Deploy to EC2 from GitHub Actions without opening port 22

Use AWS SSM Run Command instead of SSH in your CI/CD pipeline. No inbound port 22, no long-lived private key in your repo secrets.