diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 00000000..15f9114e --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,22 @@ + + +## Summary + + + +## Changes and value + + + +## Ticket + + diff --git a/.github/renovate.json b/.github/renovate.json index 38bd081a..5778715b 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -1,6 +1,7 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "enabledManagers": ["npm", "custom.regex", "terraform"], + "enabledManagers": ["npm", "custom.regex", "terraform", "github-actions"], + "schedule": ["before 6am every weekday"], "minimumReleaseAge": "3 days", "internalChecksFilter": "strict", "customManagers": [ @@ -14,6 +15,17 @@ "datasourceTemplate": "npm", "depNameTemplate": "@playwright/test", "versioningTemplate": "npm" + }, + { + "customType": "regex", + "description": [ + "actionlint release installed by the governance job; its SHA256 pin must be updated by hand, so this only surfaces the update on the dashboard" + ], + "managerFilePatterns": ["/^\\.github/workflows/ci\\.ya?ml$/"], + "matchStrings": ["ACTIONLINT_VERSION: \"(?\\d+\\.\\d+\\.\\d+)\""], + "datasourceTemplate": "github-releases", + "depNameTemplate": "rhysd/actionlint", + "extractVersionTemplate": "^v(?.*)$" } ], "packageRules": [ @@ -36,6 +48,13 @@ "dependencyDashboardApproval": true, "groupName": "playwright" }, + { + "description": [ + "Do not open actionlint PRs until approved; the SHA256 pin in ci.yaml has to change with the version" + ], + "matchPackageNames": ["rhysd/actionlint"], + "dependencyDashboardApproval": true + }, { "description": ["Keep MUI packages together"], "matchPackageNames": ["@mui/**"], diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 8a49b667..1b9935e3 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -2,37 +2,122 @@ name: Frontend checks on: pull_request: - branches: [main, dev, staging] + branches: [main, dev] + # The merge queue builds main plus the queued pull requests on a temporary + # branch and only counts checks that ran on the merge_group event. + merge_group: push: - branches: [main, dev, staging] + branches: [main] workflow_dispatch: {} permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + jobs: - build-and-test: - name: Build and test - # Org reusable workflow (Node 24): format check, lint, build, unit tests. - uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8 - with: - node-version: "24" + static: + name: static + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: "24" + cache: npm + - run: npm ci + - run: npm run format:check + - run: npm run lint + + build: + name: build + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: "24" + cache: npm + - run: npm ci + - run: npm run build + + unit: + name: unit + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + shard: [1, 2, 3, 4] + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: "24" + cache: npm + - run: npm ci + - run: npm test -- --shard=${{ matrix.shard }}/4 + + visual: + name: Visual regression + runs-on: ubuntu-latest + container: mcr.microsoft.com/playwright:v1.61.1-noble + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: "24" + cache: npm + - run: npm ci + - run: npm run test:e2e:visual + - name: Upload visual diff artifacts + if: failure() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: visual-regression-diffs + path: | + test-results/visual + playwright-report-visual + if-no-files-found: ignore + retention-days: 14 + + browser-smoke: + name: browser-smoke + runs-on: ubuntu-latest + container: mcr.microsoft.com/playwright:v1.61.1-noble + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: "24" + cache: npm + - run: npm ci + - run: npm run test:e2e + - name: Upload smoke artifacts + if: failure() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: browser-smoke-artifacts + path: | + test-results + playwright-report + if-no-files-found: ignore + retention-days: 14 governance: - # Repo-owned guarantee that every frontend quality gate runs from this - # repository, independent of (and in addition to) the reusable workflow. - # `npm run verify` is the single command that chains: format check, lint - # (--max-warnings=0), type-check + build, unit tests, then the governance - # checks in scripts/governance-check.mjs (godfile ratchet, changed-file - # maintainability gate, Terraform fmt/validate, Terraform import-plan and - # release-plan guards, isolation tests, HCP run guard, CloudFront verify, - # and GitHub workflow shell). If the reusable workflow is later confirmed - # to run every gate, this job can be slimmed to `npm run governance`. + # Repo-owned gates: godfile ratchet, changed-file maintainability, + # Terraform fmt/validate, import-plan guard, HCP run guard, CloudFront + # verify, GitHub workflow shell, isolation classifier tests, and live G13 + # (pull_request, merge_group per queued PR, and local). Format, lint, build, + # and unit tests run + # in the parallel jobs above, not here. # # GOVERNANCE_BASE points the changed-file gate at the right diff: # PR -> the PR target branch (origin/) + # merge group -> the group's own base (github.event.merge_group.base_sha) # push-> the previous commit on the branch (github.event.before) - # manual -> dev, for exact-head recovery runs + # manual -> main, for exact-head recovery runs runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -45,14 +130,17 @@ jobs: EVENT_NAME: ${{ github.event_name }} EVENT_BEFORE: ${{ github.event.before }} PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} + MERGE_GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }} run: | set -euo pipefail if [[ "${EVENT_NAME}" == "pull_request" ]]; then base="${PR_BASE_SHA}" + elif [[ "${EVENT_NAME}" == "merge_group" && -n "${MERGE_GROUP_BASE_SHA}" ]]; then + base="${MERGE_GROUP_BASE_SHA}" elif [[ "${EVENT_NAME}" == "push" && -n "${EVENT_BEFORE}" && ! "${EVENT_BEFORE}" =~ ^0+$ ]]; then base="${EVENT_BEFORE}" else - base="origin/dev" + base="origin/main" fi printf 'base=%s\n' "${base}" >> "${GITHUB_OUTPUT}" - name: Set up Terraform @@ -78,29 +166,29 @@ jobs: tar -xzf actionlint.tar.gz actionlint sudo mv actionlint /usr/local/bin/actionlint - run: npm ci - - run: npm run verify + - run: npm run governance env: GOVERNANCE_BASE: ${{ steps.governance-ref.outputs.base }} - visual-regression: - name: Visual regression + ci-complete: + name: ci-complete + if: always() + needs: [static, build, unit, visual, browser-smoke, governance] runs-on: ubuntu-latest - container: mcr.microsoft.com/playwright:v1.61.1-noble steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: "24" - cache: npm - - run: npm ci - - run: npm run test:e2e:visual - - name: Upload visual diff artifacts - if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: visual-regression-diffs - path: | - test-results/visual - playwright-report-visual - if-no-files-found: ignore - retention-days: 14 + - name: All required jobs passed + shell: bash + env: + RESULTS: ${{ join(needs.*.result, ' ') }} + run: | + set -euo pipefail + failed=0 + for result in ${RESULTS}; do + if [[ "${result}" != "success" ]]; then + failed=1 + fi + done + if [[ "${failed}" -ne 0 ]]; then + echo "Required jobs did not all succeed: ${RESULTS}" + exit 1 + fi diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml deleted file mode 100644 index c00f749e..00000000 --- a/.github/workflows/deploy-staging.yml +++ /dev/null @@ -1,148 +0,0 @@ -name: Deploy staging - -# Standalone staging deployment (push to `staging` / manual dispatch), NOT a -# caller of the org reusable `cd-cdk.yaml` (that path is dev-only): staging -# trusts the exact GitHub-environment OIDC subject, which requires the deploy -# job to declare `environment: staging` and run in this repo, with the -# non-secret role ARN pinned below (created by the staging stack itself). -# -# Order is fixed: full `npm run verify` gates run BEFORE any deploy step. -# No secrets are used — OIDC + the static role ARN are the only credentials. - -on: - push: - branches: [staging] - workflow_dispatch: {} - -permissions: - id-token: write - contents: read - -concurrency: - group: deploy-staging - cancel-in-progress: false - -jobs: - deploy: - name: Deploy to staging - # Deploy only the exact staging branch ref, never a tag or other ref - # (workflow_dispatch can be invoked from arbitrary refs). - if: github.ref == 'refs/heads/staging' - runs-on: ubuntu-latest - environment: staging - env: - VITE_API_URL: https://api.staging.seahaven.com/api - VITE_SENTRY_ENVIRONMENT: staging - VITE_APP_COMMIT_SHA: ${{ github.sha }} - AWS_REGION: us-east-1 - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 - - name: Resolve governance comparison ref - id: governance-ref - shell: bash - env: - EVENT_NAME: ${{ github.event_name }} - EVENT_BEFORE: ${{ github.event.before }} - run: | - set -euo pipefail - if [[ "${EVENT_NAME}" == "push" && -n "${EVENT_BEFORE}" && ! "${EVENT_BEFORE}" =~ ^0+$ ]]; then - base="${EVENT_BEFORE}" - else - base="origin/dev" - fi - printf 'base=%s\n' "${base}" >> "${GITHUB_OUTPUT}" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: "24" - cache: npm - # Node 24 bundles npm 11 (lockfileVersion 3); the packageManager pin - # (npm@11.16.0) matches this CI environment. - - name: Quality gates (full verify before any deploy) - run: npm ci && npm run verify - env: - GOVERNANCE_BASE: ${{ steps.governance-ref.outputs.base }} - - - name: Assume staging deploy role (OIDC) - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 - with: - role-to-assume: arn:aws:iam::396287094661:role/githubdeploy-shoc-frontend-new-staging - aws-region: us-east-1 - - # Builds the SPA with the staging VITE_API_URL and Sentry environment - # label (process env overrides the dev values committed in - # .env.production), syncs to the staging bucket, and invalidates - # CloudFront. - - name: Build and publish SPA - run: bash scripts/deploy-web.sh - env: - STACK_NAME: shoc-frontend-staging - WAIT_FOR_INVALIDATION: "true" - - - name: Upload private source maps - run: bash scripts/upload-sourcemaps.sh - env: - SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} - - - name: Verify deployment - run: | - set -euo pipefail - stack_output() { - aws cloudformation describe-stacks \ - --stack-name shoc-frontend-staging \ - --query "Stacks[0].Outputs[?OutputKey=='$1'].OutputValue" \ - --output text - } - BUCKET="$(stack_output BucketName)" - DIST_ID="$(stack_output DistributionId)" - DIST_DOMAIN="$(stack_output DistributionDomainName)" - SITE_URL="$(stack_output SiteUrl)" - if [[ -z "${BUCKET}" || "${BUCKET}" == "None" || -z "${DIST_ID}" || "${DIST_ID}" == "None" || -z "${DIST_DOMAIN}" || "${DIST_DOMAIN}" == "None" ]]; then - echo "::error::Could not resolve bucket/distribution from stack outputs." >&2 - exit 1 - fi - echo "Bucket=${BUCKET} Distribution=${DIST_ID} (${DIST_DOMAIN}) SiteUrl=${SITE_URL}" - - aws s3api head-bucket --bucket "${BUCKET}" - echo "Bucket exists." - # The distribution is proven to exist and serve by the HTTPS check - # below: the custom domain is an alias to this distribution, and the - # deploy role deliberately carries no cloudfront:GetDistribution - # (least privilege; the dev template is shared and must not drift). - - if grep -Rq "api.dev.seahaven.com" dist/; then - echo "::error::Built assets contain the dev API URL (api.dev.seahaven.com)." >&2 - grep -Rl "api.dev.seahaven.com" dist/ >&2 || true - exit 1 - fi - echo "Built assets carry no dev API URL." - grep -Rq "api.staging.seahaven.com" dist/ - echo "Built assets reference the staging API URL." - - # Verify the actual post-invalidation HTML and its referenced assets, - # not only the local build or a generic endpoint response. - remote_dir="$(mktemp -d)" - trap 'rm -rf "${remote_dir}"' EXIT - for i in 1 2 3 4 5 6; do - if curl -fsS --max-time 30 "${SITE_URL}" -o "${remote_dir}/index.html"; then - break - fi - echo "Endpoint not ready (attempt ${i}); retrying in 20s..." - sleep 20 - done - test -s "${remote_dir}/index.html" - grep -oE '(src|href)="/assets/[^"]+\.(js|css)"' "${remote_dir}/index.html" \ - | sed -E 's/^(src|href)="([^"]+)"$/\2/' \ - | sort -u > "${remote_dir}/asset-paths.txt" - test -s "${remote_dir}/asset-paths.txt" - while IFS= read -r asset_path; do - curl -fsS --max-time 30 "${SITE_URL%/}${asset_path}" \ - >> "${remote_dir}/assets.txt" - done < "${remote_dir}/asset-paths.txt" - if grep -q "api.dev.seahaven.com" "${remote_dir}/assets.txt"; then - echo "::error::Deployed assets contain the dev API URL." >&2 - exit 1 - fi - grep -q "api.staging.seahaven.com" "${remote_dir}/assets.txt" - echo "Deployed staging assets reference only the staging API URL." diff --git a/.github/workflows/deploy-web.yaml b/.github/workflows/deploy-web.yaml new file mode 100644 index 00000000..1bf4c7a2 --- /dev/null +++ b/.github/workflows/deploy-web.yaml @@ -0,0 +1,316 @@ +name: Deploy Web + +# SPA CD. GitHub Actions builds dist/ and syncs it to the S3 origin bucket +# root, then invalidates CloudFront. Terraform owns the bucket and the +# distribution and never touches content. +# +# push to main -> dev, at github.sha +# release: published -> staging, at vX.Y.Z-staging (must be on main) +# workflow_dispatch -> chosen environment at a chosen ref +# +# Releases are cut by a human with +# `gh release create vX.Y.Z-staging --target main --generate-notes`. +# A workflow cannot do it: releases created with GITHUB_TOKEN do not fire +# `release: published`. Core vX.Y.Z waits until a prod distribution exists. +# +# Bucket and distribution come from SSM after assuming the Environment's +# DEPLOY_ROLE_ARN. Nothing here creates an HCP run. Quality gates live in CI. +# +# The SPA checkout is the resolved content ref. Deploy scripts are copied +# from github.workflow_sha so workflow_dispatch of an older SHA still runs +# the current upload/verify path. + +on: + push: + branches: [main] + paths-ignore: + - "terraform/**" + - "docs/**" + - "**/*.md" + - ".github/workflows/ci.yaml" + - ".github/workflows/deploy-web.yaml" + release: + types: [published] + workflow_dispatch: + inputs: + environment: + description: "Target Environment" + required: true + type: choice + options: [dev, staging] + ref: + description: "Git ref to build and deploy (tag, branch, or SHA). Empty means the workflow ref." + required: false + type: string + default: "" + +permissions: + contents: read + +jobs: + target: + name: Resolve target + runs-on: ubuntu-latest + timeout-minutes: 5 + outputs: + environment: ${{ steps.resolve.outputs.environment }} + ref: ${{ steps.resolve.outputs.ref }} + steps: + - id: resolve + env: + EVENT_NAME: ${{ github.event_name }} + GITHUB_REF_NAME_IN: ${{ github.ref }} + GITHUB_SHA_IN: ${{ github.sha }} + RELEASE_TAG: ${{ github.event.release.tag_name }} + REPO: ${{ github.repository }} + GH_TOKEN: ${{ github.token }} + INPUT_ENVIRONMENT: ${{ inputs.environment }} + INPUT_REF: ${{ inputs.ref }} + run: | + set -euo pipefail + case "${EVENT_NAME}" in + push) + if [ "${GITHUB_REF_NAME_IN}" != "refs/heads/main" ]; then + echo "push deploys only run from main" >&2 + exit 1 + fi + environment=dev + ref="${GITHUB_SHA_IN}" + ;; + release) + if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-staging$ ]]; then + echo "release tag ${RELEASE_TAG} is not vX.Y.Z-staging; refusing until a prod distribution exists." >&2 + exit 1 + fi + environment=staging + ref="${RELEASE_TAG}" + status="$(gh api "repos/${REPO}/compare/main...${RELEASE_TAG}" --jq .status)" + if [ "${status}" != "behind" ] && [ "${status}" != "identical" ]; then + echo "release tag ${RELEASE_TAG} is not on main (compare status: ${status})" >&2 + exit 1 + fi + ;; + workflow_dispatch) + environment="${INPUT_ENVIRONMENT}" + ref="${INPUT_REF:-${GITHUB_SHA_IN}}" + ;; + *) + echo "unsupported event ${EVENT_NAME}" >&2 + exit 1 + ;; + esac + { + echo "environment=${environment}" + echo "ref=${ref}" + } >> "${GITHUB_OUTPUT}" + echo "Deploying ${ref} to ${environment}" + + deploy: + name: Deploy SPA to ${{ needs.target.outputs.environment }} + needs: target + runs-on: ubuntu-latest + timeout-minutes: 45 + environment: ${{ needs.target.outputs.environment }} + concurrency: + group: deploy-web-${{ needs.target.outputs.environment }} + cancel-in-progress: false + permissions: + contents: read + id-token: write + env: + AWS_REGION: us-east-1 + DEPLOY_ROLE_ARN: ${{ vars.DEPLOY_ROLE_ARN }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ needs.target.outputs.ref }} + persist-credentials: false + + - name: Resolve commit + id: commit + run: | + set -euo pipefail + sha="$(git rev-parse HEAD)" + echo "sha=${sha}" >> "${GITHUB_OUTPUT}" + echo "Building ${sha}" + + - name: Checkout workflow deploy scripts + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.workflow_sha }} + persist-credentials: false + sparse-checkout: | + scripts + sparse-checkout-cone-mode: true + path: .workflow-scripts + + - name: Install workflow deploy scripts + run: | + set -euo pipefail + test -f .workflow-scripts/scripts/upload-sourcemaps.sh + test -f .workflow-scripts/scripts/verify-cloudfront-release.sh + test -f .workflow-scripts/scripts/summarize-cloudfront-live-state.sh + mkdir -p scripts + cp .workflow-scripts/scripts/upload-sourcemaps.sh scripts/ + cp .workflow-scripts/scripts/verify-cloudfront-release.sh scripts/ + cp .workflow-scripts/scripts/summarize-cloudfront-live-state.sh scripts/ + + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: "24" + cache: npm + + - name: Build SPA + env: + TARGET_ENVIRONMENT: ${{ needs.target.outputs.environment }} + VITE_APP_COMMIT_SHA: ${{ steps.commit.outputs.sha }} + VITE_SENTRY_DSN: ${{ vars.VITE_SENTRY_DSN }} + VITE_SENTRY_ENVIRONMENT: ${{ needs.target.outputs.environment }} + VITE_SENTRY_RELEASE: ${{ steps.commit.outputs.sha }} + run: | + set -euo pipefail + # vars.VITE_SENTRY_DSN is unset today. An empty env value would + # override .env.production and disable Sentry (Vite does not let + # .env overwrite an existing variable). + if [ -n "${VITE_SENTRY_DSN:-}" ]; then + export VITE_SENTRY_DSN + else + unset VITE_SENTRY_DSN + fi + case "${TARGET_ENVIRONMENT}" in + dev) + export VITE_API_URL="https://api.dev.seahaven.com/api" + forbidden="api.staging.seahaven.com" + required="api.dev.seahaven.com" + ;; + staging) + export VITE_API_URL="https://api.staging.seahaven.com/api" + forbidden="api.dev.seahaven.com" + required="api.staging.seahaven.com" + ;; + *) + echo "unsupported environment ${TARGET_ENVIRONMENT}" >&2 + exit 1 + ;; + esac + npm ci + npm run build + test -f dist/index.html + if grep -Rq "${forbidden}" dist/; then + echo "Built assets contain the forbidden URL ${forbidden}." >&2 + exit 1 + fi + if grep -Rq "localhost:5141" dist/; then + echo "Built assets contain the Vite proxy target localhost:5141." >&2 + exit 1 + fi + grep -Rq "${required}" dist/ + index_sha="$(python3 -c 'import hashlib,pathlib; print(hashlib.sha256(pathlib.Path("dist/index.html").read_bytes()).hexdigest())')" + echo "INDEX_SHA256=${index_sha}" >> "${GITHUB_ENV}" + echo "VITE_API_URL=${VITE_API_URL}" >> "${GITHUB_ENV}" + echo "dist/index.html sha256=${index_sha}" + + - name: Upload private source maps + run: bash scripts/upload-sourcemaps.sh + env: + SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} + VITE_APP_COMMIT_SHA: ${{ steps.commit.outputs.sha }} + + - name: Strip source maps from dist/ + run: | + set -euo pipefail + find dist -name '*.map' -delete + if find dist -name '*.map' | grep -q .; then + echo "SPA source maps must not ship in dist/" >&2 + exit 1 + fi + + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: spa-dist-${{ needs.target.outputs.environment }}-${{ steps.commit.outputs.sha }} + path: dist/ + if-no-files-found: error + retention-days: 7 + + - name: Configure AWS credentials using OIDC + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + with: + role-to-assume: ${{ env.DEPLOY_ROLE_ARN }} + aws-region: us-east-1 + audience: sts.amazonaws.com + + - name: Get deploy parameters + id: deploy + env: + TARGET_ENVIRONMENT: ${{ needs.target.outputs.environment }} + run: | + set -euo pipefail + prefix="/shoc-frontend-new/${TARGET_ENVIRONMENT}/deploy" + BUCKET=$(aws ssm get-parameter --name "${prefix}/bucket" --query Parameter.Value --output text) + DIST_ID=$(aws ssm get-parameter --name "${prefix}/distribution-id" --query Parameter.Value --output text) + DOMAIN=$(aws cloudfront get-distribution --id "${DIST_ID}" --query Distribution.DomainName --output text) + # Refuse to touch the bucket until Terraform has moved every origin + # to the bucket root. The previous CD pointed origins at + # /releases/