GitHub Actions

# .github/workflows/ci.yml
name: CI
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

permissions:
  contents: read
  pull-requests: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix: { node: ['20', '22'] }
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: ${{ matrix.node }}, cache: npm }
      - run: npm ci
      - run: npm run lint
      - run: npm test -- --coverage
      - uses: codecov/codecov-action@v4

  build:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '22', cache: npm }
      - run: npm ci
      - run: npm run build
      - uses: actions/upload-artifact@v4
        with: { name: dist, path: dist/ }


# Deploy with OIDC to AWS (no long-lived keys)
deploy:
  needs: build
  runs-on: ubuntu-latest
  environment: production
  permissions:
    id-token: write
    contents: read
  steps:
    - uses: actions/download-artifact@v4
      with: { name: dist, path: dist/ }
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: arn:aws:iam::111111111111:role/GhActionsDeploy
        aws-region: ap-southeast-2
    - run: aws s3 sync ./dist s3://my-site --delete


# Reusable workflow
# .github/workflows/lint.yml in this same repo
on: { workflow_call: {} }
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npx prettier --check .

# .github/workflows/ci.yml using it
jobs:
  lint:
    uses: ./.github/workflows/lint.yml


# Useful odds and ends
# - Use concurrency to cancel superseded runs on the same branch
# - Pin actions to a SHA in security-sensitive flows
# - Cache .npm + node_modules via actions/cache for big monorepos
# - Use OIDC federation - never store cloud creds as secrets

# Renovate / Dependabot keeps the runners + actions up to date

name: ci
on: [push]
jobs:
    test:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v4
            - run: npm ci && npm test