name: Build & Deploy

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - run: npm run build
      - name: Upload build artifacts
        uses: actions/upload-artifact@v3
        with:
          name: dist
          path: dist

  deploy:
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/download-artifact@v3
        with:
          name: dist
          path: dist
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v3
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}
      - name: Install AWS CLI
        run: |
            set -euo pipefail

            case "$(uname -m)" in
              x86_64|amd64)   AWS_ARCH="x86_64" ;;
              aarch64|arm64)  AWS_ARCH="aarch64" ;;
              *) echo "Unsupported arch: $(uname -m)" >&2; exit 1 ;;
            esac

            curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-${AWS_ARCH}.zip" -o awscliv2.zip
            unzip -q awscliv2.zip
            sudo ./aws/install --update -i /usr/local/aws-cli -b /usr/local/bin

            aws --version
      - name: Sync hashed assets to S3
        env:
          BUCKET_NAME: ${{ secrets.BUCKET_NAME }}
        run: |
          aws s3 sync dist/ "s3://${BUCKET_NAME}" \
            --delete \
            --exclude "index.html" \
            --cache-control "public, max-age=31536000, immutable"
      - name: Upload index.html
        env:
          BUCKET_NAME: ${{ secrets.BUCKET_NAME }}
        run: |
          aws s3 cp dist/index.html "s3://${BUCKET_NAME}/index.html" \
            --cache-control "no-cache, no-store, must-revalidate" \
            --content-type "text/html"
      - name: Invalidate CloudFront
        env:
          CLOUDFRONT_ID: ${{ secrets.CLOUDFRONT_ID }}
        run: |
          aws cloudfront create-invalidation \
            --distribution-id "${CLOUDFRONT_ID}" \
            --paths "/" "/index.html"