From 20b1853a781ffd82c6ac29fd2fb937fe22025379 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 29 Aug 2026 04:30:47 +0000
Subject: [PATCH 1/3] Initial plan


From bc13ec69d767b37ac48d52f18e634a9a1829f24d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 29 Aug 2026 04:32:37 +0000
Subject: [PATCH 2/3] Fix deploy workflow Docker permission issue

Co-authored-by: Dinurang <172159221+Dinurang@users.noreply.github.com>
---
 .github/workflows/deploy.yml | 73 ++++++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 .github/workflows/deploy.yml

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..f9e92bc
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,73 @@
+name: Deploy Application
+
+on:
+  push:
+    branches:
+      - dinura-deployment
+  workflow_dispatch:
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Backend syntax check
+        run: |
+          python -m compileall integrated-backend
+
+      - name: Frontend build
+        run: |
+          npm ci --prefix integrated-frontend
+          npm run build --prefix integrated-frontend
+
+  deploy:
+    needs: ci
+    runs-on: ubuntu-latest
+    steps:
+      - name: Deploy to EC2 via SSH
+        uses: webfactory/ssh-agent@v0.9.0
+        with:
+          ssh-private-key: ${{ secrets.EC2_SSH_KEY }}
+
+      - name: SSH and deploy latest app
+        env:
+          EC2_HOST: ${{ secrets.EC2_HOST }}
+          EC2_USERNAME: ${{ secrets.EC2_USERNAME }}
+        run: |
+          set -e
+          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${EC2_USERNAME}@${EC2_HOST} <<'EOF'
+            set -e
+            cd ~/app
+            git fetch origin
+            git checkout dinura-deployment
+            git reset --hard origin/dinura-deployment
+
+            if [ ! -f .env ]; then
+              cp .env.example .env
+            fi
+
+            chmod 600 .env
+            sudo docker compose build
+            sudo docker compose up -d
+            sudo docker compose ps
+
+            if curl -fsS http://127.0.0.1/api/health >/dev/null 2>&1; then
+              echo "Backend health check passed"
+            else
+              echo "Backend health check failed"
+              sudo docker compose logs --tail 200 backend
+              exit 1
+            fi
+          EOF

From b973312d37f3e4e6402c1f9e1bd1adf16859f9f7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 29 Aug 2026 04:33:43 +0000
Subject: [PATCH 3/3] Add least-privilege permissions to deploy workflow

Co-authored-by: Dinurang <172159221+Dinurang@users.noreply.github.com>
---
 .github/workflows/deploy.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f9e92bc..0b78893 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -6,6 +6,9 @@ on:
       - dinura-deployment
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     runs-on: ubuntu-latest