Deploy #30

	name: Deploy

	on:
	workflow_run:
	workflows: [CI]
	types: [completed]
	branches: [main]

	permissions:
	contents: read

	jobs:
	deploy:
	name: Build & Deploy
	runs-on: ubuntu-latest
	if: ${{ github.event.workflow_run.conclusion == 'success' }}

	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: 22
	cache: npm

	- name: Install dependencies
	run: npm ci

	- name: Build design system
	run: npm run build -w packages/ui

	- name: Build
	run: npm run build

	- name: Deploy to S3
	env:
	AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
	AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
	AWS_DEFAULT_REGION: us-east-1
	run: \|
	# Hashed assets: cache forever (filename changes on content change)
	aws s3 sync dist/assets/ s3://forkzero-web-prod/assets/ \
	--cache-control "public, max-age=31536000, immutable" \
	--delete

	# Static assets (images, SVGs, robots.txt, sitemap): cache 1 day
	aws s3 sync dist/ s3://forkzero-web-prod/ \
	--exclude "assets/*" \
	--exclude "*.html" \
	--cache-control "public, max-age=86400" \
	--delete

	# HTML pages: short cache, revalidate often
	aws s3 sync dist/ s3://forkzero-web-prod/ \
	--exclude "assets/*" \
	--include "*.html" \
	--cache-control "public, max-age=300, s-maxage=86400"

	# Invalidate CloudFront
	aws cloudfront create-invalidation \
	--distribution-id ${{ secrets.CF_DISTRIBUTION_ID }} \
	--paths "/*"

Provide feedback