Add optional subnet and security group IDs inputs for preview deployment

.github/actions/deployment/preview/deploy-ecs-express-service/action.yml

@@ -33,6 +33,14 @@ inputs:
     description: 'Custom environment variables as JSON object, e.g. {"NAME":"VALUE"}'
     required: false
     default: '{}'
+  subnet-ids:
+    description: 'JSON array of subnet IDs for the service, e.g. ["subnet-abc"].'
+    required: false
+    default: ''
+  security-group-ids:
+    description: 'JSON array of security group IDs for the service, e.g. ["sg-abc"]. Required when subnet-ids is set.'
+    required: false
+    default: ''
 
 outputs:
   service-url:
@@ -145,6 +153,8 @@ runs:
         ENV_VARS_CONFIG: ${{ steps.prepare-env-vars.outputs.env_vars_config }}
         PLAINTEXT_ENV_VARS: ${{ steps.prepare-env-vars.outputs.plaintext_env_vars }}
         HEALTH_CHECK_ENDPOINT: ${{ inputs.health-endpoint }}
+        SUBNET_IDS: ${{ inputs.subnet-ids }}
+        SECURITY_GROUP_IDS: ${{ inputs.security-group-ids }}
       run: |
         secrets="$(jq -c '[to_entries[] | {name: .key, valueFrom: .value}]' <<< "$ENV_VARS_CONFIG")"
         plaintext="$(jq -c '[to_entries[] | {name: .key, value: .value}]' <<< "$PLAINTEXT_ENV_VARS")"
@@ -170,6 +180,18 @@ runs:
         infrastructureRoleArn="${{ steps.set-service-variables.outputs.infrastructure_role_arn }}"
         taskRoleArn="${{ steps.set-service-variables.outputs.task_tole_arn }}"
         echo "Deploying Preview: ${{ steps.set-service-variables.outputs.service_name }} ($executionRoleArn, $infrastructureRoleArn, $taskRoleArn)..."
+
+        NETWORK_ARGS=()
+        if [ -n "$SUBNET_IDS" ]; then
+          jq -e 'type == "array"' >/dev/null <<<"$SUBNET_IDS" || { echo "Error: subnet-ids must be a JSON array, e.g. [\"subnet-abc\"]"; exit 1; }
+          if [ -z "$SECURITY_GROUP_IDS" ]; then
+            echo "Error: security-group-ids must be set when subnet-ids are provided."
+            exit 1
+          fi
+          jq -e 'type == "array"' >/dev/null <<<"$SECURITY_GROUP_IDS" || { echo "Error: security-group-ids must be a JSON array, e.g. [\"sg-abc\"]"; exit 1; }
+          NETWORK_CONFIG=$(jq -n --argjson subnets "$SUBNET_IDS" --argjson sgs "$SECURITY_GROUP_IDS" '{subnets: $subnets, securityGroups: $sgs}')
+          NETWORK_ARGS=(--network-configuration "$NETWORK_CONFIG")
+        fi
 
         aws ecs create-express-gateway-service \
           --service-name "${{ steps.set-service-variables.outputs.service_name }}" \
@@ -179,6 +201,7 @@ runs:
           --primary-container "$primary_container" \
           --health-check-path "$HEALTH_CHECK_ENDPOINT" \
           --scaling-target '{"minTaskCount": 1, "maxTaskCount": 1}' \
+          "${NETWORK_ARGS[@]}" \
           --region "${{ inputs.aws-region }}"
 
         serviceArn="arn:aws:ecs:${{ inputs.aws-region }}:${{ inputs.aws-account-id }}:service/default/${{ steps.set-service-variables.outputs.service_name }}"
@@ -193,6 +216,8 @@ runs:
         ENV_VARS_CONFIG: ${{ steps.prepare-env-vars.outputs.env_vars_config }}
         PLAINTEXT_ENV_VARS: ${{ steps.prepare-env-vars.outputs.plaintext_env_vars }}
         HEALTH_CHECK_ENDPOINT: ${{ inputs.health-endpoint }}
+        SUBNET_IDS: ${{ inputs.subnet-ids }}
+        SECURITY_GROUP_IDS: ${{ inputs.security-group-ids }}
       run: |
         secrets="$(jq -c '[to_entries[] | {name: .key, valueFrom: .value}]' <<< "$ENV_VARS_CONFIG")"
         plaintext="$(jq -c '[to_entries[] | {name: .key, value: .value}]' <<< "$PLAINTEXT_ENV_VARS")"
@@ -214,13 +239,24 @@ runs:
         SERVICE_ARN="${{ steps.check-service.outputs.service_arn }}"
         echo "Updating Preview: ${{ steps.set-service-variables.outputs.service_name }} ($SERVICE_ARN)..."
 
+        NETWORK_ARGS=()
+        if [ -n "$SUBNET_IDS" ]; then
+          if [ -z "$SECURITY_GROUP_IDS" ]; then
+            echo "Error: security-group-ids must be set when subnet-ids are provided (required for shared VPC subnets)."
+            exit 1
+          fi
+          NETWORK_CONFIG=$(jq -n --argjson subnets "$SUBNET_IDS" --argjson sgs "$SECURITY_GROUP_IDS" '{subnets: $subnets, securityGroups: $sgs}')
+          NETWORK_ARGS=(--network-configuration "$NETWORK_CONFIG")
+        fi
+
         aws ecs update-express-gateway-service \
           --service-arn "$SERVICE_ARN" \
           --execution-role-arn "$executionRoleArn" \
           --task-role-arn "$taskRoleArn" \
           --primary-container "$primary_container" \
           --health-check-path "$HEALTH_CHECK_ENDPOINT" \
           --scaling-target '{"minTaskCount": 1, "maxTaskCount": 1}' \
+          "${NETWORK_ARGS[@]}" \
           --region "${{ inputs.aws-region }}"
 
         echo "Update started! $SERVICE_ARN"