also looking at this
fix(ci): deploy with encrypted production env
#82
6 files
+89
-16
| @@ -112,13 +112,12 @@ jobs: | ||
| 112 | 112 | needs: [lint, typecheck, test] |
| 113 | 113 | if: github.event_name == 'push' && github.ref == 'refs/heads/main' |
| 114 | 114 | runs-on: ubuntu-latest |
| 115 | permissions: | |
| 116 | contents: read | |
| 117 | id-token: write | |
| 115 | 118 | concurrency: |
| 116 | 119 | group: bunpress-org-production |
| 117 | 120 | cancel-in-progress: false |
| 118 | env: | |
| 119 | AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| 120 | AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| 121 | AWS_DEFAULT_REGION: us-east-1 | |
| 122 | 121 | |
| 123 | 122 | steps: |
| 124 | 123 | - uses: actions/checkout@v6 |
| @@ -133,6 +132,26 @@ jobs: | ||
| 133 | 132 | - name: Install dependencies |
| 134 | 133 | run: bun install --frozen-lockfile |
| 135 | 134 | |
| 135 | - name: Configure short-lived AWS credentials | |
| 136 | uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 | |
| 137 | with: | |
| 138 | aws-region: us-east-1 | |
| 139 | role-to-assume: arn:aws:iam::923076644019:role/github-actions-bunpress-deploy | |
| 140 | ||
| 141 | - name: Load encrypted production environment | |
| 142 | shell: bash | |
| 143 | run: | | |
| 144 | set -euo pipefail | |
| 145 | trap 'rm -f .env.keys' EXIT | |
| 146 | ||
| 147 | aws ssm get-parameter \ | |
| 148 | --name /bunpress/production/env-key \ | |
| 149 | --with-decryption \ | |
| 150 | --query Parameter.Value \ | |
| 151 | --output text > .env.keys | |
| 152 | chmod 600 .env.keys | |
| 153 | bun run env:production | |
| 154 | ||
| 136 | 155 | - name: Build documentation |
| 137 | 156 | run: bun run build:docs |
| 138 | 157 | |
| @@ -141,19 +160,9 @@ jobs: | ||
| 141 | 160 | run: | |
| 142 | 161 | set -euo pipefail |
| 143 | 162 | |
| 144 | distribution_id="$( | |
| 145 | aws cloudfront list-distributions --output json \ | |
| 146 | | jq -r '[.DistributionList.Items[] | select((.Aliases.Items // []) | index("bunpress.org")) | .Id][0] // empty' | |
| 147 | )" | |
| 148 | ||
| 149 | if [[ -z "$distribution_id" ]]; then | |
| 150 | echo "Could not find the CloudFront distribution for bunpress.org." >&2 | |
| 151 | exit 1 | |
| 152 | fi | |
| 153 | ||
| 154 | aws s3 sync dist/.bunpress s3://bunpress-org \ | |
| 163 | aws s3 sync "dist/.bunpress" "s3://${AWS_S3_BUCKET}" \ | |
| 155 | 164 | --delete \ |
| 156 | 165 | --cache-control 'max-age=3600, public' |
| 157 | 166 | aws cloudfront create-invalidation \ |
| 158 | --distribution-id "$distribution_id" \ | |
| 167 | --distribution-id "$AWS_CLOUDFRONT_DISTRIBUTION_ID" \ | |
| 159 | 168 | --paths '/*' |