deploy-s3-cloudfront.yml

name: Build and Deploy

on:
  pull_request:
  push:
    paths:
    - '.github/workflows/deploy-s3-cloudfront.yml'
    - 'assets/**'
    - 'config.toml'
    - 'content/**'
    - 'layouts/**'
    - 'resources/**'
    - 'static/**'

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repo
      uses: actions/checkout@v2

    - name: Setup Hugo
      uses: peaceiris/actions-hugo@v2
      with:
        hugo-version: 'latest'
        extended: true

    - name: Hugo build
      run: hugo --minify

    - name: Upload build result
      # No need to upload if we won't deploy.
      if: github.ref == 'refs/heads/master' && github.event_name == 'push'
      uses: actions/upload-artifact@v2
      with:
        name: build-output
        path: public

  deploy-to-s3:
    name: Deploy to S3
    runs-on: ubuntu-latest
    needs: build
    # References to the env context aren't supported here, so copy-paste from
    # the upload step.
    if: github.ref == 'refs/heads/master' && github.event_name == 'push'
    steps:
    - name: Download build result
      uses: actions/download-artifact@v3
      with:
        name: build-output
        path: public

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v1-node16
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1

    - name: Upload to S3
      run: aws s3 sync --delete public s3://ravron.com

    - name: Set S3 cache-control
      run: |
        # Sets all css, jpg, and png files to have aggressive caching
        aws s3 cp --recursive \
        --exclude '*' --include '*.css' --include '*.jpg' --include '*.png' \
        --cache-control 'public,max-age=31536000,immutable' \
        s3://ravron.com/ s3://ravron.com

  invalidate-cloudfront:
    name: Invalidate CloudFront
    runs-on: ubuntu-latest
    needs: deploy-to-s3
    steps:
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v1-node16
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1

    - name: Invalidate CloudFront
      run: |
        aws cloudfront create-invalidation \
          --distribution-id E3UK5EPKDEOBYZ \
          --paths '/*'