Deploy Hugo with GitHub Actions to S3 with OIDC

GitHub Actions provides OpenID Connect support, this means that you can set up a role in Amazon Web Services that GitHub Actions can assume, so we don't have to store any access keys as environment variables.

name: Build and Deploy Hugo Site

on:
  push:
    branches: [ master ]

jobs:
  deploy:
    runs-on: ubuntu-22.04
    concurrency:
      group: ${{ github.workflow }}-${{ github.ref }}
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v3

      - name: Setup Hugo
        uses: peaceiris/actions-hugo@v2
        with:
          hugo-version: '0.123.7'
          extended: true

      - name: Build
        run: hugo --minify

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: arn:aws:iam::123412341234:role/github-actions
          aws-region: eu-central-1

      - name: Deploy
        run: hugo deploy