web.yml

name: web
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
    paths:
      - web/**
      - .github/workflows/*
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

jobs:
  verify-frontend:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 18.x
      - run: npm install
      - run: npm run validate

  build:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web
    steps:
      - uses: actions/checkout@v4
      - name: configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: eu-west-2
      - uses: actions/setup-node@v4
        with:
          node-version: 18.x
      - run: npm install
      - run: npm run build
      - name: zip artifact
        run: (cd dist && zip -r ../dist.zip .)
      - name: upload artifact
        uses: actions/upload-artifact@v4
        if: github.ref == 'refs/heads/main' && github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        with:
          name: web-${{ github.sha }}
          path: web/dist.zip
  
  release:
    if: github.ref == 'refs/heads/main' && github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    needs: [build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: eu-west-2
      - name: terraform init
        run: |
          terraform -chdir=iac init -input=false \
            -backend-config="bucket=${{ secrets.TF_STATE_BUCKET }}" \
            -backend-config="key=${{ env.TF_STATE_KEY }}"
        env:
          TF_STATE_KEY: ask-david.tfstate
      - uses: actions/download-artifact@v4
        with:
          name: web-${{ github.sha }}
      - run: unzip -d to-upload dist.zip
      - name: upload
        run: |
          BUCKET_NAME=$(terraform -chdir=iac output -raw s3_bucket_name)
          aws s3 sync to-upload "s3://${BUCKET_NAME}/"
      - name: invalidate cache
        run: |
          CLOUDFRONT_DIST=$(terraform -chdir=iac output -raw cloudfront_id)
          aws cloudfront create-invalidation --distribution-id "${CLOUDFRONT_DIST}" --paths "/*"

  dependabot:
    if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request'}}
    needs: [verify-frontend, build]
    runs-on: ubuntu-latest
    steps:
      - run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{ secrets.PAT_AUTO_MERGE }}