deploy-production.yaml

name: Deploy to Production

on:
  workflow_dispatch:
  repository_dispatch:
    types: [republish-docs] # Triggered from the dea-notebooks repo
  push:
    branches: [main]

permissions:
  id-token: write # For requesting the JWT used by OIDC Authentication

jobs:
  publish:
    name: Publish
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.11"]
        node-version: [18.x]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: true

      - name: Install Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install requirements
        run: ./install-production.sh

      - name: Build site
        env:
          BUILD_MODE: production
        run: ./build-production.sh

      - name: Configure AWS credentials via OIDC
        if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: arn:aws:iam::538673716275:role/github-actions-dea-docs
          aws-region: ap-southeast-2

      - name: Deploy site
        if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
        env:
          DISTRIBUTION_ID: ${{ secrets.DISTRIBUTION_ID }}
        run: ./deploy-production.sh