First stab at Foundation deployment

I've deleted the upstream workflows rather than
disable them for clarity. Will always be easy to
reinstate if needed.

.github/workflows/build.yml

@@ -0,0 +1,52 @@
+name: build
+
+on:
+  release:
+    types: [created]
+  push:
+    branches:
+      - "**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ startsWith(github.ref, 'refs/tags/v') && 'release' || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/v') }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+    env:
+      AWS_DEFAULT_REGION: eu-west-1
+      PRODUCTION_CLOUDFRONT_DISTRIBUTION_ID: NOT_YET
+      STAGING_CLOUDFRONT_DISTRIBUTION_ID: E37K3V5Y65XQIX
+      REVIEW_CLOUDFRONT_DISTRIBUTION_ID: E3KUGPF02I4CJ4
+      VITE_FOUNDATION_BUILD: ${{ github.repository_owner == 'microbit-foundation' }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 20
+          cache: 'npm'
+      - run: npm ci
+      - run: npm install --no-save --registry=https://npm.pkg.github.com/microbit-foundation @microbit-foundation/[email protected] @microbit-foundation/[email protected] @microbit-foundation/npm-package-versioner@2
+        if: github.repository_owner == 'microbit-foundation'
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: npx update-ci-version
+      - run: node ./bin/print-ci-env.js >> $GITHUB_ENV
+      - run: npm run test
+      - run: npm run check
+      - run: npx prettier --check src
+      - run: npm run build
+      - run: npx website-deploy-aws
+        if: github.repository_owner == 'microbit-foundation' && (env.STAGE == 'REVIEW' || success())
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.WEB_DEPLOY_AWS_ML_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.WEB_DEPLOY_ML_AWS_SECRET_ACCESS_KEY }}
+      - run: npx invalidate-cloudfront-distribution
+        if: github.repository_owner == 'microbit-foundation' && (env.STAGE == 'REVIEW' || success())
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.WEB_DEPLOY_ML_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.WEB_DEPLOY_ML_AWS_SECRET_ACCESS_KEY }}

bin/print-ci-env.cjs

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+
+const ref = process.env.GITHUB_REF;
+let stage;
+if (ref === "refs/heads/main") {
+  stage = "STAGING";
+} else if (ref.startsWith("refs/tags/v")) {
+  stage = "PRODUCTION";
+} else {
+  stage = "REVIEW";
+}
+
+process.env.STAGE = stage;
+// STAGE must be defined before this is imported
+const { bucketName, bucketPrefix } = require("../deployment.cjs");
+const baseUrl = !bucketPrefix ? "/" : `/${bucketPrefix}/`;
+const fullUrl = `https://${bucketName}${baseUrl}`;
+
+console.log(`STAGE=${stage}`);
+console.log(`VITE_STAGE=${stage}`);
+console.log(`BASE_URL=${baseUrl}`);
+console.log(`E2E_BASE_URL=${baseUrl}`);
+// This is used for og:url and similar. Not quite right for review domain but we don't really care.
+console.log(`VITE_FULL_URL=${fullUrl}`);

deployment.cjs

@@ -0,0 +1,33 @@
+const {
+  createDeploymentDetailsFromOptions,
+} = require('@microbit-foundation/website-deploy-aws-config');
+
+const { s3Config } = createDeploymentDetailsFromOptions({
+  production: {
+    bucket: 'ml.microbit.org',
+    mode: 'root',
+    allowPrerelease: false,
+  },
+  staging: {
+    bucket: 'stage-ml.microbit.org',
+  },
+  review: {
+    bucket: 'review-ml.microbit.org',
+    mode: 'branch-prefix',
+  },
+});
+
+module.exports = {
+  ...s3Config,
+  region: 'eu-west-1',
+  removeNonexistentObjects: true,
+  enableS3StaticWebsiteHosting: true,
+  errorDocumentKey: 'index.html',
+  redirects: [],
+  params: {
+    '**/**.html': {
+      CacheControl: 'public, max-age=0, must-revalidate',
+    },
+    '**/assets/**': { CacheControl: 'public, max-age=31536000, immutable' },
+  },
+};