main.yml

name: Main

on:
  workflow_dispatch:
  push:
    branches:
      - main

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Setup job workspace
        uses: ServerlessOpsIO/gha-setup-workspace@v1

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Yarn via corepack
        shell: bash
        run: corepack enable

      - name: Install dependencies
        shell: bash
        run: yarn install --immutable

      - name: Compile Typescript
        run: yarn run compile

      - name: Run unit tests
        run: yarn run test:unit

      - name: Assume AWS credentials
        uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
        with:
          build_aws_account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}

      - name: Install AWS SAM
        uses: aws-actions/setup-sam@v2

      - name: Validate template
        run: sam validate --lint

      - name: Build deployment artifact
        run: yarn run sam:build

      - name: Store artifacts
        uses: ServerlessOpsIO/gha-store-artifacts@v1
        with:
          use_aws_sam: true

  deploy:
    needs:
      - build

    environment: production
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Setup job workspace
        uses: ServerlessOpsIO/gha-setup-workspace@v1
        with:
          checkout_artifact: true

      - name: Assume AWS credentials
        uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
        with:
          build_aws_account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}
          deploy_aws_account_id: ${{ secrets.DEPLOYMENT_ACCOUNT_ID }}

      - name: Deploy via AWS SAM
        uses: ServerlessOpsIO/gha-deploy-aws-sam@v1
        with:
          aws_account_id: ${{ secrets.DEPLOYMENT_ACCOUNT_ID }}
          env_json: ${{ toJson(env) }}
          secrets_json: ${{ toJson(secrets) }}