cloudfront + s3 + github actions 自動デプロイ

deploy.yml
各環境変数はGiHubリポジトリのSettings>Secrets>みたいなところで、Secretsを追加する

name: deploy
on:
  push:
    branches:
      - main
    paths:
      - "app/**"
      - "components/**"
      - "hooks/**"
      - "lib/**"
      - "styles/**"
      - "public/**"
      - "package.json"
      - "pnpm-lock.yaml"
      - "next.config.mjs"
      - "tsconfig.json"

env:
  AWS_REGION: ap-northeast-1

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install pnpm
        run: corepack enable && corepack prepare pnpm@latest --activate

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm build

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Upload files to S3
        run: |
          aws s3 sync --delete \
            --cache-control "max-age=31536000, immutable" \
            out/ s3://${{ secrets.S3_BUCKET }}/ \
            --exclude "*.html"
          aws s3 sync --delete \
            --cache-control "no-cache" \
            out/ s3://${{ secrets.S3_BUCKET }}/ \
            --include "*.html" \
            --exclude "*"

      - name: Invalidate CloudFront cache
        run: |
          aws cloudfront create-invalidation \
            --distribution-id ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }} \
            --paths "/*"