Aws architecture upates

.github/workflows/backend-lint.yml

@@ -0,0 +1,41 @@
+name: Backend Lint
+
+on:
+  push:
+    branches: [main, staging]
+    paths:
+      - 'backend/**'
+  pull_request:
+    branches: [main, staging]
+    paths:
+      - 'backend/**'
+
+jobs:
+  lint:
+    name: Ruff Lint & Format Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    defaults:
+      run:
+        working-directory: backend
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: Run Ruff lint check
+        run: uv run ruff check .
+
+      - name: Run Ruff format check
+        run: uv run ruff format --check .

.github/workflows/backend-tests.yml

@@ -0,0 +1,46 @@
+name: Backend Tests
+
+on:
+  push:
+    branches: [main, staging]
+    paths:
+      - 'backend/**'
+  pull_request:
+    branches: [main, staging]
+    paths:
+      - 'backend/**'
+
+jobs:
+  tests:
+    name: Pytest
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: backend
+
+    # Tests are domain-level (pure DataFrames) — no real DB or AWS needed.
+    # These env vars satisfy pydantic-settings validation at import time.
+    env:
+      DATABASE_URL: postgresql://postgres:postgres@localhost/test
+      SECRET_KEY: test-secret-key-for-ci
+      AWS_REGION: us-east-1
+      AWS_S3_BUCKET: test-bucket
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: Run tests
+        run: uv run python -m pytest tests/ --no-cov -x -q

.github/workflows/deploy-prod.yml

@@ -0,0 +1,92 @@
+name: Deploy to Production
+
+on:
+  push:
+    branches: [main]
+
+env:
+  AWS_REGION: us-east-1
+  ENVIRONMENT: prod
+  APP_NAME: examengine
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  deploy:
+    name: Build, Push & Deploy
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials via OIDC
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_GITHUB_ACTIONS_ROLE_ARN_PROD }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Log in to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Get configuration from SSM
+        id: config
+        run: |
+          get() { aws ssm get-parameter --name "/${APP_NAME}/${ENVIRONMENT}/$1" --query 'Parameter.Value' --output text; }
+          echo "cluster=$(get cluster-name)"          >> $GITHUB_OUTPUT
+          echo "backend-service=$(get backend-service)" >> $GITHUB_OUTPUT
+          echo "frontend-service=$(get frontend-service)" >> $GITHUB_OUTPUT
+          echo "backend-uri=$(get backend-repo-uri)"  >> $GITHUB_OUTPUT
+          echo "frontend-uri=$(get frontend-repo-uri)" >> $GITHUB_OUTPUT
+          echo "domain=$(get domain-name)"            >> $GITHUB_OUTPUT
+
+      - name: Build and push backend image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./backend/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: |
+            ${{ steps.config.outputs.backend-uri }}:latest
+            ${{ steps.config.outputs.backend-uri }}:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build and push frontend image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./frontend/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: |
+            ${{ steps.config.outputs.frontend-uri }}:latest
+            ${{ steps.config.outputs.frontend-uri }}:${{ github.sha }}
+          build-args: |
+            NEXT_PUBLIC_API_URL=https://${{ steps.config.outputs.domain }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Deploy backend service
+        run: |
+          aws ecs update-service \
+            --cluster ${{ steps.config.outputs.cluster }} \
+            --service ${{ steps.config.outputs.backend-service }} \
+            --force-new-deployment \
+            --region ${{ env.AWS_REGION }}
+
+      - name: Deploy frontend service
+        run: |
+          aws ecs update-service \
+            --cluster ${{ steps.config.outputs.cluster }} \
+            --service ${{ steps.config.outputs.frontend-service }} \
+            --force-new-deployment \
+            --region ${{ env.AWS_REGION }}

.github/workflows/deploy-staging.yml

@@ -0,0 +1,92 @@
+name: Deploy to Staging
+
+on:
+  push:
+    branches: [staging]
+
+env:
+  AWS_REGION: us-east-1
+  ENVIRONMENT: staging
+  APP_NAME: examengine
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  deploy:
+    name: Build, Push & Deploy
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials via OIDC
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_GITHUB_ACTIONS_ROLE_ARN_STAGING }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Log in to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Get configuration from SSM
+        id: config
+        run: |
+          get() { aws ssm get-parameter --name "/${APP_NAME}/${ENVIRONMENT}/$1" --query 'Parameter.Value' --output text; }
+          echo "cluster=$(get cluster-name)"          >> $GITHUB_OUTPUT
+          echo "backend-service=$(get backend-service)" >> $GITHUB_OUTPUT
+          echo "frontend-service=$(get frontend-service)" >> $GITHUB_OUTPUT
+          echo "backend-uri=$(get backend-repo-uri)"  >> $GITHUB_OUTPUT
+          echo "frontend-uri=$(get frontend-repo-uri)" >> $GITHUB_OUTPUT
+          echo "domain=$(get domain-name)"            >> $GITHUB_OUTPUT
+
+      - name: Build and push backend image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./backend/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: |
+            ${{ steps.config.outputs.backend-uri }}:latest
+            ${{ steps.config.outputs.backend-uri }}:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build and push frontend image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./frontend/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: |
+            ${{ steps.config.outputs.frontend-uri }}:latest
+            ${{ steps.config.outputs.frontend-uri }}:${{ github.sha }}
+          build-args: |
+            NEXT_PUBLIC_API_URL=https://${{ steps.config.outputs.domain }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Deploy backend service
+        run: |
+          aws ecs update-service \
+            --cluster ${{ steps.config.outputs.cluster }} \
+            --service ${{ steps.config.outputs.backend-service }} \
+            --force-new-deployment \
+            --region ${{ env.AWS_REGION }}
+
+      - name: Deploy frontend service
+        run: |
+          aws ecs update-service \
+            --cluster ${{ steps.config.outputs.cluster }} \
+            --service ${{ steps.config.outputs.frontend-service }} \
+            --force-new-deployment \
+            --region ${{ env.AWS_REGION }}