sst.deploy.yml

name: SST Deploy

on:
  workflow_call:
    inputs:
      environment:
        description: "GitHub environment name"
        required: true
        type: string
      sst-stage:
        description: "SST deployment stage"
        required: true
        type: string
    secrets:
      CLOUDFLARE_API_TOKEN:
        required: true
      DATABASE_URL:
        required: true
      SG_CARS_TRENDS_API_TOKEN:
        required: true
      UPSTASH_REDIS_REST_TOKEN:
        required: true
      UPSTASH_REDIS_REST_URL:
        required: true

permissions:
  id-token: write
  contents: read
  packages: read

jobs:
  sst-deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    env:
      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
      DATABASE_URL: ${{ secrets.DATABASE_URL }}
      SG_CARS_TRENDS_API_TOKEN: ${{ secrets.SG_CARS_TRENDS_API_TOKEN }}
      UPSTASH_REDIS_REST_TOKEN: ${{ secrets.UPSTASH_REDIS_REST_TOKEN }}
      UPSTASH_REDIS_REST_URL: ${{ secrets.UPSTASH_REDIS_REST_URL }}
      FEATURE_FLAG_RATE_LIMIT: ${{ vars.FEATURE_FLAG_RATE_LIMIT }}

    # Concurrency group name ensures concurrent workflow runs wait for any in-progress job to finish
    concurrency:
      group: merge-${{ github.ref }}

    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: latest
      - uses: actions/setup-node@v4
        with:
          node-version: latest
          cache: "pnpm"
      - name: Install dependencies
        run: |
          echo "//npm.pkg.github.com/:_authToken=${{ secrets.GH_TOKEN }}" >> .npmrc  # Add auth token to .npmrc
          pnpm install
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.ROLE_TO_ASSUME }}
          aws-region: ${{ vars.AWS_REGION }}
      - name: Deploy app
        run: |
          pnpm sst deploy --stage ${{ inputs.sst-stage }}