From 3cf441f1406fe9a74aa142343819c1d2c0ac29d2 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 21 Jul 2026 15:23:07 +0530
Subject: [PATCH 01/10] fix(release): update the release script

---
 .github/workflows/cd-production.yml | 2 +-
 .github/workflows/cd-staging.yml    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cd-production.yml b/.github/workflows/cd-production.yml
index 01970ce..ddb3870 100644
--- a/.github/workflows/cd-production.yml
+++ b/.github/workflows/cd-production.yml
@@ -31,7 +31,7 @@ jobs:
           INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
           BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
         run: |
-          DEPLOY_CMD="cd ${BUILD_DIRECTORY} && git fetch --tags origin && git checkout --force ${{ github.sha }} && docker compose build && docker compose run --rm --entrypoint '' backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f"
+          DEPLOY_CMD="cd ${BUILD_DIRECTORY} && git fetch --tags origin && git checkout --force ${{ github.sha }} && docker compose build && docker compose run --rm --entrypoint '' backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f && docker builder prune -af"
 
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \
diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
index 32811a6..875989f 100644
--- a/.github/workflows/cd-staging.yml
+++ b/.github/workflows/cd-staging.yml
@@ -30,7 +30,7 @@ jobs:
           INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
           BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
         run: |
-          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard origin/main && docker compose build && docker compose run --rm --entrypoint \\\"\\\" backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f\"'
+          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard origin/main && docker compose build && docker compose run --rm --entrypoint \\\"\\\" backend uv run --frozen alembic upgrade head && docker compose up -d --remove-orphans && docker image prune -f && docker builder prune -af\"'
 
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \

From 89f43900b7ff004075632942d5df9f89bfbae453 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Wed, 7 Oct 2026 15:18:36 +0530
Subject: [PATCH 02/10] feat(*): update the infra deployment script

---
 .github/actions/discord-notify/action.yml |  60 ++++++++++
 .github/workflows/cd-production.yml       |  98 +++++++++++-----
 .github/workflows/cd-staging.yml          | 103 -----------------
 .github/workflows/deploy-staging.yml      | 132 ++++++++++++++++++++++
 4 files changed, 260 insertions(+), 133 deletions(-)
 create mode 100644 .github/actions/discord-notify/action.yml
 delete mode 100644 .github/workflows/cd-staging.yml
 create mode 100644 .github/workflows/deploy-staging.yml

diff --git a/.github/actions/discord-notify/action.yml b/.github/actions/discord-notify/action.yml
new file mode 100644
index 0000000..e9a214f
--- /dev/null
+++ b/.github/actions/discord-notify/action.yml
@@ -0,0 +1,60 @@
+name: Discord deploy notification
+description: Post a green (healthy) or red (failed) deploy-status embed to Discord.
+
+inputs:
+  webhook-url:
+    description: Discord webhook URL. When empty, the step is a no-op.
+    required: true
+  name:
+    description: Deploy target name shown in the title (e.g. kaapi-staging).
+    required: true
+  release:
+    description: Release identifier (tag or run number).
+    required: true
+  sha:
+    description: Full commit SHA; truncated to 7 chars for display.
+    required: true
+  run-url:
+    description: Link to the workflow run.
+    required: true
+  ok:
+    description: "'true' for a healthy deploy; anything else renders as failed."
+    required: true
+  failure-reason:
+    description: Optional extra line explaining a failure (e.g. CI blocked the release).
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        DISCORD_WEBHOOK_URL: ${{ inputs.webhook-url }}
+        NAME: ${{ inputs.name }}
+        RELEASE: ${{ inputs.release }}
+        SHA: ${{ inputs.sha }}
+        RUN_URL: ${{ inputs.run-url }}
+        OK: ${{ inputs.ok }}
+        REASON: ${{ inputs.failure-reason }}
+      run: |
+        [ -z "$DISCORD_WEBHOOK_URL" ] && { echo "No webhook configured, skipping"; exit 0; }
+        if [ "$OK" = "true" ]; then
+          TITLE="🟢 $NAME deployment healthy"; COLOR=3066993   # green
+        else
+          TITLE="🔴 $NAME deployment failed";  COLOR=15158332  # red
+        fi
+        SHA_SHORT=$(echo "$SHA" | cut -c1-7)
+
+        fields=$(jq -n --arg release "$RELEASE" --arg sha "$SHA_SHORT" \
+          '[{name:"Release",value:$release,inline:true},{name:"SHA",value:$sha,inline:true}]')
+        # Only a failed deploy with a stated cause gets the extra Reason line.
+        if [ "$OK" != "true" ] && [ -n "$REASON" ]; then
+          fields=$(echo "$fields" | jq --arg r "$REASON" '. + [{name:"Reason",value:$r,inline:false}]')
+        fi
+
+        payload=$(jq -n --arg title "$TITLE" --argjson color "$COLOR" \
+          --arg url "$RUN_URL" --argjson fields "$fields" \
+          '{embeds:[{title:$title,url:$url,color:$color,fields:$fields,timestamp:(now|todate)}]}')
+        curl -sf -H "Content-Type: application/json" -X POST -d "$payload" "$DISCORD_WEBHOOK_URL" \
+          || echo "Discord notification failed to send"
diff --git a/.github/workflows/cd-production.yml b/.github/workflows/cd-production.yml
index 417d940..221b52c 100644
--- a/.github/workflows/cd-production.yml
+++ b/.github/workflows/cd-production.yml
@@ -10,7 +10,32 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  verify-ci:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Confirm CI passed on the tagged commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          SHA="${{ github.sha }}"
+          echo "Checking Kaapi Guardrails CI conclusion for ${SHA}"
+          CONCLUSION=$(gh api \
+            "repos/${{ github.repository }}/actions/runs?head_sha=${SHA}" \
+            --jq 'first(.workflow_runs[]
+                    | select(.name == "Kaapi Guardrails CI" and .status == "completed")
+                    | .conclusion) // "missing"')
+          echo "Kaapi Guardrails CI conclusion: ${CONCLUSION}"
+          if [ "${CONCLUSION}" != "success" ]; then
+            echo "::error::Kaapi Guardrails CI has not passed for ${SHA} (conclusion: ${CONCLUSION}). Aborting release."
+            exit 1
+          fi
+
   deploy:
+    needs: verify-ci
     runs-on: ubuntu-latest
     environment: AWS_ENV_SECRETS
 
@@ -21,8 +46,6 @@ jobs:
     steps:
       - name: Checkout the repo
         uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event.release.tag_name }}
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
@@ -66,42 +89,57 @@ jobs:
           echo "Sent SSM command: $CMD_ID"
 
       - name: Wait for SSM command to finish
+        timeout-minutes: 15
         env:
           INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
           CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
         run: |
-          get_output() {
-            aws ssm get-command-invocation \
+          while true; do
+            if aws ssm wait command-executed \
               --command-id "$CMD_ID" \
-              --instance-id "$INSTANCE_ID" \
-              --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
-              --output json
-          }
+              --instance-id "$INSTANCE_ID"; then
+              break   # waiter succeeds only on Status == Success
+            fi
 
-          for i in {1..20}; do
             STATUS=$(aws ssm get-command-invocation \
               --command-id "$CMD_ID" \
               --instance-id "$INSTANCE_ID" \
-              --query "Status" \
-              --output text)
-
-            echo "Current Status: $STATUS"
-
-            if [ "$STATUS" = "Success" ]; then
-              echo "Deployment completed successfully."
-              get_output
-              exit 0
-            fi
-
-            if [ "$STATUS" = "Failed" ] || [ "$STATUS" = "Cancelled" ] || [ "$STATUS" = "TimedOut" ]; then
-              echo "Deployment failed."
-              get_output
-              exit 1
-            fi
-
-            sleep 25
+              --query "Status" --output text 2>/dev/null || echo "Pending")
+
+            case "$STATUS" in
+              Success) break ;;
+              Failed|Cancelled|Cancelling|TimedOut)
+                echo "Deployment ended with status: $STATUS"
+                aws ssm get-command-invocation \
+                  --command-id "$CMD_ID" \
+                  --instance-id "$INSTANCE_ID" \
+                  --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
+                  --output json
+                exit 1 ;;
+              *) echo "Still running (status: $STATUS) — waiter capped out, re-waiting" ;;
+            esac
           done
 
-          echo "Deployment timed out after waiting too long."
-          get_output
-          exit 1
+          echo "Deployment completed successfully."
+          aws ssm get-command-invocation \
+            --command-id "$CMD_ID" \
+            --instance-id "$INSTANCE_ID" \
+            --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
+            --output json
+
+  notify:
+    needs: [verify-ci, deploy]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/discord-notify
+        with:
+          webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          name: kaapi-guardrails-production
+          release: ${{ github.ref_name }}
+          sha: ${{ github.sha }}
+          run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          ok: ${{ needs.deploy.result == 'success' }}
+          # Call out the specific case where the release was blocked by CI.
+          failure-reason: ${{ needs.verify-ci.result != 'success' && 'CI never passed on the tagged commit — release blocked.' || '' }}
diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
deleted file mode 100644
index 19690d4..0000000
--- a/.github/workflows/cd-staging.yml
+++ /dev/null
@@ -1,103 +0,0 @@
-name: Deploy Kaapi Guardrails Staging To EC2
-
-on:
-  push:
-    branches: [main]
-
-concurrency:
-  group: guardrail-staging-ec2-deploy
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    environment: AWS_ENV_SECRETS
-
-    permissions:
-      id-token: write
-      contents: read
-
-    steps:
-      - name: Checkout the repo
-        uses: actions/checkout@v7
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
-        with:
-          role-to-assume: ${{ secrets.EC2_DEPLOY_ROLE_ARN }}
-          aws-region: ${{ secrets.AWS_REGION }}
-
-      - name: Login to Amazon ECR
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v2
-
-      - name: Build and Push Docker Image
-        env:
-          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
-          REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-staging-repo
-        run: |
-          docker build -t $REGISTRY/$REPOSITORY:latest ./backend
-          docker push $REGISTRY/$REPOSITORY:latest
-
-      - name: Trigger deploy on EC2 via SSM
-        id: ssm
-        env:
-          INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
-          BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
-          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
-          ECR_REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-staging-repo
-          IMAGE_TAG: latest
-        run: |
-          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard origin/main && aws ecr get-login-password --region '"${{ secrets.AWS_REGION }}"' | docker login --username AWS --password-stdin '"${ECR_REGISTRY}"' && export ECR_REGISTRY='"${ECR_REGISTRY}"' ECR_REPOSITORY='"${ECR_REPOSITORY}"' IMAGE_TAG='"${IMAGE_TAG}"' && docker compose pull backend && docker compose --profile prestart run --rm prestart && docker compose up -d --remove-orphans && docker image prune -f\"'
-
-          CMD_ID=$(aws ssm send-command \
-            --instance-ids "$INSTANCE_ID" \
-            --document-name "AWS-RunShellScript" \
-            --comment "Deploy kaapi-guardrails staging" \
-            --parameters commands="[\"set -eux\",\"sudo chown -R ec2-user:ec2-user ${BUILD_DIRECTORY}\",\"${DEPLOY_CMD}\"]" \
-            --query "Command.CommandId" \
-            --output text)
-
-          echo "cmd_id=$CMD_ID" >> "$GITHUB_OUTPUT"
-          echo "Sent SSM command: $CMD_ID"
-
-      - name: Wait for SSM command to finish
-        env:
-          INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
-          CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
-        run: |
-          get_output() {
-            aws ssm get-command-invocation \
-              --command-id "$CMD_ID" \
-              --instance-id "$INSTANCE_ID" \
-              --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
-              --output json
-          }
-
-          for i in {1..20}; do
-            STATUS=$(aws ssm get-command-invocation \
-              --command-id "$CMD_ID" \
-              --instance-id "$INSTANCE_ID" \
-              --query "Status" \
-              --output text)
-
-            echo "Current Status: $STATUS"
-
-            if [ "$STATUS" = "Success" ]; then
-              echo "Deployment completed successfully."
-              get_output
-              exit 0
-            fi
-
-            if [ "$STATUS" = "Failed" ] || [ "$STATUS" = "Cancelled" ] || [ "$STATUS" = "TimedOut" ]; then
-              echo "Deployment failed."
-              get_output
-              exit 1
-            fi
-
-            sleep 25
-          done
-
-          echo "Deployment timed out after waiting too long."
-          get_output
-          exit 1
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
new file mode 100644
index 0000000..0361992
--- /dev/null
+++ b/.github/workflows/deploy-staging.yml
@@ -0,0 +1,132 @@
+name: Deploy Kaapi Guardrails Staging To EC2
+
+on:
+  workflow_run:
+    workflows: ["Kaapi Guardrails CI"]
+    branches: [main]
+    types: [completed]
+  workflow_dispatch:
+
+concurrency:
+  group: guardrail-staging-ec2-deploy
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: AWS_ENV_SECRETS
+    # workflow_dispatch runs unconditionally; workflow_run only on a green CI push to main.
+    if: >-
+      ${{ github.event_name == 'workflow_dispatch' ||
+          (github.event.workflow_run.conclusion == 'success' &&
+           github.event.workflow_run.event == 'push') }}
+
+    permissions:
+      id-token: write
+      contents: read
+
+    env:
+      DEPLOY_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+
+    steps:
+      - name: Checkout the repo
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ env.DEPLOY_SHA }}
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.EC2_DEPLOY_ROLE_ARN }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build and Push Docker Image
+        env:
+          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-staging-repo
+        run: |
+          echo "Building commit: $DEPLOY_SHA"
+          docker build -t $REGISTRY/$REPOSITORY:latest ./backend
+          docker push $REGISTRY/$REPOSITORY:latest
+
+      - name: Trigger deploy on EC2 via SSM
+        id: ssm
+        env:
+          INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
+          BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-staging-repo
+          IMAGE_TAG: latest
+        run: |
+          echo "Deploying commit: $DEPLOY_SHA"
+
+          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard '"${DEPLOY_SHA}"' && aws ecr get-login-password --region '"${{ secrets.AWS_REGION }}"' | docker login --username AWS --password-stdin '"${ECR_REGISTRY}"' && export ECR_REGISTRY='"${ECR_REGISTRY}"' ECR_REPOSITORY='"${ECR_REPOSITORY}"' IMAGE_TAG='"${IMAGE_TAG}"' && docker compose pull backend && docker compose --profile prestart run --rm prestart && docker compose up -d --remove-orphans && docker image prune -f\"'
+
+          CMD_ID=$(aws ssm send-command \
+            --instance-ids "$INSTANCE_ID" \
+            --document-name "AWS-RunShellScript" \
+            --comment "Deploy kaapi-guardrails staging" \
+            --parameters commands="[\"set -eux\",\"sudo chown -R ec2-user:ec2-user ${BUILD_DIRECTORY}\",\"${DEPLOY_CMD}\"]" \
+            --query "Command.CommandId" \
+            --output text)
+
+          echo "cmd_id=$CMD_ID" >> "$GITHUB_OUTPUT"
+          echo "Sent SSM command: $CMD_ID"
+
+      - name: Wait for SSM command to finish
+        timeout-minutes: 10
+        env:
+          INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
+          CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
+        run: |
+          while true; do
+            if aws ssm wait command-executed \
+              --command-id "$CMD_ID" \
+              --instance-id "$INSTANCE_ID"; then
+              break   # waiter succeeds only on Status == Success
+            fi
+
+            STATUS=$(aws ssm get-command-invocation \
+              --command-id "$CMD_ID" \
+              --instance-id "$INSTANCE_ID" \
+              --query "Status" --output text 2>/dev/null || echo "Pending")
+
+            case "$STATUS" in
+              Success) break ;;
+              Failed|Cancelled|Cancelling|TimedOut)
+                echo "Deployment ended with status: $STATUS"
+                aws ssm get-command-invocation \
+                  --command-id "$CMD_ID" \
+                  --instance-id "$INSTANCE_ID" \
+                  --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
+                  --output json
+                exit 1 ;;
+              *) echo "Still running (status: $STATUS) — waiter capped out, re-waiting" ;;
+            esac
+          done
+
+          echo "Deployment completed successfully."
+          aws ssm get-command-invocation \
+            --command-id "$CMD_ID" \
+            --instance-id "$INSTANCE_ID" \
+            --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
+            --output json
+
+  notify:
+    needs: [deploy]
+    if: ${{ always() && needs.deploy.result != 'skipped' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/discord-notify
+        with:
+          webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          name: kaapi-guardrails-staging
+          release: "#${{ github.run_number }}"
+          sha: ${{ github.event.workflow_run.head_sha || github.sha }}
+          run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          ok: ${{ needs.deploy.result == 'success' }}

From 71859c21d5b484cb63b5365504b4db9183bf83e0 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Wed, 7 Oct 2026 15:25:15 +0530
Subject: [PATCH 03/10] fix(*): update the secrets

---
 .github/workflows/deploy-staging.yml | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 0361992..d6693fc 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,10 +1,12 @@
 name: Deploy Kaapi Guardrails Staging To EC2
 
 on:
-  workflow_run:
-    workflows: ["Kaapi Guardrails CI"]
-    branches: [main]
-    types: [completed]
+  # workflow_run:
+  #   workflows: ["Kaapi Guardrails CI"]
+  #   branches: [main]
+  #   types: [completed]
+  push:
+    branches: [feat/deployment-script-updates]
   workflow_dispatch:
 
 concurrency:
@@ -37,7 +39,7 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
         with:
-          role-to-assume: ${{ secrets.EC2_DEPLOY_ROLE_ARN }}
+          role-to-assume: ${{ secrets.DEPLOY_ROLE_ARN }}
           aws-region: ${{ secrets.AWS_REGION }}
 
       - name: Login to Amazon ECR
@@ -56,7 +58,7 @@ jobs:
       - name: Trigger deploy on EC2 via SSM
         id: ssm
         env:
-          INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
+          INSTANCE_ID: ${{ secrets.INSTANCE_ID }}
           BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
           ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
           ECR_REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-staging-repo
@@ -80,7 +82,7 @@ jobs:
       - name: Wait for SSM command to finish
         timeout-minutes: 10
         env:
-          INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
+          INSTANCE_ID: ${{ secrets.INSTANCE_ID }}
           CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
         run: |
           while true; do

From af20059997549ce62e557f28a36da3312adb0ce5 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Wed, 7 Oct 2026 15:27:23 +0530
Subject: [PATCH 04/10] fix(*): trigger the flow in push event for testing

---
 .github/workflows/deploy-staging.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index d6693fc..5abb559 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -17,9 +17,10 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     environment: AWS_ENV_SECRETS
-    # workflow_dispatch runs unconditionally; workflow_run only on a green CI push to main.
+    # push/workflow_dispatch run unconditionally; workflow_run only on a green CI push to main.
     if: >-
-      ${{ github.event_name == 'workflow_dispatch' ||
+      ${{ github.event_name == 'push' ||
+          github.event_name == 'workflow_dispatch' ||
           (github.event.workflow_run.conclusion == 'success' &&
            github.event.workflow_run.event == 'push') }}
 

From ba856e3c6aaef8ed226bd51ea540384ab231ba69 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Wed, 7 Oct 2026 15:29:44 +0530
Subject: [PATCH 05/10] fix(*): update the env type

---
 .github/workflows/deploy-staging.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 5abb559..e1a5c31 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -16,7 +16,7 @@ concurrency:
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    environment: AWS_ENV_SECRETS
+    environment: Staging
     # push/workflow_dispatch run unconditionally; workflow_run only on a green CI push to main.
     if: >-
       ${{ github.event_name == 'push' ||

From 93a1a8886eba48633e749e2dfbb3ba1badc6a91a Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Wed, 7 Oct 2026 16:05:24 +0530
Subject: [PATCH 06/10] fix(*): incrase the timeout minutes

---
 .github/workflows/cd-production.yml  | 5 +++--
 .github/workflows/deploy-staging.yml | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/cd-production.yml b/.github/workflows/cd-production.yml
index 221b52c..1723b75 100644
--- a/.github/workflows/cd-production.yml
+++ b/.github/workflows/cd-production.yml
@@ -75,12 +75,13 @@ jobs:
           ECR_REPOSITORY: ${{ secrets.AWS_RESOURCE_PREFIX }}-prod-repo
           IMAGE_TAG: ${{ github.ref_name }}
         run: |
-          DEPLOY_CMD="cd ${BUILD_DIRECTORY} && git fetch --tags origin && git checkout --force ${IMAGE_TAG} && aws ecr get-login-password --region ${{ secrets.AWS_REGION }} | docker login --username AWS --password-stdin ${ECR_REGISTRY} && export ECR_REGISTRY=${ECR_REGISTRY} ECR_REPOSITORY=${ECR_REPOSITORY} IMAGE_TAG=${IMAGE_TAG} && docker compose pull backend && docker compose --profile prestart run --rm prestart && docker compose up -d --remove-orphans && docker image prune -f"
+          DEPLOY_CMD="cd ${BUILD_DIRECTORY} && git fetch --tags origin && git checkout --force ${IMAGE_TAG} && aws ecr get-login-password --region ${{ secrets.AWS_REGION }} | docker login --username AWS --password-stdin ${ECR_REGISTRY} && export ECR_REGISTRY=${ECR_REGISTRY} ECR_REPOSITORY=${ECR_REPOSITORY} IMAGE_TAG=${IMAGE_TAG} && docker compose pull --quiet backend && docker compose --profile prestart run --rm prestart && docker compose up -d --remove-orphans && docker image prune -f"
 
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \
             --document-name "AWS-RunShellScript" \
             --comment "Deploy kaapi-guardrails production" \
+            --cloud-watch-output-config CloudWatchOutputEnabled=true \
             --parameters "commands=[\"set -eux\", \"sudo chown -R ec2-user:ec2-user ${BUILD_DIRECTORY}\", \"sudo -iu ec2-user bash -lc \\\"${DEPLOY_CMD}\\\"\"]" \
             --query "Command.CommandId" \
             --output text)
@@ -89,7 +90,7 @@ jobs:
           echo "Sent SSM command: $CMD_ID"
 
       - name: Wait for SSM command to finish
-        timeout-minutes: 15
+        timeout-minutes: 20
         env:
           INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
           CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index e1a5c31..8176710 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -67,12 +67,13 @@ jobs:
         run: |
           echo "Deploying commit: $DEPLOY_SHA"
 
-          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard '"${DEPLOY_SHA}"' && aws ecr get-login-password --region '"${{ secrets.AWS_REGION }}"' | docker login --username AWS --password-stdin '"${ECR_REGISTRY}"' && export ECR_REGISTRY='"${ECR_REGISTRY}"' ECR_REPOSITORY='"${ECR_REPOSITORY}"' IMAGE_TAG='"${IMAGE_TAG}"' && docker compose pull backend && docker compose --profile prestart run --rm prestart && docker compose up -d --remove-orphans && docker image prune -f\"'
+          DEPLOY_CMD='sudo -iu ec2-user bash -lc \"cd '"${BUILD_DIRECTORY}"' && git fetch origin && git reset --hard '"${DEPLOY_SHA}"' && aws ecr get-login-password --region '"${{ secrets.AWS_REGION }}"' | docker login --username AWS --password-stdin '"${ECR_REGISTRY}"' && export ECR_REGISTRY='"${ECR_REGISTRY}"' ECR_REPOSITORY='"${ECR_REPOSITORY}"' IMAGE_TAG='"${IMAGE_TAG}"' && docker compose pull --quiet backend && docker compose --profile prestart run --rm prestart && docker compose up -d --remove-orphans && docker image prune -f\"'
 
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \
             --document-name "AWS-RunShellScript" \
             --comment "Deploy kaapi-guardrails staging" \
+            --cloud-watch-output-config CloudWatchOutputEnabled=true \
             --parameters commands="[\"set -eux\",\"sudo chown -R ec2-user:ec2-user ${BUILD_DIRECTORY}\",\"${DEPLOY_CMD}\"]" \
             --query "Command.CommandId" \
             --output text)
@@ -81,7 +82,7 @@ jobs:
           echo "Sent SSM command: $CMD_ID"
 
       - name: Wait for SSM command to finish
-        timeout-minutes: 10
+        timeout-minutes: 20
         env:
           INSTANCE_ID: ${{ secrets.INSTANCE_ID }}
           CMD_ID: ${{ steps.ssm.outputs.cmd_id }}

From 8dfe74eb549a0c9ae016e54c15cfce6be609f4a2 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:28:49 +0530
Subject: [PATCH 07/10] fix(*): remove the push event from the deploy staging
 file

---
 .github/workflows/deploy-staging.yml | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 8176710..9b3b14c 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,12 +1,8 @@
 name: Deploy Kaapi Guardrails Staging To EC2
 
 on:
-  # workflow_run:
-  #   workflows: ["Kaapi Guardrails CI"]
-  #   branches: [main]
-  #   types: [completed]
   push:
-    branches: [feat/deployment-script-updates]
+    branches: [main]
   workflow_dispatch:
 
 concurrency:
@@ -17,10 +13,9 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     environment: Staging
-    # push/workflow_dispatch run unconditionally; workflow_run only on a green CI push to main.
+    # workflow_dispatch runs unconditionally; workflow_run only on a green CI push to main.
     if: >-
-      ${{ github.event_name == 'push' ||
-          github.event_name == 'workflow_dispatch' ||
+      ${{ github.event_name == 'workflow_dispatch' ||
           (github.event.workflow_run.conclusion == 'success' &&
            github.event.workflow_run.event == 'push') }}
 

From fd49ce21473b3b040b5ee258c58704c32f0eb75f Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:50:10 +0530
Subject: [PATCH 08/10] fix(*): build init

---
 .github/workflows/deploy-staging.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 9b3b14c..fcac816 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,8 +1,12 @@
 name: Deploy Kaapi Guardrails Staging To EC2
 
 on:
+  # workflow_run:
+  #   workflows: ["Kaapi CI"]
+  #   branches: [main]
+  #   types: [completed]
   push:
-    branches: [main]
+    branches: [feat/deployment-script-updates]
   workflow_dispatch:
 
 concurrency:
@@ -15,9 +19,8 @@ jobs:
     environment: Staging
     # workflow_dispatch runs unconditionally; workflow_run only on a green CI push to main.
     if: >-
-      ${{ github.event_name == 'workflow_dispatch' ||
-          (github.event.workflow_run.conclusion == 'success' &&
-           github.event.workflow_run.event == 'push') }}
+      ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' ||
+          github.event.workflow_run.conclusion == 'success' }}
 
     permissions:
       id-token: write

From bcedff6c5e4929269e7cb1db3bbfc2a1583ad7ae Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Fri, 9 Oct 2026 11:03:28 +0530
Subject: [PATCH 09/10] fix(*): revert the last changes

---
 .github/workflows/deploy-staging.yml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index fcac816..1d01bbb 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,12 +1,10 @@
 name: Deploy Kaapi Guardrails Staging To EC2
 
 on:
-  # workflow_run:
-  #   workflows: ["Kaapi CI"]
-  #   branches: [main]
-  #   types: [completed]
-  push:
-    branches: [feat/deployment-script-updates]
+  workflow_run:
+    workflows: ["Kaapi CI"]
+    branches: [main]
+    types: [completed]
   workflow_dispatch:
 
 concurrency:
@@ -19,7 +17,7 @@ jobs:
     environment: Staging
     # workflow_dispatch runs unconditionally; workflow_run only on a green CI push to main.
     if: >-
-      ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' ||
+      ${{ github.event_name == 'workflow_dispatch' ||
           github.event.workflow_run.conclusion == 'success' }}
 
     permissions:

From e7d3aa94ca24896aaf550747e11f9b989945ae76 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Mon, 12 Oct 2026 14:23:25 +0530
Subject: [PATCH 10/10] fix(*): update the workflow nae

---
 .github/workflows/deploy-staging.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 1d01bbb..949031b 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -2,7 +2,7 @@ name: Deploy Kaapi Guardrails Staging To EC2
 
 on:
   workflow_run:
-    workflows: ["Kaapi CI"]
+    workflows: ["Kaapi Guardrails CI"]
     branches: [main]
     types: [completed]
   workflow_dispatch: