepositoryType\": \"ECR\",
\"ImageConfiguration\": {
\"Port\": \"8080\",
\"RuntimeEnvironmentVariables\": {
\"GEMINI_API_KEY\": \"${{ secrets.GEMINI_API_KEY }}\"
}
}
}
}"
