.github/workflows/deploy-lnt.llvm.org.yaml

name: Deploy lnt.llvm.org

on:
  workflow_dispatch:
  # Eventually:
  # pull_request_target:
  #   paths:
  #     - '.github/workflows/deploy-lnt.llvm.org.yaml'
  #     - 'deployment/*'

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-24.04

    steps:
    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2

    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
      with:
        aws-region: us-west-2
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

    - name: Initialize Terraform
      run: terraform -chdir=deployment init

    - name: Plan Terraform changes
      run: terraform -chdir=deployment plan

    - name: Apply Terraform changes
      if: ${{ github.ref == 'refs/heads/main' }} # only apply changes on pushes to main
      run: terraform -chdir=deployment apply -auto-approve