main.yml

name: Build and deploy main
on:
  push:
    branches:
      - main
jobs:
  ci:
    runs-on: ubuntu-latest
    environment: prod
    permissions:
      contents: 'read'
      id-token: 'write'
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            registry.npmjs.org:443
            sts.googleapis.com:443
            iamcredentials.googleapis.com:443
            storage.googleapis.com:443
            deploy.nav.cloud.nais.io:443
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          persist-credentials: false
      - name: Setup Node
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
        with:
          node-version: '22.x'
      - name: Install dependencies
        run: npm ci
      - name: Build
        run: npm run build
      - name: Upload to CDN
        uses: nais/deploy/actions/spa-deploy/v2@master
        with:
          team: security-champion-admin
          app: playbook
          environment: prod
          source: build
          ingress: https://sikkerhet.nav.no
          project_id: ${{ vars.NAIS_MANAGEMENT_PROJECT_ID }}
          identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}