From e94541b284c62afd2ed2aaa496291c5dd1980a8f Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 6 Oct 2026 12:39:53 +0530
Subject: [PATCH 01/13] feat(*): update the deploy staging script

---
 .github/workflows/deploy-staging.yml | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index c5a60658d..189cfc5ed 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,9 +1,9 @@
-name: Deploy Kaapi staging to EC2
+name: Deploy Kaapi to Non-Prod EC2 (Staging)
 
 on:
   workflow_run:
     workflows: ["Kaapi CI"]
-    branches: [main]
+    branches: [feat/read-only-agent]
     types: [completed]
   workflow_dispatch:
 
@@ -14,7 +14,7 @@ concurrency:
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    environment: AWS_STAGING_ENV
+    environment: Staging
     # workflow_dispatch runs unconditionally; workflow_run only on a green CI.
     if: >-
       ${{ github.event_name == 'workflow_dispatch' ||
@@ -28,23 +28,23 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
         with:
-          role-to-assume: ${{ secrets.STAGING_EC2_DEPLOY_ROLE_ARN }}
+          role-to-assume: ${{ secrets.EC2_DEPLOY_ROLE_ARN }}
           aws-region: ap-south-1
 
       - name: Trigger deploy on EC2 via SSM
         id: ssm
         env:
-          INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
-          SECRET_ID: ${{ vars.STAGING_SECRET_ID }}
+          INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
+          SECRET_IDs: ${{ vars.SECRET_MANAGER_IDS }}
           DEPLOY_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
         run: |
-          SECRET_ID=$(echo "$SECRET_ID" | tr -d '[:space:]')
+          SECRET_IDs=$(echo "$SECRET_IDs" | tr -d '[:space:]')
           echo "Deploying commit: $DEPLOY_SHA"
 
           DEPLOY_CMD="cd /data/kaapi-backend \
             && git fetch --all \
             && git checkout $DEPLOY_SHA \
-            && SECRET_ID=$SECRET_ID sh scripts/fetch-secrets.sh \
+            && SECRET_IDs=$SECRET_IDs sh scripts/fetch-secrets.sh \
             && GIT_SHA=$DEPLOY_SHA docker compose -f docker-compose.staging.yml build \
             && docker compose -f docker-compose.staging.yml --profile migrate run --rm migrate \
             && docker compose -f docker-compose.staging.yml up -d --wait --remove-orphans \
@@ -63,7 +63,7 @@ jobs:
       - name: Wait for SSM command to finish
         timeout-minutes: 10
         env:
-          INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
+          INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
           CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
         run: |
           while true; do
@@ -108,7 +108,7 @@ jobs:
       - uses: ./.github/actions/discord-notify
         with:
           webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
-          name: kaapi-staging
+          name: kaapi-non-prod
           release: "#${{ github.run_number }}"
           sha: ${{ github.event.workflow_run.head_sha || github.sha }}
           run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

From b9836e89495750716daa13f6579b8caf8db4c8b4 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 6 Oct 2026 13:06:32 +0530
Subject: [PATCH 02/13] fix(*): trigger the flow on push event

---
 .github/workflows/deploy-staging.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 189cfc5ed..f9dd5194f 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,10 +1,12 @@
 name: Deploy Kaapi to Non-Prod EC2 (Staging)
 
 on:
-  workflow_run:
-    workflows: ["Kaapi CI"]
-    branches: [feat/read-only-agent]
-    types: [completed]
+  # workflow_run:
+  #   workflows: ["Kaapi CI"]
+  #   branches: [feat/read-only-agent]
+  #   types: [completed]
+  push:
+    branches: [feat/non-prod-script-updates]
   workflow_dispatch:
 
 concurrency:
@@ -15,9 +17,10 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     environment: Staging
-    # workflow_dispatch runs unconditionally; workflow_run only on a green CI.
+    # push/workflow_dispatch run unconditionally; workflow_run only on a green CI.
     if: >-
       ${{ github.event_name == 'workflow_dispatch' ||
+          github.event_name == 'push' ||
           github.event.workflow_run.conclusion == 'success' }}
 
     permissions:

From 7dc96ed251c3003838154b303009f526c11ec0b2 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 6 Oct 2026 15:41:11 +0530
Subject: [PATCH 03/13] fix(*): update the flow and path

---
 .github/workflows/deploy-staging.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index f9dd5194f..31fdd649f 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -39,12 +39,14 @@ jobs:
         env:
           INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
           SECRET_IDs: ${{ vars.SECRET_MANAGER_IDS }}
+          APP_DIR: ${{ secrets.APP_DIR }}
           DEPLOY_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
         run: |
           SECRET_IDs=$(echo "$SECRET_IDs" | tr -d '[:space:]')
-          echo "Deploying commit: $DEPLOY_SHA"
+          : "${APP_DIR:?APP_DIR repo/environment variable is not set}"
+          echo "Deploying commit: $DEPLOY_SHA to $APP_DIR"
 
-          DEPLOY_CMD="cd /data/kaapi-backend \
+          DEPLOY_CMD="cd $APP_DIR \
             && git fetch --all \
             && git checkout $DEPLOY_SHA \
             && SECRET_IDs=$SECRET_IDs sh scripts/fetch-secrets.sh \
@@ -57,7 +59,7 @@ jobs:
             --instance-ids "$INSTANCE_ID" \
             --document-name "AWS-RunShellScript" \
             --comment "Deploy kaapi-backend kaapi-staging" \
-            --parameters commands='["set -eux","chown -R ubuntu:ubuntu /data/kaapi-backend","sudo -iu ubuntu bash -lc \"'"$DEPLOY_CMD"'\""]' \
+            --parameters commands='["set -eux","sudo -iu ec2-user bash -lc \"'"$DEPLOY_CMD"'\""]' \
             --cloud-watch-output-config CloudWatchOutputEnabled=true \
             --query "Command.CommandId" --output text)
           echo "cmd_id=$CMD_ID" >> "$GITHUB_OUTPUT"

From 842f16dc2656c1172f865ce902d6cd966d89e0ca Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 6 Oct 2026 15:46:35 +0530
Subject: [PATCH 04/13] fix(*): update the variable name

---
 .github/workflows/deploy-staging.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 31fdd649f..764228d02 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -49,7 +49,7 @@ jobs:
           DEPLOY_CMD="cd $APP_DIR \
             && git fetch --all \
             && git checkout $DEPLOY_SHA \
-            && SECRET_IDs=$SECRET_IDs sh scripts/fetch-secrets.sh \
+            && SECRET_ID=$SECRET_IDs sh scripts/fetch-secrets.sh \
             && GIT_SHA=$DEPLOY_SHA docker compose -f docker-compose.staging.yml build \
             && docker compose -f docker-compose.staging.yml --profile migrate run --rm migrate \
             && docker compose -f docker-compose.staging.yml up -d --wait --remove-orphans \

From 3d9102e4303292795c0a9eb3c6c13701fcc3885c Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 6 Oct 2026 16:07:17 +0530
Subject: [PATCH 05/13] fix(*): revert the unwanted changes

---
 .github/workflows/deploy-staging.yml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 764228d02..227638be0 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,12 +1,10 @@
 name: Deploy Kaapi to Non-Prod EC2 (Staging)
 
 on:
-  # workflow_run:
-  #   workflows: ["Kaapi CI"]
-  #   branches: [feat/read-only-agent]
-  #   types: [completed]
-  push:
-    branches: [feat/non-prod-script-updates]
+  workflow_run:
+    workflows: ["Kaapi CI"]
+    branches: [main]
+    types: [completed]
   workflow_dispatch:
 
 concurrency:
@@ -17,7 +15,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     environment: Staging
-    # push/workflow_dispatch run unconditionally; workflow_run only on a green CI.
+    # workflow_dispatch runs unconditionally; workflow_run only on a green CI.
     if: >-
       ${{ github.event_name == 'workflow_dispatch' ||
           github.event_name == 'push' ||

From e691e9700f5de5e3f09cc7d728f609b8c1a50c48 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 6 Oct 2026 16:11:00 +0530
Subject: [PATCH 06/13] fix(*): update the script

---
 .github/workflows/deploy-staging-ecs.yml | 4 ++--
 .github/workflows/deploy-staging.yml     | 3 +--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy-staging-ecs.yml b/.github/workflows/deploy-staging-ecs.yml
index dc780e83a..028807d3e 100644
--- a/.github/workflows/deploy-staging-ecs.yml
+++ b/.github/workflows/deploy-staging-ecs.yml
@@ -6,7 +6,7 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-    environment: AWS_ENV_VARS
+    environment: Staging
 
     permissions:
       packages: write
@@ -22,7 +22,7 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
         with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          role-to-assume: ${{ secrets.DEPLOY_ROLE_ARN }}
           aws-region: ap-south-1
 
       - name: Login to Amazon ECR
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 227638be0..1c1fbc3dd 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -18,7 +18,6 @@ jobs:
     # workflow_dispatch runs unconditionally; workflow_run only on a green CI.
     if: >-
       ${{ github.event_name == 'workflow_dispatch' ||
-          github.event_name == 'push' ||
           github.event.workflow_run.conclusion == 'success' }}
 
     permissions:
@@ -29,7 +28,7 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
         with:
-          role-to-assume: ${{ secrets.EC2_DEPLOY_ROLE_ARN }}
+          role-to-assume: ${{ secrets.DEPLOY_ROLE_ARN }}
           aws-region: ap-south-1
 
       - name: Trigger deploy on EC2 via SSM

From 178b2e25e3fe5009b75b2abdf05a65c0772a400a Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:31:48 +0530
Subject: [PATCH 07/13] fix(*): update the script for testing

---
 .github/workflows/deploy-staging.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 1c1fbc3dd..1f9a12897 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,10 +1,13 @@
 name: Deploy Kaapi to Non-Prod EC2 (Staging)
 
 on:
-  workflow_run:
-    workflows: ["Kaapi CI"]
-    branches: [main]
-    types: [completed]
+  # workflow_run:
+  #   workflows: ["Kaapi CI"]
+  #   branches: [main]
+  #   types: [completed]
+  push:
+    branches:
+      - feat/non-prod-script-updates
   workflow_dispatch:
 
 concurrency:
@@ -17,7 +20,7 @@ jobs:
     environment: Staging
     # workflow_dispatch runs unconditionally; workflow_run only on a green CI.
     if: >-
-      ${{ github.event_name == 'workflow_dispatch' ||
+      ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' ||
           github.event.workflow_run.conclusion == 'success' }}
 
     permissions:

From 48e249bf08a38e5631e231a53ef531f40a0e40ff Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:44:34 +0530
Subject: [PATCH 08/13] fix(*): few updates

---
 .github/workflows/deploy-staging.yml | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 1f9a12897..75f6ee231 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,13 +1,10 @@
 name: Deploy Kaapi to Non-Prod EC2 (Staging)
 
 on:
-  # workflow_run:
-  #   workflows: ["Kaapi CI"]
-  #   branches: [main]
-  #   types: [completed]
-  push:
-    branches:
-      - feat/non-prod-script-updates
+  workflow_run:
+    workflows: ["Kaapi CI"]
+    branches: [main]
+    types: [completed]
   workflow_dispatch:
 
 concurrency:
@@ -20,7 +17,7 @@ jobs:
     environment: Staging
     # workflow_dispatch runs unconditionally; workflow_run only on a green CI.
     if: >-
-      ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' ||
+      ${{ github.event_name == 'workflow_dispatch' ||
           github.event.workflow_run.conclusion == 'success' }}
 
     permissions:
@@ -113,7 +110,7 @@ jobs:
       - uses: ./.github/actions/discord-notify
         with:
           webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
-          name: kaapi-non-prod
+          name: kaapi-backend-staging
           release: "#${{ github.run_number }}"
           sha: ${{ github.event.workflow_run.head_sha || github.sha }}
           run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

From 0134f27917e4dce4d5e4ec9d98cf087fe3642929 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:35:40 +0530
Subject: [PATCH 09/13] fix(*): initiate build

---
 .github/workflows/deploy-staging.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 75f6ee231..e4a2acd45 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,10 +1,13 @@
 name: Deploy Kaapi to Non-Prod EC2 (Staging)
 
 on:
-  workflow_run:
-    workflows: ["Kaapi CI"]
-    branches: [main]
-    types: [completed]
+  # workflow_run:
+  #   workflows: ["Kaapi CI"]
+  #   branches: [main]
+  #   types: [completed]
+  push:
+    branches:
+      - main
   workflow_dispatch:
 
 concurrency:
@@ -17,7 +20,7 @@ jobs:
     environment: Staging
     # workflow_dispatch runs unconditionally; workflow_run only on a green CI.
     if: >-
-      ${{ github.event_name == 'workflow_dispatch' ||
+      ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' ||
           github.event.workflow_run.conclusion == 'success' }}
 
     permissions:

From 11127d3c3a53f36e7122c0265797b814f8292d5c Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:36:17 +0530
Subject: [PATCH 10/13] fix(*): update branch name

---
 .github/workflows/deploy-staging.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index e4a2acd45..fea966521 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -7,7 +7,7 @@ on:
   #   types: [completed]
   push:
     branches:
-      - main
+      - feat/non-prod-script-updates
   workflow_dispatch:
 
 concurrency:

From 86e032e6e47a4b0f7c2a36519416bb4111ad98f7 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:38:27 +0530
Subject: [PATCH 11/13] fix(*): revert the changes

---
 .github/workflows/deploy-staging.yml | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index fea966521..75f6ee231 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,13 +1,10 @@
 name: Deploy Kaapi to Non-Prod EC2 (Staging)
 
 on:
-  # workflow_run:
-  #   workflows: ["Kaapi CI"]
-  #   branches: [main]
-  #   types: [completed]
-  push:
-    branches:
-      - feat/non-prod-script-updates
+  workflow_run:
+    workflows: ["Kaapi CI"]
+    branches: [main]
+    types: [completed]
   workflow_dispatch:
 
 concurrency:
@@ -20,7 +17,7 @@ jobs:
     environment: Staging
     # workflow_dispatch runs unconditionally; workflow_run only on a green CI.
     if: >-
-      ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' ||
+      ${{ github.event_name == 'workflow_dispatch' ||
           github.event.workflow_run.conclusion == 'success' }}
 
     permissions:

From c8c5283590b9d863b1305fcdced7bdcaffd35f26 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:40:12 +0530
Subject: [PATCH 12/13] fix(*): update workflow

---
 .github/workflows/deploy-staging.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 75f6ee231..d6059e814 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,4 +1,4 @@
-name: Deploy Kaapi to Non-Prod EC2 (Staging)
+name: Deploy Kaapi to Staging EC2
 
 on:
   workflow_run:

From dd22839b5c3fc701e2aeff636426d1ffb6f100f7 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Mon, 12 Oct 2026 13:23:56 +0530
Subject: [PATCH 13/13] fix(*): remove the unwanted echo

---
 .github/workflows/deploy-staging.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index d6059e814..6a6f12bfc 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -41,7 +41,6 @@ jobs:
         run: |
           SECRET_IDs=$(echo "$SECRET_IDs" | tr -d '[:space:]')
           : "${APP_DIR:?APP_DIR repo/environment variable is not set}"
-          echo "Deploying commit: $DEPLOY_SHA to $APP_DIR"
 
           DEPLOY_CMD="cd $APP_DIR \
             && git fetch --all \