release.yml

name: Release

on:
  push:
    tags:
      - v*.*.*

permissions:
  id-token: write
  contents: read

jobs:
  staging_deploy:
    environment: staging
    runs-on: ubuntu-latest
    env:
      DIST: ./dist
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'yarn'

      - name: Install yarn
        run: |
          : # set-version will always download the latest version of yarn
          yarn policies set-version 4.3.0
          yarn install --immutable

      - name: Build Website
        id: build_website_staging
        run: yarn staging

      - uses: actions/upload-artifact@v4
        with:
            name: build-staging
            path: ${{ env.DIST }}
            retention-days: 1

      - uses: actions/download-artifact@v4
        with:
          name: build-staging
          path: ${{ env.DIST }}

      - name: Configure AWS credentials
        id: aws_auth
        uses: aws-actions/configure-aws-credentials@v4
        with:
          audience: sts.amazonaws.com
          aws-region: ${{ vars.AWS_REGION }}
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}

      - name: Copy files to the production website with the AWS CLI
        run: |
          aws s3 sync --delete ${{ env.DIST }} s3://${{ vars.BUCKET }} --region ${{ vars.AWS_REGION }}

      - name: Clear cloudfront cache
        run: |
          aws cloudfront create-invalidation \
          --distribution-id ${{ vars.DISTRIBUTION_ID }} \
          --paths "/*" \
          --region ${{ vars.AWS_REGION }}

  production_deploy:
    environment: production
    runs-on: ubuntu-latest
    needs: [staging_deploy]
    env:
      DIST: ./dist
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'yarn'

      - name: Install yarn
        run: |
          : # set-version will always download the latest version of yarn
          yarn policies set-version 4.3.0
          yarn install --immutable

      - name: Build Website
        id: build_website_production
        run: yarn prod

      - uses: actions/upload-artifact@v4
        with:
            name: build-production
            path: ${{ env.DIST }}
            retention-days: 1

      - uses: actions/download-artifact@v4
        with:
          name: build-production
          path: ${{ env.DIST }}

      - name: Generate App Token
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ vars.DEPLOY_APP_ID }}
          private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}

      - name: Upload Artifacts to Release
        run: |
          artifacts='${{ steps.build_website_production.outputs }}'
          echo "$json" > artifacts.json
          gh release upload ${{ github.ref_name }} artifacts.json
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}

      - name: Configure AWS credentials
        id: aws_auth
        uses: aws-actions/configure-aws-credentials@v4
        with:
          audience: sts.amazonaws.com
          aws-region: ${{ vars.AWS_REGION }}
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}

      - name: Copy files to the production website with the AWS CLI
        run: |
          aws s3 sync --delete ${{ env.DIST }} s3://${{ vars.BUCKET }} --region ${{ vars.AWS_REGION }}

      - name: Clear cloudfront cache
        run: |
          aws cloudfront create-invalidation \
          --distribution-id ${{ vars.DISTRIBUTION_ID }} \
          --paths "/*" \
          --region ${{ vars.AWS_REGION }}