build.yaml

name: Build on push
on: [push]
concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}
  cancel-in-progress: true
jobs:
  build:
    runs-on: ubuntu-latest
    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Install deps, lint, build and test project
        uses: ./.github/actions/install
      # Every push to main deploys to staging
      - name: Deploy to staging
        if: ${{ github.ref_name == 'main' }}
        uses: ./.github/actions/deploy
        with:
          aws_role: ${{ secrets.AWS_ROLE_STAGING_ACCOUNT }}
          aws_deploy_path: ${{ secrets.AWS_STAGING_BUCKET }}
          aws_s3_sync_args: --include '*' --exclude '*/*'
          aws_s3_cache: no-store
          cloudfront_distribution_id: ${{ secrets.CLOUDFRONT_ID_STAGING }}
          cloudfront_invalidation_paths: '/*'
        # Only tags named as release-* will deploy to production
      - name: Deploy to prod
        if: startsWith(github.ref, 'refs/tags/release-')
        uses: ./.github/actions/deploy
        with:
          aws_role: ${{ secrets.AWS_ROLE_PRODUCTION_ACCOUNT }}
          aws_deploy_path: ${{ secrets.AWS_PRODUCTION_BUCKET }}
          aws_s3_sync_args: --include '*' --exclude '*/*'
          aws_s3_cache: max-age=3600
          cloudfront_distribution_id: ${{ secrets.CLOUDFRONT_ID_PRODUCTION }}
          cloudfront_invalidation_paths: '/*'