[P1] build(reader): make the deployable artifact reproducible

.gitattributes

@@ -0,0 +1,10 @@
+*.css text eol=lf
+*.html text eol=lf
+*.js text eol=lf
+*.json text eol=lf
+*.md text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf
+*.ttf binary
+.gitattributes text eol=lf
+.gitignore text eol=lf

.github/workflows/deploy.yml

@@ -9,15 +9,35 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Extract branch name
+      - name: Resolve deployment target
+        id: target
         shell: bash
-        run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
-        id: extract_branch
-      - run: zip -9 -x .git/\* -x .github/\* -x .gitignore -x build.js -x README.md -r sabbath-school-reader-latest.zip .
-      - run: curl https://s3.amazonaws.com/aws-cli/awscli-bundle.zip -o awscli-bundle.zip
-      - run: unzip awscli-bundle.zip
-      - run: ./awscli-bundle/install -b ~/bin/aws
-      - run: aws s3 cp sabbath-school-reader-latest.zip s3://sabbath-school`[[ "${{ steps.extract_branch.outputs.branch }}" = "stage" ]] && echo '-stage'`.adventech.io/reader/ --acl "public-read" --region us-east-1 --no-progress
+        run: |
+          set -euo pipefail
+          case "$GITHUB_REF_NAME" in
+            master) bucket="sabbath-school.adventech.io" ;;
+            stage) bucket="sabbath-school-stage.adventech.io" ;;
+            *) echo "Unsupported deployment branch: $GITHUB_REF_NAME" >&2; exit 1 ;;
+          esac
+          echo "bucket=$bucket" >> "$GITHUB_OUTPUT"
+      - name: Install locked build dependencies
+        run: npm ci --ignore-scripts
+      - name: Test reader
+        run: npm test
+      - name: Build source-bound reader artifact
+        run: npm run build -- --source-sha "$GITHUB_SHA" --output dist
+      - name: Verify artifact and deployment client
+        run: |
+          sha256sum --check dist/sabbath-school-reader-latest.zip.sha256
+          aws --version
+      - name: Upload verified reader artifact
+        shell: bash
+        run: |
+          set -euo pipefail
+          destination="s3://${{ steps.target.outputs.bucket }}/reader"
+          aws s3 cp dist/sabbath-school-reader-latest.zip "$destination/sabbath-school-reader-latest.zip" --acl "public-read" --region us-east-1 --no-progress
+          aws s3 cp dist/sabbath-school-reader-latest.zip.sha256 "$destination/sabbath-school-reader-latest.zip.sha256" --acl "public-read" --region us-east-1 --no-progress
+          aws s3 cp dist/reader-manifest.json "$destination/reader-manifest.json" --acl "public-read" --region us-east-1 --no-progress
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.gitignore

@@ -1,3 +1,4 @@
 .DS_Store
 .idea
-node_modules
+node_modules
+dist

README.md

@@ -1 +1,20 @@
-### Sabbath School Reader
+### Sabbath School Reader
+
+Install the locked build dependencies and run the tests:
+
+```sh
+npm ci --ignore-scripts
+npm test
+```
+
+Create the deployable reader artifact with the full source commit SHA:
+
+```sh
+npm run build -- --source-sha "$(git rev-parse HEAD)" --output dist
+sha256sum --check dist/sabbath-school-reader-latest.zip.sha256
+```
+
+The ZIP contains only `index.html`, `css/`, `fonts/`, `js/`, and its
+source-bound `reader-manifest.json`. The external manifest and checksum are
+written alongside the ZIP. Building twice from the same source produces
+identical bytes.