Material for MkDocs をAWS CDKとGitHub Actionsで公開する

const originS3Bucket = new aws_s3.Bucket(this, 'MKDocsOriginS3Bucket', {
      bucketName: `${cdk.Stack.of(this).account}-mkdocs-origin`,
      websiteIndexDocument: 'index.html',
      blockPublicAccess: aws_s3.BlockPublicAccess.BLOCK_ALL,
      removalPolicy: RemovalPolicy.DESTROY,
    });

const originAccessControl = new aws_cloudfront.CfnOriginAccessControl(this, 'MKDocsOriginAccessControl', {
      originAccessControlConfig: {
        name: 'MKDocsOriginAccessControlForOriginS3Bucket',
        originAccessControlOriginType: 's3',
        signingBehavior: 'always',
        signingProtocol: 'sigv4',
        description: 'Access Control',
      },
    });

const cfnDistribution = distribution.node.defaultChild as aws_cloudfront.CfnDistribution
    cfnDistribution.addPropertyOverride('DistributionConfig.Origins.0.OriginAccessControlId', originAccessControl.getAtt('Id'))

    const distribution = new aws_cloudfront.Distribution(this, 'MKDocsDistribution', {
      defaultRootObject: 'index.html',
      defaultBehavior: {
        origin: new aws_cloudfront_origins.S3Origin(originS3Bucket),
        functionAssociations : [
          {
            eventType: FunctionEventType.VIEWER_REQUEST,
            function: new aws_cloudfront.Function(this, 'MKDocsBasicAuthFunction', {
              functionName: `mkdocs-basic-authentication`,
              code: aws_cloudfront.FunctionCode.fromFile({
                filePath: "basic_auth_function/index.js"
              }),
            }),
          },
        ],
        viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS
      },
    });

function handler(event) {
    var request = event.request;
    var headers = request.headers;
    var uri = request.uri;

    // echo -n user:pass | base64
    var authString = "Basic dXNlcjpwYXNz";

    if (
        typeof headers.authorization === "undefined" ||
        headers.authorization.value !== authString
    ) {
        return {
            statusCode: 401,
            statusDescription: "Unauthorized",
            headers: { "www-authenticate": { value: "Basic" } }
        };
    }

    if (uri.endsWith('/')) {
        request.uri += 'index.html';
    }
    else if (!uri.includes('.')) {
        request.uri += '/index.html';
    }

    return request;
}

name: "Manual Deploy"

on: workflow_dispatch

env:
  BUCKET_NAME : ${{ secrets.S3_BUCKET_NAME }}
  AWS_REGION : ${{ secrets.AWS_REGION }}
  AWS_ROLE_ARN: ${{ secrets.AWS_OIDC_IAM_ROLE_ARN }}
  SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
  SLACK_CHANNEL_ID: ${{ secrets.SLACK_CHANNEL_ID }}

permissions:
  id-token: write
  contents: read

jobs:
  build_and_push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2

      - name: Build
        uses: addnab/docker-run-action@v3
        with:
          image: squidfunk/mkdocs-material:latest
          options: -v ${{ github.workspace }}:/docs
          run: mkdocs build

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          role-to-assume: ${{ env.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Sync html to s3
        run: |
          aws s3 sync ./site s3://${{ env.BUCKET_NAME }}/ --delete --quiet

      - name: Slack Notification on Success
        if: success()
        uses: rtCamp/action-slack-notify@v2
        env:
          SLACK_CHANNEL: ${{ env.SLACK_CHANNEL_ID }}
          SLACK_TITLE: MKDocs - Manual Deploy job Success
          SLACK_COLOR: good
          SLACK_MESSAGE: Successfully executed the Manual Deploy job.
          SLACK_USERNAME: MKDocs - Manual Deploy job Success

      - name: Slack Notification on Failure
        uses: rtCamp/action-slack-notify@v2
        if: failure()
        env:
          SLACK_CHANNEL: ${{ env.SLACK_CHANNEL_ID }}
          SLACK_TITLE: MKDocs - Manual Deploy job Failure
          SLACK_COLOR: danger
          SLACK_MESSAGE: <!channel> The Manual Deploy job failed to execute.
          SLACK_USERNAME: MKDocs - Manual Deploy job Failure