deploy.yaml

name: Deploy Hugo Site to S3 with OIDC

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  deploy-to-prod:
    runs-on: ubuntu-latest
    environment: prod
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Get AWS credentials using OIDC
        id: assume-role
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
          role-session-name: hugo-deploy-${{ github.run_id }}

      - name: Set up Hugo
        uses: peaceiris/actions-hugo@v2
        with:
          hugo-version: latest
          extended: true

      - name: Build the Hugo site
        run: |
          hugo

      - name: Deploy to S3
        run: |
          echo "######## Site root"
          echo
          ls public/
          echo
          echo "######## Posts"
          echo
          ls public/posts
          echo
          echo "######## Posts page contents"
          cat public/posts/index.html
          echo
          hugo deploy --target prod # Change target to a var if you have multiple target envs

      - name: Invalidate CloudFront cache (optional)
        run: aws cloudfront create-invalidation --distribution-id ${{secrets.AWS_CLOUDFRONT_DISTRIBUTION_ID}} --paths "/*"