main.yml

name: Build and deploy site

on:
  push:
    branches:
      - gh-pages-source
  schedule:
    - cron: "0 3 1 * *" # monthly
  workflow_dispatch:

env:
  AWS_REGION: ${{ vars.AWS_REGION }}
  DEPLOYMENT_ROLE_ARN: ${{ vars.DEPLOYMENT_ROLE_ARN }}
  BUCKET_NAME: ${{ vars.BUCKET_NAME }}

# Required to fetch OIDC token
permissions:
  id-token: write
  contents: read

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v4

      - name: Install Nix ❄️
        uses: cachix/install-nix-action@v25

      - name: Install and setup Cachix 💽
        uses: cachix/cachix-action@v14
        with:
          name: munihac-website
          signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"

      - name: Build Generator and Site 👷
        run: |
          nix-build
          cp -RL result result-with-changed-permissions
          chmod -R +w result-with-changed-permissions/

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-artifacts
          path: result-with-changed-permissions/

  deploy-aws:
    name: Deploy to AWS
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-artifacts
          path: result

      - name: Obtain OIDC token
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: ${{ env.DEPLOYMENT_ROLE_ARN }}

      - name: Deploy static site to S3 bucket
        run: aws s3 sync ./result/ s3://${{ env.BUCKET_NAME }} --delete --size-only