deploy.yml

name: deploy
on:
  push:
    branches:
      - master
concurrency:
  group: ${{ github.workflow }}
jobs:
  deploy-cdk-stack:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Allows JWT to be requested from GitHub's OIDC provider.
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - id: cache
        uses: actions/cache@v4
        with:
          # Use contents of Mamba environment file, NPM lock file and Poetry lock file as cache key.
          key: ${{ hashFiles('environment.yml', 'package-lock.json', 'poetry.lock') }}
          # Cache micromamba binary, environments and pipx installs.
          path: |
            ./bin/micromamba
            ~/micromamba/envs
            ~/.local/pipx
      - if: steps.cache.outputs.cache-hit != 'true'
        run: |
          # Install micromamba.
          wget -qO- https://micro.mamba.pm/api/micromamba/linux-64/latest | tar -xvj bin/micromamba


          # Install Poetry.
          pipx install poetry~=1.8

          # Create Mamba environment.
          export MAMBA_ROOT_PREFIX=~/micromamba
          eval "$(./bin/micromamba shell hook -s posix)"
          micromamba create --file environment.yml --yes
          micromamba activate brodie.id.au

          # Install Python package dependencies.
          poetry install
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::961672313229:role/Account-GithubOidcRole20798CD3-LZP3AHTIPJU2
          aws-region: ap-southeast-2
      - run: |
          export MAMBA_ROOT_PREFIX=~/micromamba
          eval "$(./bin/micromamba shell hook -s posix)"
          micromamba activate brodie.id.au

          # Set timezone so that Sphinx uses local dates.
          sudo timedatectl set-timezone Australia/Queensland

          # Build Sphinx website.
          sphinx-build --builder html brodie.id.au _build

          # Install Node.js package dependencies.
          npm ci

          # Show CDK stack diff.
          npx cdk diff

          # Deploy CDK stack.
          npx cdk deploy --require-approval never