【2026年版】GitHub ActionsでAWS ECSに自動デプロイ｜OIDC認証のCI/CD構築手順

name: Deploy to ECS
on:
  push:
    branches: [ main ]

permissions:
  id-token: write   # OIDCに必須
  contents: read

env:
  AWS_REGION: ap-northeast-1
  ECR_REPOSITORY: my-app-repo
  ECS_SERVICE: my-app-service
  ECS_CLUSTER: my-app-cluster
  ECS_TASK_DEFINITION: task-definition.json
  CONTAINER_NAME: my-app-container

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # OIDCでIAMロールを引き受け（アクセスキー不要）
      - uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-ecs
          aws-region: ${{ env.AWS_REGION }}

      - id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      # ビルドしてgit SHAタグでECRへpush
      - id: build
        env:
          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        run: |
          IMAGE=$REGISTRY/$ECR_REPOSITORY:${{ github.sha }}
          docker build -t $IMAGE .
          docker push $IMAGE
          echo "image=$IMAGE" >> $GITHUB_OUTPUT

      # タスク定義のイメージを差し替え
      - id: render
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: ${{ env.ECS_TASK_DEFINITION }}
          container-name: ${{ env.CONTAINER_NAME }}
          image: ${{ steps.build.outputs.image }}

      # ECSへデプロイ（安定するまで待機）
      - uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          task-definition: ${{ steps.render.outputs.task-definition }}
          service: ${{ env.ECS_SERVICE }}
          cluster: ${{ env.ECS_CLUSTER }}
          wait-for-service-stability: true