google-cloudrun-docker.yml

# This workflow builds and pushes Docker containers to Google Artifact Registry
# and deploys both backend and frontend on Cloud Run when a commit is pushed to the "production"
# branch.

name: 'Build and Deploy QueryPal to Cloud Run'

on:
  push:
    branches:
      - 'production'
  workflow_dispatch:

env:
  PROJECT_ID: 'gen-lang-client-0698668474'
  REGION: 'europe-west1'
  BACKEND_SERVICE: 'querypal-backend'
  FRONTEND_SERVICE: 'querypal-frontend'
  WORKLOAD_IDENTITY_PROVIDER: 'projects/874216619692/locations/global/workloadIdentityPools/github/providers/querypal'

jobs:
  deploy:
    runs-on: 'ubuntu-latest'

    permissions:
      contents: 'read'
      id-token: 'write'

    steps:
      - name: 'Checkout'
        uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332' # actions/checkout@v4

      # Configure Workload Identity Federation and generate an access token.
      - id: 'auth'
        name: 'Authenticate to Google Cloud'
        uses: 'google-github-actions/auth@f112390a2df9932162083945e46d439060d66ec2' # google-github-actions/auth@v2
        with:
          workload_identity_provider: '${{ env.WORKLOAD_IDENTITY_PROVIDER }}'
          service_account: 'github-actions@gen-lang-client-0698668474.iam.gserviceaccount.com'

      # Set up Cloud SDK
      - name: 'Set up Cloud SDK'
        uses: 'google-github-actions/setup-gcloud@98ddc00a17442e89a24bbf282954a3b65ce6d200' # google-github-actions/setup-gcloud@v2

      # Configure Docker to use gcloud as a credential helper
      - name: 'Configure Docker for GCR'
        run: |-
          gcloud auth configure-docker --quiet

      # Build and Push Backend Container
      - name: 'Build and Push Backend Container'
        run: |-
          cd backend
          DOCKER_TAG="gcr.io/${{ env.PROJECT_ID }}/${{ env.BACKEND_SERVICE }}:${{ github.sha }}"
          docker build --tag "${DOCKER_TAG}" --platform linux/amd64 .
          docker push "${DOCKER_TAG}"

      # Deploy Backend to Cloud Run
      - id: 'deploy-backend'
        name: 'Deploy Backend to Cloud Run'
        uses: 'google-github-actions/deploy-cloudrun@33553064113a37d688aa6937bacbdc481580be17' # google-github-actions/deploy-cloudrun@v2
        with:
          service: '${{ env.BACKEND_SERVICE }}'
          region: '${{ env.REGION }}'
          image: 'gcr.io/${{ env.PROJECT_ID }}/${{ env.BACKEND_SERVICE }}:${{ github.sha }}'
          env_vars: |
            ENVIRONMENT=production
            AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}
            AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}
            AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}
            ARM_SCOPE=https://management.azure.com/.default
            GEMINI_API_KEY=${{ secrets.GEMINI_API_KEY }}
            DB_USER=${{ secrets.DB_USER }}
            DB_PASS=${{ secrets.DB_PASS }}
            DB_NAME=querypal
            DB_UNIX_SOCKET=/cloudsql/gen-lang-client-0698668474:europe-west1:querypal-db
          flags: |
            --port=8000
            --add-cloudsql-instances=gen-lang-client-0698668474:europe-west1:querypal-db
            --allow-unauthenticated

      # Build and Push Frontend Container
      - name: 'Build and Push Frontend Container'
        run: |-
          cd frontend
          DOCKER_TAG="gcr.io/${{ env.PROJECT_ID }}/${{ env.FRONTEND_SERVICE }}:${{ github.sha }}"
          docker build --tag "${DOCKER_TAG}" --platform linux/amd64 \
            --build-arg VITE_API_BASE_URL=${{ steps.deploy-backend.outputs.url }} \
            --build-arg VITE_AZURE_REDIRECT_URI=https://querypal.virtonomy.io \
            .
          docker push "${DOCKER_TAG}"

      # Deploy Frontend to Cloud Run
      - id: 'deploy-frontend'
        name: 'Deploy Frontend to Cloud Run'
        uses: 'google-github-actions/deploy-cloudrun@33553064113a37d688aa6937bacbdc481580be17' # google-github-actions/deploy-cloudrun@v2
        with:
          service: '${{ env.FRONTEND_SERVICE }}'
          region: '${{ env.REGION }}'
          image: 'gcr.io/${{ env.PROJECT_ID }}/${{ env.FRONTEND_SERVICE }}:${{ github.sha }}'
          flags: |
            --port=4000
            --allow-unauthenticated

      # Show output URLs
      - name: 'Show deployment URLs'
        run: |-
          echo "Backend URL: ${{ steps.deploy-backend.outputs.url }}"
          echo "Frontend URL: ${{ steps.deploy-frontend.outputs.url }}"