ReviewOS

also looking at this

stacks/bunpress

fix(ci): deploy with encrypted production env

#82
Merged chrisbbreuer wants to merge agent/oidc-encrypted-production-env into main
6 files +89 -16
.github/workflows/ci.ymlmodified+25-16
Changes to .github/workflows/ci.yml
@@ -112,13 +112,12 @@ jobs:
112112 needs: [lint, typecheck, test]
113113 if: github.event_name == 'push' && github.ref == 'refs/heads/main'
114114 runs-on: ubuntu-latest
115 permissions:
116 contents: read
117 id-token: write
115118 concurrency:
116119 group: bunpress-org-production
117120 cancel-in-progress: false
118 env:
119 AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
120 AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
121 AWS_DEFAULT_REGION: us-east-1
122121
123122 steps:
124123 - uses: actions/checkout@v6
@@ -133,6 +132,26 @@ jobs:
133132 - name: Install dependencies
134133 run: bun install --frozen-lockfile
135134
135 - name: Configure short-lived AWS credentials
136 uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
137 with:
138 aws-region: us-east-1
139 role-to-assume: arn:aws:iam::923076644019:role/github-actions-bunpress-deploy
140
141 - name: Load encrypted production environment
142 shell: bash
143 run: |
144 set -euo pipefail
145 trap 'rm -f .env.keys' EXIT
146
147 aws ssm get-parameter \
148 --name /bunpress/production/env-key \
149 --with-decryption \
150 --query Parameter.Value \
151 --output text > .env.keys
152 chmod 600 .env.keys
153 bun run env:production
154
136155 - name: Build documentation
137156 run: bun run build:docs
138157
@@ -141,19 +160,9 @@ jobs:
141160 run: |
142161 set -euo pipefail
143162
144 distribution_id="$(
145 aws cloudfront list-distributions --output json \
146 | jq -r '[.DistributionList.Items[] | select((.Aliases.Items // []) | index("bunpress.org")) | .Id][0] // empty'
147 )"
148
149 if [[ -z "$distribution_id" ]]; then
150 echo "Could not find the CloudFront distribution for bunpress.org." >&2
151 exit 1
152 fi
153
154 aws s3 sync dist/.bunpress s3://bunpress-org \
163 aws s3 sync "dist/.bunpress" "s3://${AWS_S3_BUCKET}" \
155164 --delete \
156165 --cache-control 'max-age=3600, public'
157166 aws cloudfront create-invalidation \
158 --distribution-id "$distribution_id" \
167 --distribution-id "$AWS_CLOUDFRONT_DISTRIBUTION_ID" \
159168 --paths '/*'