Merge pull request #2494 from YosemiteCrew/fix/codeql-open-alerts-sweep #684
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CD Frontend | |
| on: | |
| push: | |
| branches: [main, dev] | |
| permissions: | |
| contents: read | |
| actions: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| NODE_VERSION: '20' | |
| jobs: | |
| detect-frontend: | |
| name: Detect if frontend build is affected | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| outputs: | |
| should-deploy: ${{ steps.set.outputs.should_deploy }} | |
| steps: | |
| - name: Checkout (push-safe) | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.sha }} | |
| fetch-depth: 0 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| with: | |
| run_install: false | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'pnpm' | |
| - name: Compute base SHA | |
| id: base | |
| env: | |
| GITHUB_EVENT_NAME: ${{ github.event_name }} | |
| EVENT_BEFORE: ${{ github.event.before }} | |
| run: ./scripts/ci/compute-base-sha.sh >> "$GITHUB_OUTPUT" | |
| # Every uncertain path below deploys. A missed deploy silently leaves the | |
| # site stale, whereas a redundant deploy only costs an Amplify build, so | |
| # this decision fails closed to deploying rather than to skipping. | |
| - name: Decide whether to deploy | |
| id: set | |
| shell: bash | |
| env: | |
| BASE_SHA: ${{ steps.base.outputs.sha }} | |
| RUN_ALL: ${{ steps.base.outputs.run_all }} | |
| run: | | |
| set -euo pipefail | |
| deploy() { | |
| echo "$1" | |
| echo "should_deploy=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| } | |
| if [ "$RUN_ALL" = "true" ]; then | |
| deploy "No trustworthy base SHA; deploying." | |
| fi | |
| echo "Diff base => $BASE_SHA" | |
| if ! pnpm dlx turbo@2.10.4 run build --filter="frontend...[${BASE_SHA}]" --dry=json > affected-frontend.json; then | |
| deploy "Turbo dry run failed; deploying." | |
| fi | |
| if ! COUNT=$(node -e 'const a=require("./affected-frontend.json"); process.stdout.write(String((a.tasks||[]).length));'); then | |
| deploy "Could not read the affected task list; deploying." | |
| fi | |
| echo "Affected frontend build tasks: $COUNT" | |
| if [ "$COUNT" -gt 0 ]; then | |
| echo "should_deploy=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "should_deploy=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Show decision | |
| run: echo "should-deploy=${{ steps.set.outputs.should_deploy }}" | |
| deploy-frontend: | |
| name: Trigger Amplify deploy (frontend) | |
| needs: detect-frontend | |
| # Deploy unless detection positively proved the frontend unaffected. If the | |
| # detect job itself failed the output is empty, which must still deploy - | |
| # `== 'true'` would have turned an infrastructure failure into a silent | |
| # skipped release. | |
| # | |
| # Cancellation is the one case that must not deploy. This workflow sets | |
| # cancel-in-progress, so a superseded push leaves detect-frontend cancelled | |
| # with no output; under a bare always() the empty output reads as "not | |
| # false" and would ship the older, superseded commit. !cancelled() excludes | |
| # that while still deploying on a genuine detection failure. | |
| if: ${{ !cancelled() && needs.detect-frontend.outputs.should-deploy != 'false' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Select Amplify webhook for branch | |
| id: webhook | |
| run: | | |
| if [ "${{ github.ref_name }}" = "main" ]; then | |
| echo "url=${{ secrets.AMPLIFY_WEBHOOK_URL }}" >> $GITHUB_OUTPUT | |
| else | |
| echo "url=${{ secrets.AMPLIFY_WEBHOOK_URL_DEV }}" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Call Amplify webhook | |
| id: call-webhook | |
| run: | | |
| WEBHOOK_URL="${{ steps.webhook.outputs.url }}" | |
| if [ -z "$WEBHOOK_URL" ]; then | |
| echo "Amplify webhook secret is not set for this branch" | |
| exit 1 | |
| fi | |
| echo "Triggering Amplify webhook for branch '${{ github.ref_name }}'..." | |
| status_code=$(curl -sS -o /dev/null -w "%{http_code}" -X POST "$WEBHOOK_URL") | |
| echo "Webhook HTTP status: $status_code" | |
| if [ "$status_code" -lt 200 ] || [ "$status_code" -ge 300 ]; then | |
| echo "Amplify webhook call failed" | |
| exit 1 | |
| fi | |
| echo "Amplify webhook triggered successfully ✅" |