release.yml

name: Deploy Hugo site

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  id-token: write
  contents: read
  pull-requests: write

defaults:
  run:
    shell: bash
  
jobs:
  deploy-infra:
    name: Deploy Terraform Infrastructure as Code
    runs-on: ubuntu-latest
    outputs:
      distribution: ${{ steps.terraform.outputs.DID }}
      bucket: ${{ steps.terraform.outputs.URL }}
      baseurl: ${{ steps.terraform.outputs.BASE }}

    defaults:
      run:
        working-directory: terraform/
  
    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume:  ${{ secrets.AWS_GITHUB_ACTIONS_ROLE }}
        aws-region: us-east-1

    - name: Generate token
      id: generate_token
      uses: tibdex/github-app-token@v2
      with:
        app_id: ${{ secrets.GH_APP_ID }}
        private_key: ${{ secrets.GH_PRIVATE_KEY }}
        installation_retrieval_mode: id
        installation_retrieval_payload: ${{ secrets.GH_INSTALLATION_ID }}

    - name: Terraform Format
      id: fmt
      run: terraform fmt -no-color -check
      continue-on-error: true

    - name: Terraform Init
      id: init
      run: terraform init -no-color
    
    - name: Terraform Validate
      id: validate
      run: terraform validate -no-color
    
    - name: Terraform Plan
      id: plan
      run: terraform plan -no-color

    - uses: actions/github-script@v7
      if: github.event_name == 'pull_request'
      env:
        PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
      with:
        github-token: ${{ steps.generate_token.outputs.token }}
        script: |
          // 1. Retrieve existing bot comments for the PR
          const { data: comments } = await github.rest.issues.listComments({
            owner: context.repo.owner,
            repo: context.repo.repo,
            issue_number: context.issue.number,
          })
          const botComment = comments.find(comment => {
            return comment.user.type === 'Bot' && comment.body.includes('Terraform Format and Style')
          })

          // 2. Prepare format of the comment
          const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
          #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
          #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
          <details><summary>Validation Output</summary>

          \`\`\`\n
          ${{ steps.validate.outputs.stdout }}
          \`\`\`

          </details>

          #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`

          <details><summary>Show Plan</summary>

          \`\`\`\n
          ${process.env.PLAN}
          \`\`\`

          </details>

          *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ env.tf_actions_working_dir }}\`, Workflow: \`${{ github.workflow }}\`*`;

          // 3. If we have a comment, update it, otherwise create a new one
          if (botComment) {
            github.rest.issues.updateComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: botComment.id,
              body: output
            })
          } else {
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })
          }

    - name: Terraform Plan Status
      if: steps.plan.outcome == 'failure'
      run: exit 1

    - name: Terraform Apply
      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
      run: terraform apply -no-color -auto-approve

    - name: Output Terraform values
      id: terraform
      run: |
        echo "DID=$(terraform output -raw cloudFrontDistributionID)" >> "$GITHUB_OUTPUT"
        echo "URL=$(terraform output -raw URL)" >> "$GITHUB_OUTPUT"
        echo "BASE=$(terraform output -raw hostname)" >> "$GITHUB_OUTPUT"

  build-hugo:
    name: Generate Hugo site
    runs-on: ubuntu-latest
    needs: deploy-infra

    env:
      HUGO_ENV: production
    
    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Setup node
      uses: actions/setup-node@v4
      with:
        node-version: 'lts/*'

    - run: npm ci

    - name: Setup Hugo
      uses: peaceiris/actions-hugo@v3
      with:
        hugo-version: '0.124.1'
        extended: true

    # - uses: actions/cache@v4
    #   with:
    #     path: ~/.cache/hugo_cache    # <-- with hugo version v0.116.0 and above
    #     key: ${{ runner.os }}-hugomod-${{ hashFiles('**/go.sum') }}
    #     restore-keys: |
    #       ${{ runner.os }}-hugomod-
      
    - name: Hugo Build
      run: hugo --gc --enableGitInfo --minify --baseURL https://${{ needs.deploy-infra.outputs.baseurl }}/

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.AWS_GITHUB_ACTIONS_ROLE }}
        aws-region: us-east-1

    - name: Assume IAM Role
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.AWS_TERRAFORM_DEPLOY_ROLE }}
        role-chaining: true
        aws-region: us-east-1

    - name: Update Hugo Deployment
      run: |
        sed -i "s@CLOUDFRONT_DISTRIBUTION_ID@${{ needs.deploy-infra.outputs.distribution }}@g" config/production/deployment.yaml
        sed -i "s@S3_BUCKET_URL@${{ needs.deploy-infra.outputs.bucket }}@g" config/production/deployment.yaml

    - name: Hugo Deploy (dry-run)
      if: github.event_name == 'pull_request'
      run: hugo deploy --dryRun --target AWS

    - name: Hugo Deploy
      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
      run: hugo deploy --maxDeletes -1 --target AWS --logLevel info