on:
  workflow_call:
    inputs:
      build_cmd:     { required: true,  type: string }
      dist_dir:      { required: true,  type: string }
      s3_bucket:     { required: true,  type: string }
      exclude_glob:  { required: false, type: string, default: "" }
    secrets:
      AWS_ACCESS_KEY_ID:     { required: true }
      AWS_SECRET_ACCESS_KEY: { required: true }
      CF_DIST_ID:    { required: true }
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: ${{ inputs.build_cmd }}
      - env:
          AWS_ACCESS_KEY_ID:     ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION:    eu-central-1
        run: |
          EXCLUDES=""
          [ -n "${{ inputs.exclude_glob }}" ] && for g in ${{ inputs.exclude_glob }}; do EXCLUDES="$EXCLUDES --exclude $g"; done
          aws s3 sync ${{ inputs.dist_dir }}/ s3://${{ inputs.s3_bucket }}/ --delete $EXCLUDES
          aws cloudfront create-invalidation --distribution-id "${{ secrets.CF_DIST_ID }}" --paths "/*"