deploy.yml

name: Deploy

on:
  workflow_run:
    workflows: [CI]
    types: [completed]
    branches: [main]

permissions:
  contents: read

jobs:
  deploy:
    name: Build & Deploy
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Build design system
        run: npm run build -w packages/ui

      - name: Build
        run: npm run build

      - name: Deploy to S3
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          # Hashed assets: cache forever (filename changes on content change)
          aws s3 sync dist/assets/ s3://forkzero-web-prod/assets/ \
            --cache-control "public, max-age=31536000, immutable" \
            --delete

          # Static assets (images, SVGs, robots.txt, sitemap): cache 1 day
          aws s3 sync dist/ s3://forkzero-web-prod/ \
            --exclude "assets/*" \
            --exclude "*.html" \
            --cache-control "public, max-age=86400" \
            --delete

          # HTML pages: short cache, revalidate often
          aws s3 sync dist/ s3://forkzero-web-prod/ \
            --exclude "assets/*" \
            --include "*.html" \
            --cache-control "public, max-age=300, s-maxage=86400"

          # Invalidate CloudFront
          aws cloudfront create-invalidation \
            --distribution-id ${{ secrets.CF_DISTRIBUTION_ID }} \
            --paths "/*"