bytesized.co/.github/workflows/deploy.yml at main · pvzig/bytesized.co · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
name: Build and Deploy

on:
  push:
    branches:
      - main

concurrency:
  group: deploy-production
  cancel-in-progress: true

jobs:
  deploy_backend:
    name: Deploy Backend
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_REGION: ${{ vars.AWS_REGION }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      GENERATED_IMAGES_BUCKET: ${{ vars.GENERATED_IMAGES_BUCKET }}
      IMAGE_GEN_PREFIX: ${{ vars.IMAGE_GEN_PREFIX }}
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
      OPENAI_IMAGE_MODEL: ${{ vars.OPENAI_IMAGE_MODEL }}
      RAILWAY_PROJECT_ID: ${{ vars.RAILWAY_PROJECT_ID }}
      RAILWAY_ENVIRONMENT_NAME: ${{ vars.RAILWAY_ENVIRONMENT_NAME }}
      RAILWAY_RUNTIME_HOST: "0.0.0.0"
      RAILWAY_RUNTIME_PORT: "8080"
      RAILWAY_SERVICE_NAME: ${{ vars.RAILWAY_SERVICE_NAME }}
      RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
    steps:
      - uses: actions/checkout@v6

      - name: Set up Node
        uses: actions/setup-node@v6
        with:
          node-version: "22"

      - name: Validate Railway configuration
        run: |
          set -euo pipefail

          : "${AWS_ACCESS_KEY_ID:?AWS_ACCESS_KEY_ID is required}"
          : "${AWS_REGION:?AWS_REGION is required}"
          : "${AWS_SECRET_ACCESS_KEY:?AWS_SECRET_ACCESS_KEY is required}"
          : "${GENERATED_IMAGES_BUCKET:?GENERATED_IMAGES_BUCKET is required}"
          : "${IMAGE_GEN_PREFIX:?IMAGE_GEN_PREFIX is required}"
          : "${OPENAI_API_KEY:?OPENAI_API_KEY is required}"
          : "${OPENAI_IMAGE_MODEL:?OPENAI_IMAGE_MODEL is required}"
          : "${RAILWAY_PROJECT_ID:?RAILWAY_PROJECT_ID is required}"
          : "${RAILWAY_ENVIRONMENT_NAME:?RAILWAY_ENVIRONMENT_NAME is required}"
          : "${RAILWAY_SERVICE_NAME:?RAILWAY_SERVICE_NAME is required}"
          : "${RAILWAY_TOKEN:?RAILWAY_TOKEN is required}"

      - name: Sync Railway backend variables
        run: ./Scripts/sync-railway-backend-variables.sh

      - name: Deploy backend to Railway
        run: |
          set -euo pipefail

          npx -y @railway/cli up Backend \
            --ci \
            --path-as-root \
            --project "${RAILWAY_PROJECT_ID}" \
            --environment "${RAILWAY_ENVIRONMENT_NAME}" \
            --service "${RAILWAY_SERVICE_NAME}" \
            --message "GitHub Actions ${GITHUB_SHA}"

  deploy_site:
    name: Deploy Site
    runs-on: macos-latest
    needs: deploy_backend
    env:
      AWS_REGION: ${{ vars.AWS_REGION }}
      BYTESIZED_CAFE_API_URL: ${{ vars.BYTESIZED_CAFE_API_URL }}
    steps:
      - uses: actions/checkout@v6

      - name: Set up just
        uses: extractions/setup-just@v4

      - name: Validate site API URL
        run: |
          set -euo pipefail

          : "${AWS_REGION:?AWS_REGION is required}"
          : "${BYTESIZED_CAFE_API_URL:?BYTESIZED_CAFE_API_URL is required}"

      - name: Set up Swift
        uses: swift-actions/setup-swift@v3
        with:
          swift-version: "6.3.0"

      - name: Set up SwiftWasm
        id: swiftwasm
        uses: swiftwasm/setup-swiftwasm@v2.1
        with:
          tag: swift-6.3-RELEASE
          target: wasm32-unknown-wasip1

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: Install Binaryen
        run: brew install binaryen

      - name: Build SwiftWASM app
        env:
          SWIFT_WASM_SDK_ID: ${{ steps.swiftwasm.outputs.swift-sdk-id }}
        run: just wasm

      - name: Build site
        run: just site-release

      - name: Deploy site
        env:
          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
        run: just site-deploy

      - name: Invalidate CloudFront cache
        uses: chetan/invalidate-cloudfront-action@v2
        env:
          DISTRIBUTION: ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }}
          PATHS: '/ /index.html /page/* /posts/* /feed.rss /bytesized-cafe-app/* /css/* /images/* /fonts/*'
          AWS_REGION: 'us-east-1'
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}