release #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| # Tag-driven deploy of the transport server (cmd/server) to Cloud Run. | |
| # | |
| # Pushing a semver tag (v1.2.3) builds the server image from this repo at | |
| # that tag and deploys it. Keyless auth via Workload Identity Federation | |
| # (the deployer SA is owner-scoped, so this public repo can use it). No | |
| # secrets are needed — the server builds from this module alone and | |
| # llmgate is a public tagged dependency. | |
| # | |
| # workflow_dispatch is also enabled for manual re-deploys / testing. | |
| # | |
| # Migrations run on container boot, so the deploy applies any pending | |
| # engine/server DB migrations automatically. The control plane has its | |
| # own deploy path (vectorless-deploy); this workflow only ships the server. | |
| on: | |
| push: | |
| tags: ["v*.*.*"] | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: read | |
| id-token: write # required for the WIF OIDC token | |
| jobs: | |
| deploy-server: | |
| runs-on: ubuntu-latest | |
| env: | |
| GCP_PROJECT: ${{ vars.GCP_PROJECT }} | |
| GCP_REGION: ${{ vars.GCP_REGION }} | |
| AR_REPO: ${{ vars.AR_REPO }} | |
| steps: | |
| - name: Checkout (at the tag / triggering ref) | |
| uses: actions/checkout@v4 | |
| - name: Authenticate to GCP (WIF) | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| project_id: ${{ vars.GCP_PROJECT }} | |
| workload_identity_provider: ${{ vars.GCP_WIF_PROVIDER }} | |
| service_account: ${{ vars.GCP_DEPLOY_SA }} | |
| - name: Set up gcloud | |
| uses: google-github-actions/setup-gcloud@v2 | |
| - name: Configure Docker for Artifact Registry | |
| run: gcloud auth configure-docker "${GCP_REGION}-docker.pkg.dev" --quiet | |
| - name: Build + push server image | |
| run: | | |
| VER="${GITHUB_REF_NAME}" # tag name on a tag push, else branch name | |
| IMG="${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT}/${AR_REPO}/server" | |
| docker build \ | |
| -f Dockerfile.server \ | |
| --build-arg VERSION="${VER}" \ | |
| -t "${IMG}:${VER}" -t "${IMG}:latest" \ | |
| . | |
| docker push "${IMG}:${VER}" | |
| docker push "${IMG}:latest" | |
| echo "SERVER_IMG=${IMG}:${VER}" >> "$GITHUB_ENV" | |
| - name: Deploy server (image-only update) | |
| run: | | |
| gcloud run deploy vectorless-server \ | |
| --image="${SERVER_IMG}" \ | |
| --region="${GCP_REGION}" \ | |
| --project="${GCP_PROJECT}" \ | |
| --quiet | |
| - name: Summary | |
| if: always() | |
| run: | | |
| { | |
| echo "### Server release" | |
| echo "- ref: \`${GITHUB_REF_NAME}\`" | |
| echo "- image: \`${SERVER_IMG:-build failed}\`" | |
| } >> "$GITHUB_STEP_SUMMARY" |