ci: enables deployment to AWS ECS [#59]

[robert-7]

Summary

Adds the Phase 5 CD pipeline to .github/workflows/main.yml so merges to main can deploy the app to AWS ECS after the existing CI jobs succeed.

This PR extends the current GitHub Actions workflow with a deploy job that:

• runs only on push to main
• waits for lint, test, docker-build, and e2e-docker
• authenticates to AWS with GitHub OIDC via AWS_ROLE_ARN
• builds and pushes a Docker image to ECR tagged with github.sha
• reads the current ECS task definition, updates the container image, registers a new task definition revision, and deploys it to course-enrollment-app-svc
• waits for ECS service stability before marking the workflow green

Why this approach

The deployment uses immutable SHA image tags instead of reusing latest.
That gives us commit-to-runtime traceability and fits the current AWS setup, where the ECR repository was created with tag immutability enabled in Phase 1.

GitHub Actions configuration

This PR expects the following repo configuration:

Secret

• AWS_ROLE_ARN

Variables

• AWS_REGION
• ECR_REGISTRY
• ECR_REPOSITORY
• ECS_CLUSTER
• ECS_SERVICE

These values have already been added in GitHub repo settings.

AWS prerequisite

The GitHub Actions deploy role must be able to:

• describe ECS services
• describe task definitions
• register task definitions
• update the ECS service
• pass ECSTaskExecutionRole-CourseEnrollmentApp

The IAM policy for GitHubActions-CourseEnrollmentApp was updated to support this deploy flow.

Validation

Ran locally:

• pre-commit run --files .github/workflows/main.yml ✅

Confirmed in GitHub repo settings:

• gh variable list --repo robert-7/course-enrollment-app ✅
• gh secret list --repo robert-7/course-enrollment-app ✅

Post-merge validation

After merging this PR to main, validate that:

• the deploy job runs after the CI jobs pass
• the image is pushed to ECR with the merge commit SHA tag
• ECS creates a new task definition revision and updates course-enrollment-app-svc
• the workflow waits successfully for service stability
• CloudWatch logs show the new container starting cleanly
• the ALB /index path still returns HTTP 200

Closes #59

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!