deploy.yml

# Deploy to Google Cloud Run via Workload Identity Federation. The Cloud
# Run service pulls the deploy image from an Artifact Registry remote
# repository that proxies GHCR (Cloud Run can't pull from GHCR directly).
#
# The one-time GCP setup (AR remote repo, Workload Identity pool and
# provider, deploy service account and its role bindings) is provisioned
# out of band by the maintainer; this workflow assumes it already exists.
name: deploy

on:
  workflow_dispatch:
    inputs:
      image_tag:
        description: "GHCR image tag (default 'main' = latest CI-baked image)"
        required: true
        default: "main"

permissions:
  contents: read
  id-token: write    # required for WIF OIDC token

concurrency:
  group: deploy
  cancel-in-progress: false

env:
  GCP_REGION: europe-west1
  GHCR_REMOTE_REPO: ghcr-remote
  SERVICE_NAME: spectrarag

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Authenticate to GCP (Workload Identity Federation)
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID }}
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT_EMAIL }}
          # Mint an access token directly (vs default credentials-file mode)
          # so downstream `gcloud` calls use the bearer token rather than
          # re-impersonating the SA themselves. Avoids the "getAccessToken
          # denied" failure mode where gcloud's auth refresh path can't
          # impersonate even though the federated identity has tokenCreator.
          token_format: "access_token"

      - name: Compute image URI
        id: image
        env:
          IMAGE_TAG: ${{ github.event.inputs.image_tag }}
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          REPO_LOWER=$(echo "$REPO" | tr '[:upper:]' '[:lower:]')
          # Resolve the tag to its immutable digest at GHCR before deploying.
          # The AR remote repository caches manifests, so pulling a moving tag
          # (":main") through it can silently deploy a stale image; a digest
          # pull cannot be stale. The image is public, so the anonymous pull
          # token is enough.
          TOKEN=$(curl -fsSL "https://ghcr.io/token?scope=repository:${REPO_LOWER}:pull" | jq -r .token)
          DIGEST=$(curl -fsSI \
            -H "Authorization: Bearer ${TOKEN}" \
            -H "Accept: application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.docker.distribution.manifest.v2+json" \
            "https://ghcr.io/v2/${REPO_LOWER}/manifests/${IMAGE_TAG}" \
            | tr -d '\r' | awk 'tolower($1)=="docker-content-digest:"{print $2}')
          test -n "$DIGEST"
          URI="${GCP_REGION}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${GHCR_REMOTE_REPO}/${REPO_LOWER}@${DIGEST}"
          echo "uri=$URI" >> "$GITHUB_OUTPUT"
          echo "Image: ${IMAGE_TAG} -> ${DIGEST}"

      - name: Deploy to Cloud Run
        id: deploy
        uses: google-github-actions/deploy-cloudrun@v3
        with:
          service: ${{ env.SERVICE_NAME }}
          image: ${{ steps.image.outputs.uri }}
          region: ${{ env.GCP_REGION }}
          # --update-env-vars MERGES (does not replace), so the out-of-band env
          # config (corpus collection, pages dir, etc.) is preserved. Enables the
          # experimental DCI mode; with no server key it runs on the caller's key.
          # max-instances=1 + timeout bound the worst-case Cloud Run burn rate.
          # ADR 0028: 16Gi/4vCPU fits the in-process ColQwen2 query encoder (2B,
          # fp32 ~8GB) alongside bge-m3; Cloud Run requires >=4 vCPU at 16Gi.
          # RAG_ENABLE_MULTIMODAL turns the visual leg on (it stays inert unless
          # the visual collection is populated in the baked Qdrant snapshot).
          flags: --port=8000 --memory=16Gi --cpu=4 --cpu-boost --min-instances=0 --max-instances=1 --timeout=120 --allow-unauthenticated --update-env-vars=RAG_ENABLE_DCI=true,RAG_ENABLE_MULTIMODAL=true

      - name: Print URL
        run: |
          URL="${{ steps.deploy.outputs.url }}"
          echo "::notice::Deployed to $URL"
          {
            echo "## Deployed"
            echo "- URL: $URL"
            echo "- Image: \`${{ steps.image.outputs.uri }}\`"
          } >> "$GITHUB_STEP_SUMMARY"