deploy-site.yaml

---
name: deploy website
on:
  workflow_dispatch: {}
  workflow_call:
    secrets:
      GCP_PROJECT_NAME:
        required: true
      BUCKET_NAME:
        required: true
      WIP_PROJECT_ID:
        required: true
  push:
    branches:
      - master

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

jobs:
  upload-website:
    name: Build and deploy website
    environment: website
    runs-on: ubuntu-latest

    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout publicsuffix/publicsuffix.org
        uses: actions/checkout@v3
        with:
          repository: publicsuffix/publicsuffix.org
          path: publicsuffix.org

      - name: Checkout publicsuffix/list
        uses: actions/checkout@v3
        with:
          repository: publicsuffix/list
          path: list

      - name: Authenticate with GCP
        uses: google-github-actions/auth@v0
        with:
          token_format: access_token
          service_account: deploy-website@${{ secrets.GCP_PROJECT_NAME }}.iam.gserviceaccount.com
          workload_identity_provider: projects/${{ secrets.WIP_PROJECT_ID }}/locations/global/workloadIdentityPools/github-actions/providers/github-actions          

      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@v1

      - name: Deploy website
        run: |-
          gsutil -m -h "Cache-Control:public, max-age=86400" rsync -d -r -x '\.git|.*\.dat$' publicsuffix.org/ gs://${{ secrets.BUCKET_NAME }}/
          gsutil -h "Cache-Control:public, max-age=86400" -h "Content-Type:text/plain; charset=UTF-8" cp list/public_suffix_list.dat gs://${{ secrets.BUCKET_NAME }}/list/public_suffix_list.dat
          gsutil -h "Cache-Control:public, max-age=86400" -h "Content-Type:text/plain; charset=UTF-8" cp list/public_suffix_list.dat gs://${{ secrets.BUCKET_NAME }}/list/effective_tld_names.dat