preview.yml

name: CMS Preview Check

permissions:
  id-token: write # This is required for requesting the JWT for AWS creds
  contents: read  # This is required for actions/checkout

on:
  push:
    branches:
      - 'main'
  pull_request:

jobs:
  # This is necessary to get credentials to use the private ECR image defined in the test job container.
  login-to-amazon-ecr:
    runs-on: ubuntu-latest
    steps:
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4.0.2
      with:
        aws-region: us-gov-west-1
        role-to-assume: ${{ vars.AWS_ASSUME_ROLE }}
        mask-aws-account-id: 'false'
    - name: Login to Amazon ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v2
      with:
        mask-password: 'false'
    outputs:
      docker_username: ${{ steps.login-ecr.outputs.docker_username_008577686731_dkr_ecr_us_gov_west_1_amazonaws_com }}
      docker_password: ${{ steps.login-ecr.outputs.docker_password_008577686731_dkr_ecr_us_gov_west_1_amazonaws_com }}

  preview:
    timeout-minutes: 15
    runs-on: [self-hosted, asg]
    needs: login-to-amazon-ecr
    container:
      image: 008577686731.dkr.ecr.us-gov-west-1.amazonaws.com/node-18.19.0-bullseye:latest
      credentials:
        username: ${{ needs.login-to-amazon-ecr.outputs.docker_username }}
        password: ${{ needs.login-to-amazon-ecr.outputs.docker_password }}
      # Certs added for the self hosted runner
      env:
        NODE_EXTRA_CA_CERTS: /etc/ssl/certs/ca-certificates.crt
        APP_ENV: gha
      ports:
        - 80
      volumes:
        - my_docker_volume:/home/runner
        - /etc/ssl/certs:/etc/ssl/certs
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version: 18
    - name: Setup Yarn
      run: |
        corepack enable
        corepack install -g --cache-only .yarn/releases/corepack.tgz

    - name: Install dependencies
      run: |
        yarn

    - name: Verify CMS preview build works
      run: yarn build:preview --DRUPAL_CLIENT_ID ${{ secrets.PROD_DRUPAL_CLIENT_ID }} --DRUPAL_CLIENT_SECRET ${{ secrets.PROD_DRUPAL_CLIENT_SECRET }}