build.yml

name: build

on:
  push:
    branches: [ main, deploy ]
    paths-ignore:
      - '**/*.gitattributes'
      - '**/*.gitignore'
  pull_request:
    branches: [ main ]
  workflow_dispatch:

env:
  FORCE_COLOR: 3
  TERM: xterm

permissions:
  contents: read

jobs:

  build:
    runs-on: ubuntu-latest

    steps:

    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: 3.3

    - name: Update file timestamps
      shell: bash
      run: |
        git ls-files | xargs -I{} git log -1 --date=format:%Y%m%d%H%M.%S --format='touch -t %ad "{}"' "{}" | $SHELL

    - name: Build blog
      shell: pwsh
      run: |
        bundler config path vendor/bundle
        bundler install
        ./build.ps1

    - name: Publish blog
      uses: actions/upload-artifact@v4
      with:
        name: blog
        path: ./build
        if-no-files-found: error

  lint:
    runs-on: ubuntu-latest

    steps:

    - name: Checkout code
      uses: actions/checkout@v4

    - name: Add actionlint problem matcher
      run: echo "::add-matcher::.github/actionlint-matcher.json"

    - name: Lint workflows
      uses: docker://rhysd/actionlint@sha256:7617f05bd698cd2f1c3aedc05bc733ccec92cca0738f3e8722c32c5b42c70ae6 # v1.7.3
      with:
        args: -color

    - name: Lint markdown
      uses: DavidAnson/markdownlint-cli2-action@v17
      with:
        config: '.markdownlint.json'
        globs: |
          **/*.md

  deploy:
    if: github.event.repository.fork == false && github.ref_name == 'deploy'
    runs-on: ubuntu-latest
    needs: [ build, lint ]

    environment:
      name: production
      url: https://blog.martincostello.com

    permissions:
      id-token: write

    steps:

    - name: Download blog
      uses: actions/download-artifact@v4
      with:
        name: blog
        path: ./build

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.AWS_DEPLOYMENT_ROLE }}
        role-session-name: ${{ github.event.repository.name }}-${{ github.run_id }}-deploy
        aws-region: eu-west-2

    - name: Deploy to S3
      run: aws s3 sync ./build/ s3://blog.martincostello.com --cache-control 'max-age=604800' --delete

    - name: Create CloudFront invalidation
      shell: pwsh
      env:
        DISTRIBUTION_ID: ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }}
      run: |
        $invalidationId = aws cloudfront create-invalidation --distribution-id "${env:DISTRIBUTION_ID}" --paths "/*" --output text --query "Invalidation.Id"
        aws cloudfront wait invalidation-completed --distribution-id "${env:DISTRIBUTION_ID}" --id $invalidationId