deploy-to-prod.yml

name: Deploy to Production (main)

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-to-prod
  cancel-in-progress: true

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: deploy-to-prod
    timeout-minutes: 120

    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.GH_PAT_CHECKOUT }}
          submodules: "recursive"

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version-file: ".node-version"
          cache: "pnpm"

      - uses: actions/cache/restore@v4
        with:
          path: |
            public
            .cache
          key: gatsby-v1-${{ hashFiles('public') }}
          restore-keys: |
            gatsby-v1-

      - run: pnpm install --frozen-lockfile

      - run: pnpm run build
        env:
          AWS_S3_BUCKET_NAME: ${{ secrets.AWS_S3_BUCKET_NAME }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
          GTM_ID: ${{ vars.GTM_ID }}

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: ${{ secrets.AWS_REGION }}
          role-duration-seconds: 7200
          mask-aws-account-id: true

      - run: pnpm run deploy
        env:
          AWS_S3_BUCKET_NAME: ${{ secrets.AWS_S3_BUCKET_NAME }}
          AWS_REGION: ${{ secrets.AWS_REGION }}

      - run: |
          aws cloudfront create-invalidation \
          --distribution-id ${{ secrets.AWS_CLOUDFRONT_DISTRIBUTION_ID }} \
          --paths "/*"

      - uses: actions/cache/save@v4
        with:
          path: |
            public
            .cache
          key: gatsby-v1-${{ hashFiles('public') }}