trigger-web-deployment #71
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Website | |
| concurrency: Website Production | |
| on: | |
| workflow_dispatch: | |
| repository_dispatch: | |
| types: [trigger-web-deployment] | |
| jobs: | |
| check-deploy-conditions: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| should_deploy: ${{ steps.check.outputs.should_deploy }} | |
| steps: | |
| - name: Check deployment conditions | |
| id: check | |
| run: | | |
| # Default to deploy | |
| SHOULD_DEPLOY="true" | |
| # If triggered by repository dispatch, check conditions | |
| if [[ "${{ github.event_name }}" == "repository_dispatch" ]]; then | |
| # Parse client payload | |
| SOURCE="${{ github.event.client_payload.source }}" | |
| SUCCESS="${{ github.event.client_payload.success }}" | |
| WEB_CHANGED="${{ github.event.client_payload.web_changed }}" | |
| # Skip deployment if: | |
| # - Release was unsuccessful AND | |
| # - No web files were changed | |
| if [[ "$SUCCESS" == "failure" && "$WEB_CHANGED" != "true" ]]; then | |
| SHOULD_DEPLOY="false" | |
| echo "Skipping deployment: Release failed and no web changes detected" | |
| fi | |
| fi | |
| echo "should_deploy=$SHOULD_DEPLOY" >> $GITHUB_OUTPUT | |
| echo "Deployment decision: $SHOULD_DEPLOY" | |
| run-deploy-job: | |
| needs: check-deploy-conditions | |
| if: needs.check-deploy-conditions.outputs.should_deploy != 'false' | |
| runs-on: ubuntu-latest | |
| environment: Website Production | |
| timeout-minutes: 22 | |
| outputs: | |
| deployment_status: ${{ steps.deploy.outputs.status }} | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "lts/*" | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v1 | |
| with: | |
| bun-version: "latest" | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.x' | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| with: | |
| enable-cache: true | |
| - name: Install dependencies | |
| run: bun install | |
| - name: Run security audit | |
| run: npm audit signatures | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-east-2 | |
| - name: Deploy to production | |
| id: deploy | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_DEFAULT_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_DEFAULT_ACCOUNT_ID }} | |
| CLOUDFLARE_EMAIL: ${{ secrets.CLOUDFLARE_EMAIL }} | |
| run: | | |
| start_time=$(date +%s) | |
| bun sst unlock --stage production | |
| if bun run sst deploy --stage production; then | |
| status="success" | |
| else | |
| status="failure" | |
| fi | |
| end_time=$(date +%s) | |
| duration=$((end_time - start_time)) | |
| echo "status=$status" >> $GITHUB_OUTPUT | |
| echo "duration=$((duration / 60))m $((duration % 60))s" >> $GITHUB_OUTPUT | |
| - name: Fail the job if deployment failed | |
| if: steps.deploy.outputs.status == 'failure' | |
| run: exit 1 |