preview-s3-deploy.yml

name: S3 Preview Bucket - Deploy

on:
  pull_request:
    branches: '**'

permissions:
  id-token: write
  contents: read
  issues: write
  pull-requests: write

env:
  # The bucket name must follow the pattern ds-preview-<REPO_ID>-${{ github.event.number }}
  # The AWS Role only has permissions to manage buckets that start with ds-preview.
  BUCKET_NAME: ds-preview-satsummit-${{ github.event.number }}
  # The ARN of the role created in AWS.
  AWS_ROLE_ARN: arn:aws:iam::552819999234:role/ds-preview-satsummit
  # The AWS region where the bucket will be created.
  AWS_REGION: us-east-1
  # The name of the directory where the site is built.
  DIST_DIRECTORY: public

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'

      - name: Cache dependencies
        uses: actions/cache@v4
        id: cache-yarn
        with:
          path: |
            /home/runner/.cache/yarn
            node_modules
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package.json') }}

      - name: Cache dist
        uses: actions/cache@v4
        id: cache-dist
        with:
          path: ${{env.DIST_DIRECTORY}}
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ github.sha }}

      - name: Post building comment
        uses: actions/github-script@v6
        with:
          script: |
            const { createDeployingComment } = require('./.github/workflows/github-pr-update.js')
            await createDeployingComment({ github, context, core })

      - name: Install
        run: yarn install  --ignore-engines

      - name: Build
        run: yarn build

      - name: Post error comment
        uses: actions/github-script@v6
        if: failure()
        with:
          script: |
            const { createFailedComment } = require('./.github/workflows/github-pr-update.js')
            await createFailedComment({ github, context, core })

  deploy:
    runs-on: ubuntu-latest
    needs: build

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Checkout
        uses: actions/checkout@v4

      - name: Restore dist cache
        uses: actions/cache@v4
        id: cache-dist
        with:
          path: ${{env.DIST_DIRECTORY}}
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ github.sha }}

      - name: Check if bucket exists
        id: check_bucket
        run: |
          if aws s3 ls "s3://${{ env.BUCKET_NAME }}" 2>&1 | grep -q 'NoSuchBucket'; then
            echo "Bucket does not exist."
            echo "::set-output name=exists::false"
          else
            echo "Bucket exists."
            echo "::set-output name=exists::true"
          fi

      - name: Create S3 bucket
        if: steps.check_bucket.outputs.exists == 'false'
        run: |
          aws s3 mb s3://${{ env.BUCKET_NAME }}

      - name: Enable static website hosting
        if: steps.check_bucket.outputs.exists == 'false'
        run: |
          aws s3 website \
          s3://${{ env.BUCKET_NAME }} \
          --index-document index.html \
          --error-document index.html

      - name: Sync files
        run: |
          aws s3 sync \
            ./${{env.DIST_DIRECTORY}} s3://${{ env.BUCKET_NAME }} \
            --delete \
            --quiet

      - name: Make bucket public access
        if: steps.check_bucket.outputs.exists == 'false'
        run: |
          aws s3api delete-public-access-block --bucket ${{ env.BUCKET_NAME }}

      - name: Add bucket policy for public access
        if: steps.check_bucket.outputs.exists == 'false'
        run: |
          echo '{
            "Version": "2012-10-17",
            "Statement": [{
              "Sid": "PublicReadGetObject",
              "Effect": "Allow",
              "Principal": "*",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::${{ env.BUCKET_NAME }}/*"
            }]
          }' > bucket-policy.json
          aws s3api put-bucket-policy --bucket ${{ env.BUCKET_NAME }} --policy file://bucket-policy.json

      - name: Post error comment
        uses: actions/github-script@v6
        if: success()
        with:
          script: |
            const { createSuccessComment } = require('./.github/workflows/github-pr-update.js')
            await createSuccessComment({ github, context, core })

      - name: Post comment with preview URL
        uses: actions/github-script@v6
        if: failure()
        with:
          script: |
            const { createFailedComment } = require('./.github/workflows/github-pr-update.js')
            await createFailedComment({ github, context, core })