mirror of
https://github.com/standardnotes/app
synced 2026-10-16 18:14:18 -04:00
b8ccb0f85c
* ci: pin third-party actions to full commit SHAs Pin third-party actions on mutable @master/@main tags in credentialed jobs: - chetan/invalidate-cloudfront-action (web.release.prod.yml) — handed production AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY - convictional/trigger-workflow-and-wait (snjs.pr.yml, e2e jobs) — handed CI_PAT_TOKEN - johnnyhuy/actions-discord-git-webhook (web.release.prod.yml) — handed DISCORD_WEBHOOK_URL A moved tag would run unreviewed code with those credentials. Behaviour unchanged; per GitHub's pin-to-SHA guidance. Signed-off-by: Kobi Hikri <[email protected]> * Apply suggestion from @antsgar --------- Signed-off-by: Kobi Hikri <[email protected]> Co-authored-by: Antonella Sgarlatta <[email protected]> Co-authored-by: Antonella Sgarlatta <[email protected]>
52 lines
1.5 KiB
YAML
52 lines
1.5 KiB
YAML
name: Web Deploy
|
|
|
|
concurrency:
|
|
group: prod_environment
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- '*standardnotes/*web*'
|
|
- '!*standardnotes/*web*beta*'
|
|
- '!*standardnotes/*web*alpha*'
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v3
|
|
- name: Install dependencies
|
|
run: yarn install --immutable
|
|
- name: Build
|
|
run: yarn build:web
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@v1
|
|
with:
|
|
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
aws-region: us-east-1
|
|
- name: Deploy static site to S3 bucket
|
|
run: aws s3 sync packages/web/dist/ s3://app.standardnotes.com --delete
|
|
- name: Invalidate CloudFront Cache
|
|
uses: chetan/invalidate-cloudfront-action@fce6f6f546fae2e9fe55f3bd1411063a908f2557 # master
|
|
env:
|
|
DISTRIBUTION: ${{ secrets.WEBAPP_CLOUDFRONT_COM_DISTRIBUTION_ID }}
|
|
PATHS: '/*'
|
|
AWS_REGION: 'us-east-1'
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
|
|
notify_discord:
|
|
needs: deploy
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Run Discord Webhook
|
|
uses: johnnyhuy/actions-discord-git-webhook@59b728b6b5cd1c18e4b462f4876d3a0d8e26f23a # main
|
|
with:
|
|
webhook_url: ${{ secrets.DISCORD_WEBHOOK_URL }}
|