caddy.yml

name: Caddy

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - .github/workflows/caddy.yml

permissions:
  id-token: write
  attestations: write

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

env:
  GO_VERSION: 1.23
  CADDY_VERSION: 2.9.1

jobs:
  build:
    strategy:
      matrix:
        include:
          - os: ubuntu-24.04
            name: x86_64-unknown-linux-gnu
            goos: linux
            goarch: amd64
          - os: ubuntu-24.04-arm
            name: aarch64-unknown-linux-gnu
            goos: linux
            goarch: arm64
          - os: windows-latest
            name: x86_64-pc-windows-gnu
            goos: windows
            goarch: amd64
          - os: macos-14
            name: x86_64-apple-darwin
            goos: darwin
            goarch: amd64
          - os: macos-14
            name: aarch64-apple-darwin
            goos: darwin
            goarch: arm64

    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - run: go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
      - run: xcaddy build v${{ env.CADDY_VERSION }} --with github.com/caddy-dns/route53
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
      - shell: bash
        run: |
          ext=""
          [[ "${{ runner.os }}" == windows* ]] && ext=".exe"
          mv caddy$ext caddy-${{ matrix.name }}$ext

      - uses: actions/attest-build-provenance@v1
        with:
          subject-path: caddy-${{ matrix.name }}*
      - uses: actions/upload-artifact@v4
        with:
          name: caddy-${{ matrix.name }}
          path: caddy-${{ matrix.name }}*
          if-no-files-found: error

  upload:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # OIDC token for AWS login
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: caddy-*
          merge-multiple: true

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ap-southeast-2
          role-to-assume: arn:aws:iam::143295493206:role/gha-tamanu-tools-upload
          role-session-name: GHA@3PB=Caddy

      - name: Upload
        run: |
          for f in caddy-*; do
            aws s3 cp $f s3://bes-ops-tools/caddy/${{ env.CADDY_VERSION }}/$f --no-progress
            aws s3 cp $f s3://bes-ops-tools/caddy/latest/$f --no-progress
          done

      - name: Clear cache
        run: aws cloudfront create-invalidation --distribution-id=EDAG0UBS1MN74 --paths '/caddy/*'