ingitdb-cli/.github/workflows/deploy-server-from-code.yml at main · ingitdb/ingitdb-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
name: Deploy server (from code)

on:
  workflow_dispatch: # Allows manual trigger from Actions tab

jobs:
  deploy:
    name: Deploy to Cloud Run
    runs-on: ubuntu-latest

    env:
      GCLOUD_PROJECT_ID: ingitdb
      GCLOUD_REGION: europe-west3
      SERVICE_NAME: ingitdb-server
      INGITDB_GITHUB_OAUTH_CLIENT_ID: ${{ vars.INGITDB_GITHUB_OAUTH_CLIENT_ID }}
      INGITDB_GITHUB_OAUTH_CALLBACK_URL: ${{ vars.INGITDB_GITHUB_OAUTH_CALLBACK_URL }}
      INGITDB_AUTH_COOKIE_DOMAIN: ${{ vars.INGITDB_AUTH_COOKIE_DOMAIN }}
      INGITDB_AUTH_API_BASE_URL: ${{ vars.INGITDB_AUTH_API_BASE_URL }}
      INGITDB_AUTH_COOKIE_NAME: ${{ vars.INGITDB_AUTH_COOKIE_NAME }}
      INGITDB_AUTH_COOKIE_SECURE: ${{ vars.INGITDB_AUTH_COOKIE_SECURE }}
      GCP_OAUTH_CLIENT_SECRET_NAME: ${{ vars.GCP_OAUTH_CLIENT_SECRET_NAME }}

    permissions:
      contents: 'read'
      id-token: 'write'

    steps:
      - name: Validate required env vars
        shell: bash
        run: |
          set -euo pipefail
          required_vars=(
            GCLOUD_PROJECT_ID
            GCLOUD_REGION
            SERVICE_NAME
            INGITDB_GITHUB_OAUTH_CLIENT_ID
            INGITDB_GITHUB_OAUTH_CALLBACK_URL
            INGITDB_AUTH_COOKIE_DOMAIN
            INGITDB_AUTH_API_BASE_URL
            GCP_OAUTH_CLIENT_SECRET_NAME
          )
          missing=()
          for var_name in "${required_vars[@]}"; do
            if [[ -z "${!var_name:-}" ]]; then
              missing+=("$var_name")
            fi
          done
          if (( ${#missing[@]} > 0 )); then
            echo "::error::Missing required env vars: ${missing[*]}"
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.26'
          cache: true

      - name: Build Go binary
        run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ingitdb ./cmd/ingitdb

      - id: auth
        name: Authenticate with Google Cloud
        uses: google-github-actions/auth@v3
        with:
          service_account: 'deployer2gcloud@${{ env.GCLOUD_PROJECT_ID }}.iam.gserviceaccount.com'
          workload_identity_provider: 'projects/152447355531/locations/global/workloadIdentityPools/github/providers/ingitdb'

      - name: Setup Cloud SDK
        uses: google-github-actions/setup-gcloud@v3
        with:
          project_id: ${{ env.GCLOUD_PROJECT_ID }}

      - name: Configure Docker for Artifact Registry
        run: gcloud auth configure-docker ${{ env.GCLOUD_REGION }}-docker.pkg.dev

      - name: Build Docker image
        run: |
          docker build \
            -f server/Dockerfile \
            -t ${{ env.GCLOUD_REGION }}-docker.pkg.dev/${{ env.GCLOUD_PROJECT_ID }}/cloud-run/${{ env.SERVICE_NAME }}:${{ github.sha }} \
            -t ${{ env.GCLOUD_REGION }}-docker.pkg.dev/${{ env.GCLOUD_PROJECT_ID }}/cloud-run/${{ env.SERVICE_NAME }}:latest \
            .

      - name: Push Docker image
        run: |
          docker push ${{ env.GCLOUD_REGION }}-docker.pkg.dev/${{ env.GCLOUD_PROJECT_ID }}/cloud-run/${{ env.SERVICE_NAME }}:${{ github.sha }}
          docker push ${{ env.GCLOUD_REGION }}-docker.pkg.dev/${{ env.GCLOUD_PROJECT_ID }}/cloud-run/${{ env.SERVICE_NAME }}:latest

      - name: Deploy to Cloud Run
        run: |
          gcloud run deploy ${{ env.SERVICE_NAME }} \
            --image=${{ env.GCLOUD_REGION }}-docker.pkg.dev/${{ env.GCLOUD_PROJECT_ID }}/cloud-run/${{ env.SERVICE_NAME }}:${{ github.sha }} \
            --platform=managed \
            --region=${{ env.GCLOUD_REGION }} \
            --allow-unauthenticated \
            --min-instances=0 \
            --max-instances=2 \
            --memory=512Mi \
            --cpu=1 \
            --timeout=300 \
            --set-env-vars=INGITDB_GITHUB_OAUTH_CLIENT_ID=${{ env.INGITDB_GITHUB_OAUTH_CLIENT_ID }},INGITDB_GITHUB_OAUTH_CALLBACK_URL=${{ env.INGITDB_GITHUB_OAUTH_CALLBACK_URL }},INGITDB_AUTH_COOKIE_DOMAIN=${{ env.INGITDB_AUTH_COOKIE_DOMAIN }},INGITDB_AUTH_API_BASE_URL=${{ env.INGITDB_AUTH_API_BASE_URL }},INGITDB_AUTH_COOKIE_NAME=${{ env.INGITDB_AUTH_COOKIE_NAME }},INGITDB_AUTH_COOKIE_SECURE=${{ env.INGITDB_AUTH_COOKIE_SECURE }} \
            --set-secrets=INGITDB_GITHUB_OAUTH_CLIENT_SECRET=${{ env.GCP_OAUTH_CLIENT_SECRET_NAME }}:latest \
            --project=${{ env.GCLOUD_PROJECT_ID }}

      - name: Show service URL
        run: |
          SERVICE_URL=$(gcloud run services describe ${{ env.SERVICE_NAME }} --region=${{ env.GCLOUD_REGION }} --format='value(status.url)')
          echo "Service deployed to: $SERVICE_URL"