docs/.github/workflows/deploy.yml at main · bugsee/docs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
name: Build and Deploy

on:
  # Pull requests run the SAME checkout / install / spell-check / build steps as a
  # deploy, but stop before touching AWS. Without this the workflow only ran on
  # pushes to main, so a content PR could not be validated until AFTER it merged —
  # which is exactly how a spelling error reached main and broke the deploy.
  # Deliberately no paths-ignore here: validating a workflow or config change on the
  # PR is cheap and catches breakage before it can affect a deploy.
  pull_request:
  push:
    branches: [main]
    # Skip deploys for changes that can't affect the built site.
    # (workflow_dispatch below always deploys, regardless of paths.)
    paths-ignore:
      - '.github/**'
      - '.claude/**'
      - '.vscode/**'
      - 'README.md'
      - 'LICENSE'
      - '.gitignore'
  workflow_dispatch:

# Required for GitHub OIDC -> AWS IAM role assumption (no stored AWS keys).
# Unused on pull_request runs, where every AWS step is skipped.
permissions:
  id-token: write
  contents: read

concurrency:
  # github.ref is refs/pull/<n>/merge on a PR, so PR validation runs get their own
  # group and never cancel an in-flight deploy of main.
  group: deploy-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      # The agent skills under docs/ai/agent-skills/sdk are generated from bugsee/bugsee-for-ai
      # (see scripts/mirror-skills.mjs). Fail on hand edits to them.
      - name: Agent skills mirror (tests + no hand edits)
        run: |
          npm run test:mirror
          npm run check-skills

      - name: Spell check
        run: npx cspell "docs/**/*.md" "docs/**/*.mdx" --no-cache -c cspell.json

      - name: Build site
        run: |
          node scripts/sync-skills.mjs
          npm run build
          node scripts/copy-raw-markdown.mjs

      - name: Configure AWS credentials (OIDC)
        if: github.event_name != 'pull_request'
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: Sync to S3
        if: github.event_name != 'pull_request'
        # --acl public-read mirrors the existing s3cmd `-P` behavior. Remove it if the
        # bucket uses a bucket policy with ACLs disabled (Object Ownership = enforced).
        run: |
          aws s3 sync build/ "s3://${{ vars.S3_BUCKET }}/" \
            --delete \
            --acl public-read

      - name: Invalidate CloudFront
        if: github.event_name != 'pull_request'
        run: |
          aws cloudfront create-invalidation \
            --distribution-id "${{ vars.CLOUDFRONT_ID }}" \
            --paths "/*"