build-and-deploy-app.yml

name: 'Build and deploy an app'

on:
  workflow_call:
    inputs:
      app-name:
        required: true
        type: string
        description: The app to build/deploy
      branch-or-tag:
        required: true
        type: string
        description: The branch or tag to deploy
      bucket-name:
        required: true
        type: string
        description: The bucket to deploy to
      cfdist-id:
        required: true
        type: string
        description: The distribution to invalidate
      deployment-role-arn:
        required: true
        type: string
        description: The IAM role used to deploy

jobs:
  build-and-deploy:
    name: build-and-deploy
    runs-on: ubuntu-latest
    # Allow OIDC Integration (so we can assume the AWS role to deploy)
    permissions:
      id-token: write
      contents: read
    steps:
      # checkout and build
      - name: checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.branch-or-tag }}
      - uses: ./.github/actions/pnpm-setup-action
      - name: build
        run: pnpm nx run ${{ inputs.app-name }}:build
      - name: Assume AWS Role
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ inputs.deployment-role-arn }}
          role-session-name: GitHubActions-${{ github.repository_owner }}-${{ github.event.repository.name }}-${{ github.run_id }}
          role-duration-seconds: 1200
      - name: deploy
        run: |
          aws s3 sync ./apps/${{ inputs.app-name }}/build s3://${{ inputs.bucket-name }}/ --delete
          aws cloudfront create-invalidation --distribution-id ${{ inputs.cfdist-id }} --paths '/*'