From f262d4dfdc41fd552f9cb532f515079cbb1adff2 Mon Sep 17 00:00:00 2001 From: Alexander Wang Date: Sun, 2 Aug 2026 16:01:05 -0700 Subject: [PATCH] Deploy docs through AWS OIDC --- .github/workflows/ci.yml | 11 +++++++---- ci/deploy.sh | 3 +-- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 62bded0..16a4634 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -63,6 +63,12 @@ jobs: needs: [ci, nofixups, spell-check, alt-tags-check, webp-versions-check] runs-on: ubuntu-latest if: github.ref == 'refs/heads/master' && github.event_name == 'push' + permissions: + contents: read + id-token: write + env: + D2_DOCS_S3_BUCKET: s3://d2lang-docs-278852893615 + D2_DOCS_CLOUDFRONT_ID: E2NLB7I775SAF steps: - uses: actions/checkout@v3 with: @@ -76,14 +82,11 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v2 with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + role-to-assume: arn:aws:iam::278852893615:role/d2lang-docs-deploy aws-region: us-west-1 - name: Install dependencies run: yarn install --frozen-lockfile - name: Deploy to production run: ./ci/deploy.sh env: - D2_DOCS_S3_BUCKET: ${{ secrets.D2_DOCS_S3_BUCKET }} - D2_DOCS_CLOUDFRONT_ID: ${{ secrets.D2_DOCS_CLOUDFRONT_ID }} D2_DOCS_ALGOLIA_CRAWLER_API_KEY: ${{ secrets.D2_DOCS_ALGOLIA_CRAWLER_API_KEY }} diff --git a/ci/deploy.sh b/ci/deploy.sh index 0214c0a..7e20a87 100755 --- a/ci/deploy.sh +++ b/ci/deploy.sh @@ -21,11 +21,10 @@ fi DOCUSAURUS_IGNORE_SSG_WARNINGS=true npm run prod aws sts get-caller-identity --no-cli-pager > /dev/null -aws s3 sync ./build ${D2_DOCS_S3_BUCKET} --delete --acl public-read --no-cli-pager +aws s3 sync ./build ${D2_DOCS_S3_BUCKET} --delete --no-cli-pager aws cloudfront create-invalidation --distribution-id ${D2_DOCS_CLOUDFRONT_ID} --paths "/*" --no-cli-pager curl -H "Content-Type: application/json" \ -X POST \ --user dd0bd3fe-db42-4673-89ae-e7e70dfae16b:${D2_DOCS_ALGOLIA_CRAWLER_API_KEY} \ "https://crawler.algolia.com/api/1/crawlers/2d841c67-ab75-4fb1-9114-f8844363d74c/reindex" -