deploy-staging.yml

name: Deploy to staging

on:
  workflow_dispatch:

permissions:
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Configure aws credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: arn:aws:iam::773124449165:role/carisurau-github-action
          aws-region: ap-southeast-1
      - name: Checkout
        uses: actions/checkout@v3
      - name: TruffleHog
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          head: HEAD
          extra_args: --debug --only-verified
      - name: Get secrets by name and by ARN
        uses: aws-actions/aws-secretsmanager-get-secrets@v1
        with:
          secret-ids: |
            carisurauprod
      - name: Cache modules
        uses: actions/cache@v3
        id: yarn-cache
        with:
          path: node_modules
          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
          restore-keys: ${{ runner.os }}-yarn-
      - name: Use Node.js 18.x
        uses: actions/setup-node@v3
        with:
          node-version: 18
      - name: Install dependencies
        run: yarn --frozen-lockfile
      - name: Build
        run: yarn build
      - name: Deploy
        run: yarn sst deploy --stage staging