From 3cfa960142f52cb01e8c955ed5bba9b6a20d1f43 Mon Sep 17 00:00:00 2001
From: Jeremy Demers <52353432+JeremyDemers@users.noreply.github.com>
Date: Mon, 29 Jun 2026 15:21:49 -0400
Subject: [PATCH] Automate Arcade production deployment

---
 .github/workflows/ci.yml     | 47 +++++++++++++++++++++++++++++++++---
 backend/serverless/README.md |  4 +++
 2 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 45005bd..9d898f7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,8 +23,8 @@ jobs:
       run:
         working-directory: ${{ matrix.directory }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
@@ -37,8 +37,8 @@ jobs:
     name: Serverless API
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.14"
           cache: pip
@@ -61,3 +61,42 @@ jobs:
           terraform -chdir=backend/serverless/terraform fmt -check
           terraform -chdir=backend/serverless/terraform init -backend=false -input=false
           terraform -chdir=backend/serverless/terraform validate
+
+  deploy-api:
+    name: Deploy production API
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: [frontend, serverless-api]
+    runs-on: ubuntu-latest
+    concurrency:
+      group: arcade-production
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.14"
+
+      - name: Build Lambda package
+        run: ./backend/serverless/build-lambda.sh
+
+      - name: Configure temporary AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
+          role-session-name: arcade-${{ github.run_id }}
+          aws-region: ${{ vars.AWS_REGION }}
+
+      - name: Update Lambda code
+        run: |
+          aws lambda update-function-code \
+            --function-name "${{ vars.ARCADE_LAMBDA_NAME }}" \
+            --zip-file fileb://backend/serverless/dist/arcade-api.zip \
+            --no-cli-pager
+          aws lambda wait function-updated-v2 \
+            --function-name "${{ vars.ARCADE_LAMBDA_NAME }}"
+
+      - name: Verify production API
+        run: curl --fail-with-body --silent --show-error "${{ vars.ARCADE_API_URL }}/health"
diff --git a/backend/serverless/README.md b/backend/serverless/README.md
index 215ee82..f335405 100644
--- a/backend/serverless/README.md
+++ b/backend/serverless/README.md
@@ -67,3 +67,7 @@ export ARCADE_TERRAFORM_STATE_BUCKET="YOUR_STATE_BUCKET"
 ```
 
 The script intentionally does not use `-auto-approve`. After deployment, use the `api_url` output for both portfolio game API variables.
+
+## Continuous deployment
+
+After CI passes on `main`, GitHub Actions builds the Lambda package, assumes the repository's AWS role through OIDC, updates only `arcade-prod-api`, and verifies `/health`. The role trusts only `JeremyDemers/arcade` on `main` and cannot change Terraform infrastructure.