deploy.yml

name: main

on:
  push:
    branches:
      - main
    paths-ignore:
      - "**.tf"
  pull_request:
    branches:
      - main
    paths-ignore:
      - "**.tf"

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

# read+write needed for `aws-actions/configure-aws-credentials` to work
permissions:
  id-token: write
  contents: read

jobs:
  image-handler:
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    runs-on: ubuntu-latest-arm64

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-
      - name: install
        run: make npm/install
      - name: install
        run: make npm/test
      - name: build
        run: make build

      - name: configure aws credentials
        # 📌 Runs only if:
        # 1. is a 'push to main'
        # 2. did not run in a fork
        if: ${{ github.ref == 'refs/heads/main' && github.repository_owner == 'stroeer' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::053041861227:role/github-s3-access-eu-west-1
          role-session-name: GitHubActions
          aws-region: eu-west-1

      - name: s3 upload artefact
        # 📌 Runs only if:
        # 1. is a 'push to main'
        # 2. did not run in a fork
        if: ${{ github.ref == 'refs/heads/main' && github.repository_owner == 'stroeer' }}
        run: make deploy