frontend.yml

name: Deploy Frontend

on:
  push:
    branches: [ 'production' ]

  workflow_dispatch:

permissions:
  id-token: write   # This is required for requesting the JWT
  contents: read    # This is required for actions/checkout

env:
  AWS_REGION: ap-southeast-1
  S3_BUCKET_NAME: app.peerprep.org

jobs:
  deploy:
    name: Deploy Frontend
    runs-on: ubuntu-latest
    environment: production

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        id: aws-configure
        uses: aws-actions/configure-aws-credentials@v4.0.2
        with:
          role-to-assume: ${{ secrets.AWS_FRONTEND_ROLE }}
          role-session-name: GitHub_to_AWS_via_FederatedOIDC
          aws-region: ${{ env.AWS_REGION }}

      - name: Build frontend distribution
        working-directory: frontend
        run: npm ci && npm run build

      - name: Sync distribution to S3
        run: |
          aws s3 sync ./frontend/dist/frontend/browser/ s3://$S3_BUCKET_NAME --delete

      - name: Invalidate Cloudfront Cache
        run: |
          aws cloudfront create-invalidation --distribution-id ${{ secrets.AWS_CLOUDFRONT_ID }} --paths "/*"