deploy-agentcore.yml

name: Deploy Strand Agent to Bedrock AgentCore Runtime

on:
  workflow_dispatch:

env:
  AWS_REGION: us-east-1

permissions:
  id-token: write
  contents: read

jobs:
  validate:
    name: Validate Agent Code
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955

    - name: Set up Python
      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
      with:
        python-version: '3.12'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r agents/requirements.txt
        pip install pytest black isort flake8

    - name: Format and lint check
      run: |
        black --check agents/
        isort --check-only agents/
        flake8 agents/ --max-line-length=88 --extend-ignore=E203,W503

  build-and-deploy:
    name: Build and Deploy Agent
    runs-on: ubuntu-latest
    needs: validate
    outputs:
      ecr-repository: ${{ steps.set-vars.outputs.ecr-repository }}
    
    steps:
    - name: Checkout code
      uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955

    - name: Set up Python
      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
      with:
        python-version: '3.12'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r agents/requirements.txt
        pip install boto3

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@d0834ad3a60a024346910e522a81b0002bd37fea
      with:
        role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
        role-session-name: GitHubActions-AgentCore-Deploy
        aws-region: ${{ env.AWS_REGION }}

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@18ce135bb5112fa8ce4ed6c17ab05699d7f3a5e0
      with:
        platforms: linux/arm64

    - name: Set environment variables
      id: set-vars
      run: |
        AGENT_NAME="strands_agent"
        ECR_REPOSITORY="${AGENT_NAME}"
        echo "AGENT_NAME=${AGENT_NAME}" >> $GITHUB_ENV
        echo "ECR_REPOSITORY=${ECR_REPOSITORY}" >> $GITHUB_ENV
        echo "ecr-repository=${ECR_REPOSITORY}" >> $GITHUB_OUTPUT

    - name: Create IAM role
      run: |
        python scripts/create_iam_role.py \
          --agent-name "${{ env.AGENT_NAME }}" \
          --region "${{ env.AWS_REGION }}"

    - name: Create Bedrock guardrail
      run: |
        python scripts/create_guardrail.py \
          --region "${{ env.AWS_REGION }}"

    - name: Setup ECR repository and scanning
      run: |
        # Check if repository exists, create if not
        if aws ecr describe-repositories --repository-names ${{ env.ECR_REPOSITORY }} --region ${{ env.AWS_REGION }} >/dev/null 2>&1; then
          echo "Repository already exists"
        else
          echo "Creating repository..."
          aws ecr create-repository --repository-name ${{ env.ECR_REPOSITORY }} --region ${{ env.AWS_REGION }} \
            --image-scanning-configuration scanOnPush=true
          echo "Repository created successfully"
          
          # Enable enhanced scanning (one-time registry setup)
          aws ecr put-registry-scanning-configuration \
            --scan-type ENHANCED \
            --rules 'scanFrequency=SCAN_ON_PUSH,repositoryFilters=[{filter="*",filterType="WILDCARD"}]' \
            --region ${{ env.AWS_REGION }} 2>/dev/null && echo "Enhanced scanning enabled" || echo "Enhanced scanning setup failed"
        fi
        
    - name: Login to ECR
      uses: aws-actions/amazon-ecr-login@33f92af657bba1882ab79d8621debd2f6769a0c9

    - name: Build and push Docker image
      run: |
        ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
        IMAGE_TAG="${GITHUB_SHA:0:8}"
        ECR_URI="${ACCOUNT_ID}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ env.ECR_REPOSITORY }}:${IMAGE_TAG}"
        ECR_LATEST="${ACCOUNT_ID}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ env.ECR_REPOSITORY }}:latest"
        
        docker buildx build --platform linux/arm64 -t $ECR_URI -t $ECR_LATEST --push .
        echo "CONTAINER_URI=$ECR_URI" >> $GITHUB_ENV

    - name: Deploy to AgentCore Runtime
      run: |
        python scripts/deploy_agent.py \
          --agent-name "${{ env.AGENT_NAME }}" \
          --region "${{ env.AWS_REGION }}" \
          --container-uri "${{ env.CONTAINER_URI }}"

  cleanup:
    name: Cleanup Old Images
    runs-on: ubuntu-latest
    needs: build-and-deploy
    if: success()
    
    steps:
    - name: Checkout code
      uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@d0834ad3a60a024346910e522a81b0002bd37fea
      with:
        role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
        role-session-name: GitHubActions-AgentCore-Cleanup
        aws-region: ${{ env.AWS_REGION }}

    - name: Cleanup old ECR images
      run: |
        python scripts/cleanup_ecr.py \
          --region "${{ env.AWS_REGION }}" \
          --repository-name "${{ needs.build-and-deploy.outputs.ecr-repository }}"