deploy.yml

name: Deploy

permissions:
  contents: read

on:
  push:
    branches:
      - main
      - deploy-*
  workflow_dispatch:
    inputs:
      branch:
        description: Branch to deploy
        required: true
        # user must select a branch when triggering workflow manually

env:
  working_dir: terragrunt/live/website

concurrency:
  group: ${{ github.workflow }}

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout selected branch
      uses: actions/checkout@v6
      with:
        # If workflow_dispatch, use the selected branch.
        # If push event, use the branch that triggered the workflow.
        ref: ${{ github.event.inputs.branch || github.ref_name }}

    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v6.1.1
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1

    - name: Update Terraform State and Providers
      uses: gruntwork-io/terragrunt-action@v3
      env:
        TERRAGRUNT_DISABLE_COPY: true
      with:
        tg_dir: ${{ env.working_dir }}
        tg_command: init --upgrade

    - name: Terragrunt Plan
      uses: gruntwork-io/terragrunt-action@v3
      env:
        TERRAGRUNT_DISABLE_COPY: true
      with:
        tg_dir: ${{ env.working_dir }}
        tg_command: plan

    - name: Terragrunt Apply
      uses: gruntwork-io/terragrunt-action@v3
      env:
        TERRAGRUNT_DISABLE_COPY: true
      with:
        tg_dir: ${{ env.working_dir }}
        tg_command: apply

    - name: Read Values
      id: terragrunt_output
      run: |
        cd terragrunt/live/website
        printf "distribution_id=%s\n" $(terragrunt output distribution_id) >> "$GITHUB_OUTPUT"
        printf "bucket_name=%s\n" $(terragrunt output bucket_name) >> "$GITHUB_OUTPUT"

    - name: Build Jekyll project
      run: |
        bundle install
        mise build

    - name: Validate Outputs
      run: |
        echo "Verifying CloudFront Distribution..."
        aws cloudfront get-distribution --id "${{ steps.terragrunt_output.outputs.distribution_id }}"
        echo "\nVerifying S3 Bucket..."
        aws s3 ls | grep "${{ steps.terragrunt_output.outputs.bucket_name }}"

    - name: Copy output to S3
      run: aws s3 sync ./_site/ s3://${{ steps.terragrunt_output.outputs.bucket_name }} --acl public-read --delete --cache-control max-age=604800

    - name: Invalidate Cloudfront
      run: aws cloudfront create-invalidation --distribution-id ${{ steps.terragrunt_output.outputs.distribution_id }} --paths "/*"

    - name: Auto-commit updated Terraform lockfile
      run: |
        git config --global user.email "actions@github.com"
        git config --global user.name "GitHub Actions"

        # Only commit the module lockfile — live lockfiles must never exist
        git add terragrunt/modules/website/.terraform.lock.hcl

        if git diff --cached --quiet; then
          echo "No lockfile changes to commit."
        else
          echo "Committing updated lockfile..."
          git commit -m "chore(terraform): update provider lock file"
          git push
        fi

    - name: Check for uncommitted changes
      run: |
        git config --global --add safe.directory "$GITHUB_WORKSPACE"

        echo "Git status after build:"
        git status
        git diff

        CHANGES="$(git status --porcelain)"
        if [ -n "$CHANGES" ]; then
          echo "❌ Uncommitted changes detected in the repository."
          echo "These files changed (format: XY path):"
          echo "$CHANGES"

          echo "::error::Your deployment produced uncommitted changes. \
          This usually means something should be added to .gitignore or a lockfile/other tracked file needs updating."
          exit 1
        else
          echo "✅ No uncommitted changes after deploy."
        fi



    - name: Upload lock files on failure
      if: failure()
      uses: actions/upload-artifact@v7
      with:
        name: terraform-lock-files
        path: |
          terraform/website/.terraform.lock.hcl
          terragrunt/live/website/.terraform.lock.hcl
          terragrunt/dev/website/.terraform.lock.hcl
        if-no-files-found: ignore