push.yml

name: Build

on: [push]

jobs:
  main:
    runs-on: ubuntu-latest

    steps:
      - uses: linz/action-typescript@9bf69b0f313b3525d3ba3116f26b1aff7eb7a6c0 # v3.1.0

  deploy-prod:
    runs-on: ubuntu-latest
    concurrency: deploy-prod-${{ github.ref }}
    needs: [main]
    if: github.ref == 'refs/heads/master' && github.repository == 'linz/lds-cache'

    permissions:
      id-token: write
      contents: write

    environment:
      name: prod

    steps:
      - uses: linz/action-typescript@9bf69b0f313b3525d3ba3116f26b1aff7eb7a6c0 # v3.1.0

      - name: (Prod) Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4
        with:
          aws-region: ap-southeast-2
          mask-aws-account-id: true
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}

      - name: (Prod) Deploy
        run: |
          npx cdk deploy --require-approval never
        env:
          NODE_ENV: "production"
          CACHE_BUCKET_NAME: "linz-lds-cache"