deploy.yml

name: Deploy

on:
  pull_request:
    branches:
      - main
  push:
    branches:
    - main

  workflow_dispatch: null
env:
  OIDC_IAM_ROLE_ARN: ${{ secrets.OIDC_IAM_ROLE_ARN }}
  AWS_REGION: us-west-2

permissions:
  id-token: write
  contents: read

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        persist-credentials: false

    - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      name: Install pnpm
      with:
        run_install: |
          - recursive: true

    - name: Build
      run: pnpm build

    - name: Lint
      run: pnpm run --if-present --recursive --parallel lint

  deploy-bexample:
    # 同時実行すると CREATE_IN_PROGRESS や UPDATE_IN_PROGRESS 状態で cdk deploy を行う可能性があるため抑止する
    concurrency:
      group: "cloudformation-aws-lambda-mcp-server-example"
      cancel-in-progress: false

    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        persist-credentials: false

    - name: Use Node.js
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
        node-version: 'lts/*'
        check-latest: true
        package-manager-cache: false

    - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      name: Install pnpm
      with:
        run_install: |
          - recursive: true
            args: [--no-frozen-lockfile]
          - args: [--global, esbuild]

    - name: Build
      run: pnpm build

    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
      with:
        role-to-assume: ${{ env.OIDC_IAM_ROLE_ARN }}
        role-session-name: GitHubActions
        aws-region: ${{ env.AWS_REGION }}

    - name: deploy
      working-directory: ./example
      run: |
        pnpm dlx aws-cdk@latest deploy --require-approval=never