From e3e343f1c5e14367402ba6b4ca042a3ec54f59d2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:02:07 +0000
Subject: [PATCH 1/2] Initial plan


From 648095ab3d1084bbb0bf4d1454a0489597deb0b9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:03:52 +0000
Subject: [PATCH 2/2] fix: allow temporary runner SSH access for EC2 deploy

Co-authored-by: sanket-rajput <100849898+sanket-rajput@users.noreply.github.com>
---
 .github/workflows/deploy.yml | 53 ++++++++++++++++++++++++++++++++++++
 deploy/README.md             | 11 +++++++-
 2 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 42ceaa8..03ffdb7 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -8,14 +8,47 @@ jobs:
   deploy:
     name: Deploy to Production EC2
     runs-on: ubuntu-latest
+    env:
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      EC2_SECURITY_GROUP_ID: ${{ secrets.EC2_SECURITY_GROUP_ID }}
 
     steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Allow GitHub Actions runner SSH access
+        id: allow_runner_ssh
+        run: |
+          set -euo pipefail
+          RUNNER_IP="$(curl -fsSL https://checkip.amazonaws.com | tr -d '\n')"
+          echo "runner_ip=${RUNNER_IP}" >> "$GITHUB_OUTPUT"
+
+          set +e
+          AUTHORIZE_OUTPUT=$(aws ec2 authorize-security-group-ingress \
+            --group-id "$EC2_SECURITY_GROUP_ID" \
+            --protocol tcp \
+            --port 22 \
+            --cidr "${RUNNER_IP}/32" 2>&1)
+          STATUS=$?
+          set -e
+
+          if [ "$STATUS" -ne 0 ] && ! echo "$AUTHORIZE_OUTPUT" | grep -q "InvalidPermission.Duplicate"; then
+            echo "$AUTHORIZE_OUTPUT"
+            exit "$STATUS"
+          fi
+
       - name: Deploy & Verify on Production EC2 via SSH
         uses: appleboy/ssh-action@v1.0.3
         with:
           host: ${{ secrets.EC2_HOST }}
           username: ${{ secrets.EC2_USER }}
           key: ${{ secrets.EC2_SSH_KEY }}
+          timeout: 2m
+          command_timeout: 20m
           script_stop: true
           script: |
             set -e
@@ -72,3 +105,23 @@ jobs:
               exit 1
             fi
             echo "=== Deployment Completed Successfully ==="
+
+      - name: Revoke GitHub Actions runner SSH access
+        if: ${{ always() && steps.allow_runner_ssh.outputs.runner_ip != '' }}
+        run: |
+          set -euo pipefail
+          RUNNER_IP="${{ steps.allow_runner_ssh.outputs.runner_ip }}"
+
+          set +e
+          REVOKE_OUTPUT=$(aws ec2 revoke-security-group-ingress \
+            --group-id "$EC2_SECURITY_GROUP_ID" \
+            --protocol tcp \
+            --port 22 \
+            --cidr "${RUNNER_IP}/32" 2>&1)
+          STATUS=$?
+          set -e
+
+          if [ "$STATUS" -ne 0 ] && ! echo "$REVOKE_OUTPUT" | grep -q "InvalidPermission.NotFound"; then
+            echo "$REVOKE_OUTPUT"
+            exit "$STATUS"
+          fi
diff --git a/deploy/README.md b/deploy/README.md
index 785aa43..60aba77 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -34,7 +34,7 @@ Ensure the following inbound ports are open in AWS EC2 Security Group:
 
 | Type | Port Range | Source | Purpose |
 | :--- | :--- | :--- | :--- |
-| **SSH** | `22` | `My IP` | Secure SSH administration |
+| **SSH** | `22` | `My IP` + GitHub Actions Runner `/32` | Secure SSH administration and CI/CD deployment |
 | **HTTP** | `80` | `0.0.0.0/0` | ACME Challenge Verification & HTTP -> HTTPS Redirect |
 | **HTTPS** | `443` | `0.0.0.0/0` | Secure Web Frontend (`https://fileshare.sanketrajput.live`) |
 | **Custom TCP** | `8080` | `0.0.0.0/0` | Direct Spring Boot API & Swagger UI |
@@ -42,6 +42,15 @@ Ensure the following inbound ports are open in AWS EC2 Security Group:
 
 ---
 
+### CI/CD SSH Access Note
+The deployment workflow (`.github/workflows/deploy.yml`) temporarily whitelists the current GitHub Actions runner public IP on port `22` before deployment and revokes it afterward.
+
+Required repository secrets for this automation:
+- `AWS_ACCESS_KEY_ID`
+- `AWS_SECRET_ACCESS_KEY`
+- `AWS_REGION`
+- `EC2_SECURITY_GROUP_ID`
+
 ## 🔑 One-Time SSL Certificate Issuance (Let's Encrypt)
 
 Before issuing the certificate, ensure DNS A-Record for **`fileshare.sanketrajput.live`** points directly to your EC2 Elastic IP address.