deploy.yml

name: Deploy to AWS CDN + S3

on:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  build-and-deploy:
    environment:
      name: aws
      url: 'https://boldify.net'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '26'

      - name: Install pnpm
        run: npm install -g pnpm

      - name: Install dependencies
        run: pnpm install

      - name: Build project
        env:
          INDEXNOW_KEY: ${{ secrets.INDEXNOW_KEY }}
        run: pnpm build

      - name: Configure AWS
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: 'eu-west-1'

      - name: Install OpenTofu
        uses: opentofu/setup-opentofu@v2

      - name: Tofu apply
        run: |
          cd devops/terraform
          tofu init
          tofu apply --var-file .tfvars -auto-approve
          echo "BUCKET_NAME=$(tofu output -raw bucket_name)" >> $GITHUB_ENV
          echo "CLOUDFRONT_ID=$(tofu output -raw cloudfront_id)" >> $GITHUB_ENV

      - name: Deploy sources
        run: |
          aws s3 rm s3://$BUCKET_NAME --recursive
          aws s3 cp build s3://$BUCKET_NAME --recursive

      - name: Fix content-type for .well-known files
        run: |
          aws s3 cp s3://$BUCKET_NAME/.well-known/api-catalog s3://$BUCKET_NAME/.well-known/api-catalog \
            --content-type "application/linkset+json" \
            --metadata-directive REPLACE

      - name: Invalidate CloudFront cache
        run: |
          aws cloudfront create-invalidation --distribution-id $CLOUDFRONT_ID --paths "/*"

      - name: Notify IndexNow content upgrade
        env:
          INDEXNOW_KEY: ${{ secrets.INDEXNOW_KEY }}
        run: |
          node devops/scripts/notify_indexnow.js