deploy.yml

name: Deploy Site

on:
  push:
    branches:
      - master
    paths-ignore:
      - 'infra/**'
      - '*.md'
      - 'LICENSE.txt'
      - '.gitignore'

permissions:
  id-token: write
  contents: read

concurrency:
  group: deploy-production
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1

      - name: Sync all files to S3
        run: |
          aws s3 sync . s3://${{ secrets.S3_BUCKET_NAME }} \
            --delete \
            --exclude ".git/*" \
            --exclude ".github/*" \
            --exclude ".claude/*" \
            --exclude "README.*" \
            --exclude "LICENSE.txt" \
            --exclude "infra/*" \
            --exclude "*.md" \
            --exclude ".gitignore" \
            --cache-control "public, max-age=1800"

      - name: Set short cache on HTML files
        run: |
          aws s3 cp s3://${{ secrets.S3_BUCKET_NAME }}/ s3://${{ secrets.S3_BUCKET_NAME }}/ \
            --recursive \
            --exclude "*" \
            --include "*.html" \
            --metadata-directive REPLACE \
            --cache-control "public, max-age=120" \
            --content-type "text/html; charset=utf-8"

      - name: Invalidate CloudFront cache
        run: |
          aws cloudfront create-invalidation \
            --distribution-id ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }} \
            --paths "/*"