can you convert this github actions file into a bash script that works within another Github actions file as a step and be able to pull github secrets too? 

name: Update website content
on:
  push:
    branches:
      - dev
      - stg
      - prod
    # Triggers if there is any change in static_website directory
    paths:
      - 'static_website/**'

permissions:
  id-token: write
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: checkout out current code using public action
        uses: actions/checkout@v3

      - name: Set env variable for branch
        id: env_var_step
        run: |
          if [[ "${{ github.ref_name }}" == "dev" ]];
          then
            echo "NAMESPACE=dev" >> $GITHUB_OUTPUT
          elif [[ "${{ github.ref_name }}" == "stg" ]];
          then
            echo "NAMESPACE=stg" >> $GITHUB_OUTPUT
          elif [[ "${{ github.ref_name }}" == "prod" ]];
          then
            echo "NAMESPACE=prod" >> $GITHUB_OUTPUT
          # elif [[ "${{ github.ref_name }}" == "test_ci_cd" ]];
          # then
          #   echo "I am inside test_ci_cd"
          #   echo "NAMESPACE=stg" >> $GITHUB_OUTPUT
          fi

      - name: Export AWS credentials for AWS CLI setup
        id: aws_creds
        run: |
          if [[ ${{ steps.env_var_step.outputs.NAMESPACE }} == "dev" ]];
          then
            echo "role_arn=${{ secrets.DEV_GITHUB_MDL_CLOUD_SERVERLESS_ROLE }}" >> $GITHUB_OUTPUT
          elif [[ ${{ steps.env_var_step.outputs.NAMESPACE }} == "stg" ]];
          then
            echo "role_arn=${{ secrets.STG_GITHUB_MDL_CLOUD_SERVERLESS_ROLE }}" >> $GITHUB_OUTPUT
          elif [[  ${{ steps.env_var_step.outputs.NAMESPACE }} == "prod" ]];
          then 
            echo "role_arn=${{ secrets.PROD_GITHUB_MDL_CLOUD_SERVERLESS_ROLE }}" >> $GITHUB_OUTPUT
          elif [[  ${{ steps.env_var_step.outputs.NAMESPACE }} == "sandbox" ]];
          then 
            echo "role_arn=${{ secrets.SANDBOX_GITHUB_MDL_CLOUD_SERVERLESS_ROLE }}" >> $GITHUB_OUTPUT
          fi

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          role-to-assume: ${{ steps.aws_creds.outputs.role_arn }}
          role-session-name: OIDCSession
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Upload latest changes to S3 bucket
        run: |
          echo ${{ steps.env_var_step.outputs.NAMESPACE }}
          bucket_list=$(aws s3 ls | awk '{print $3}')
          for bucket in $bucket_list; do
            if [[ "$bucket" == *"${{ secrets.PROJECT_NAME }}-${{ steps.env_var_step.outputs.NAMESPACE }}"* ]]; then
              if [[ "$bucket" != *"logs" ]]; then
                aws s3 sync static_website/ s3://$bucket --delete
              fi
            fi
          done

      - name: Create Cloudfront invalidation to pick name changes
        run: |
          distributions=$(aws cloudfront list-distributions | jq -r '.DistributionList.Items[] | .AliasICPRecordals[].CNAME')

          if [[ ${{ steps.env_var_step.outputs.NAMESPACE }} == "dev" ]];
          then
            for item in $distributions; do
              if [[ "$item" == "${{ secrets.PROJECT_NAME }}.dev.deployer.mckinsey.com" ]]; then
                id=$(aws cloudfront list-distributions | jq -r '.DistributionList.Items[] | select(.AliasICPRecordals[].CNAME == "'$item'") | .Id')
                
                invalidation_id=$(aws cloudfront create-invalidation --distribution-id $id --paths "/*" | jq -r '.Invalidation.Id')
                aws cloudfront wait invalidation-completed --distribution-id $id --id $invalidation_id
              fi
            done
          elif [[ ${{ steps.env_var_step.outputs.NAMESPACE }} == "stg" ]];
          then
            for item in $distributions; do
              if [[ "$item" == "${{ secrets.PROJECT_NAME }}.stg.deployer.mckinsey.com" ]]; then
                id=$(aws cloudfront list-distributions | jq -r '.DistributionList.Items[] | select(.AliasICPRecordals[].CNAME == "'$item'") | .Id')
                
                invalidation_id=$(aws cloudfront create-invalidation --distribution-id $id --paths "/*" | jq -r '.Invalidation.Id')
                aws cloudfront wait invalidation-completed --distribution-id $id --id $invalidation_id
              fi
            done
          elif [[  ${{ steps.env_var_step.outputs.NAMESPACE }} == "prod" ]];
          then 
            for item in $distributions; do
              if [[ "$item" == "${{ secrets.PROJECT_NAME }}.deployer.mckinsey.com" ]]; then
                id=$(aws cloudfront list-distributions | jq -r '.DistributionList.Items[] | select(.AliasICPRecordals[].CNAME == "'$item'") | .Id')
                
                invalidation_id=$(aws cloudfront create-invalidation --distribution-id $id --paths "/*" | jq -r '.Invalidation.Id')
                aws cloudfront wait invalidation-completed --distribution-id $id --id $invalidation_id
              fi
            done
          fi