deploy-aws.yml

name: Deploy to AWS (S3 + CloudFront)

on:
  push:
    paths:
      - 'src/**'
      - 'index.html'

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20'
        cache: 'npm'

    - name: Install dependencies
      run: npm install

    - name: Fix permissions for Vite
      run: chmod +x ./node_modules/.bin/vite

    - name: Build project
      run: npm run build
      env:
        VITE_API_BASE_URL: ${{ secrets.VITE_API_BASE_URL }}
        VITE_AUTH0_DOMAIN: ${{ secrets.VITE_AUTH0_DOMAIN }}
        VITE_AUTH0_CLIENT_ID: ${{ secrets.VITE_AUTH0_CLIENT_ID }}
        VITE_AUTH0_AUDIENCE: ${{ secrets.VITE_AUTH0_AUDIENCE }}

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: ${{ secrets.AWS_REGION }}

    # Upload index.html with no-cache so new deploys show immediately
    - name: Upload index.html (no-cache)
      run: |
        aws s3 cp dist/index.html s3://${{ secrets.S3_BUCKET }}/index.html \
          --cache-control "no-cache, no-store, must-revalidate" \
          --content-type "text/html"

    # Upload everything else with long cache (hashed assets)
    - name: Sync assets (immutable)
      run: |
        aws s3 sync dist/ s3://${{ secrets.S3_BUCKET }} \
          --exclude "index.html" \
          --cache-control "public, max-age=31536000, immutable" \
          --delete

    - name: Invalidate CloudFront
      run: |
        aws cloudfront create-invalidation \
          --distribution-id ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }} \
          --paths "/*"