I turned our GitHub Actions + OIDC setup into a reusable template that runs matrix tests across 6 services, caches Docker layers, and auto-deploys to a dev ECS cluster; infra is Terraform-managed and prod is gated by a manual approval, bringing total pipeline time to about 9 minutes. If you’ve got battle-tested tweaks or a cleaner pattern for ephemeral test envs and blue/green deploys, I’ll swap notes and share the template.
We fought ephemeral env sprawl too; what worked was spinning a per-PR ECS service off the same task def with a path-based ALB rule and a TTL tag, then an EventBridge rule tears it down after 24h — kept setup under about 2 min and costs sane. For “blue/green”, CodeDeploy with listener rules + ECS deployment circuit breaker was steadier than rolling updates, and GitHub Actions just feeds Terraform the PR number; docs: CodeDeploy blue/green deployments for Amazon ECS - Amazon Elastic Container Service. Minor caveat: Fargate Spot saved money but occasionally slowed that 6‑service matrix, — worth toggling only for dev.
But we shaved our pipeline from about 11 to about 8 min by pushing the Buildx cache to ECR (cache-to=type=registry,mode=max) so matrix jobs share layers across runners, plus using GitHub Actions concurrency to kill superseded PR runs — cache misses on fresh runners were killing us. For per-PR envs, building on @aspen_j23, capacity providers with Fargate Spot + a TTL tag and an EventBridge Scheduler kept costs sane (about 60% drop) without leaving orphaned services; tiny caveat: Spot can evict, so keep a min=1 on on‑demand.
We knocked our GitHub Actions + OIDC pipeline from about 10 to about 6 min by making the matrix dynamic — only build/test services touched by the diff; , watching all 6 rebuild for a docs tweak drove me nuts. Used dorny/paths-filter to emit the matrix and fall back to a ‘full-run’ switch when Terraform or shared proto changes happen: GitHub - dorny/paths-filter: Conditionally run actions based on files modified by PR, feature branch or pushed commits. Might shave a couple minutes off your 9 min total — does your dev ECS deploy need every service each run?