cd.yml

name: Continuous Delivery


on:
  push:
    branches:
      - main


permissions:
  id-token: write
  contents: read


jobs:

  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    steps:

      - uses: actions/checkout@v4

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_FOR_DEPLOY }}
          aws-region: us-east-1

      - uses: hashicorp/setup-terraform@v3

      - uses: actions/setup-python@v5
        with:
          python-version-file: ./backend/.python-version

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true
          cache-dependency-glob: ./backend/uv.lock

      - uses: actions/setup-node@v4
        with:
          node-version-file: ./ui/package.json
          cache: npm
          cache-dependency-path: ./ui/package-lock.json

      - working-directory: ./backend/
        run: uv run build.py

      - working-directory: ./ui/
        run: npm ci

      - working-directory: ./ui/
        run: npm run build

      - working-directory: ./iac/
        run: terraform init -backend-config="key=terraform_state_gsa_dev.tfstate"

      - working-directory: ./iac/
        run: terraform apply -auto-approve -var 'environment=${{ vars.ENVIRONMENT }}'

      - name: Extract Terraform Output
        working-directory: ./iac/
        id: terraformOutput
        run: |
          distribution_id=$(terraform output -raw distribution_id)
          echo "distribution_id=$distribution_id" >> $GITHUB_OUTPUT

      - name: Invalidate Cloudfront Distribution
        run: |
          INVALIDATION_ID=$(aws cloudfront create-invalidation --distribution-id ${{ steps.terraformOutput.outputs.distribution_id }} --paths "/*" --query 'Invalidation.Id' --output text)
          aws cloudfront wait invalidation-completed --distribution-id ${{ steps.terraformOutput.outputs.distribution_id }} --id $INVALIDATION_ID