Merge pull request #5 from sanspace/feat/release-infra

work in progress for private release

Author: sanspace

.gitignore

@@ -10,6 +10,7 @@ local/
 
 # Terraform state and providers
 /.terraform/
+.terraform/
 
 # Ignore all content inside environments directories...
 **/environments/*

deploy.sh

@@ -15,8 +15,20 @@
 
 set -e
 
+# --- Argument Parsing ---
+TARGET_VERSION="latest"
+while [[ "$#" -gt 0 ]]; do
+    case $1 in
+        -v|--version) TARGET_VERSION="$2"; shift ;;
+        *) warn "Unknown parameter: $1"; echo "Usage: ./deploy.sh [--version v1.2.0]"; exit 1 ;;
+    esac
+    shift
+done
+
+info "Target Release Version: ${C_YELLOW}${TARGET_VERSION}${C_RESET}"
+
 # --- Configuration ---
-REQUIRED_TERRAFORM_VERSION="1.15.1"
+REQUIRED_TERRAFORM_VERSION="1.15.5"
 UPSTREAM_REPO_URL="https://github.com/GoogleCloudPlatform/gcc-creative-studio"
 TEMPLATE_ENV_DIR="environments/example"
 DEFAULT_ENV_NAME="dev"
@@ -312,6 +324,13 @@ configure_environment() {
         info "Configuring terraform.tfvars..."
         sed -i.bak "s|^[#[:space:]]*project_id[[:space:]]*=.*|project_id = \"$GCP_PROJECT_ID\"|g" "$TFVARS_FILE_PATH"
         sed -i.bak "s|^[#[:space:]]*environment[[:space:]]*=.*|environment = \"$ENV_NAME\"|g" "$TFVARS_FILE_PATH"
+
+        # Ensure the target version is passed to Terraform
+        if grep -q "app_version" "$TFVARS_FILE_PATH"; then
+            sed -i.bak "s|^[#[:space:]]*app_version[[:space:]]*=.*|app_version = \"$TARGET_VERSION\"|g" "$TFVARS_FILE_PATH" && rm -f "${TFVARS_FILE_PATH}.bak"
+        else
+            echo -e "\napp_version = \"$TARGET_VERSION\"" >> "$TFVARS_FILE_PATH"
+        fi
 
         prompt_and_update_tfvar "Region to deploy resources into" "us-central1" "region" "DEPLOY_REGION"
         prompt_and_update_tfvar "Resource naming prefix" "cs" "resource_prefix" "RES_PREFIX"

infrastructure/app.tf

@@ -16,12 +16,17 @@ module "compute" {
   region          = var.region
   resource_prefix = var.resource_prefix
   environment     = var.environment
+  
+  # The deployment script dynamically sets this value (e.g., "latest" or "v1.2.0")
+  app_version     = var.app_version
 
   # Direct VPC routing configurations
   vpc_subnet_name = module.network.cloud_run_subnet_name
   database_ip     = module.database.private_ip_address
-  image_url       = "${module.artifact.repository_url}/${var.backend_image_name}:${var.backend_image_tag}"
+  
+  # Dynamically construct the image URL using the injected app_version
+  image_url       = "${module.artifact.repository_url}/${var.backend_image_name}:${var.app_version}"
 
   # References the list keys to configure secret environment block mappings
-  secret_ids = var.application_secrets
-}
+  secret_ids      = var.application_secrets
+}

infrastructure/modules/artifact/main.tf

@@ -1,23 +1,11 @@
 # infra/modules/artifact-registry/main.tf
 
-resource "google_artifact_registry_repository" "ghcr_proxy" {
+resource "google_artifact_registry_repository" "cstudio_repo" {
   location      = var.region
   repository_id = "${var.resource_prefix}-${var.environment}-${var.repository_id}"
-  description   = "Regional proxy for GHCR with vulnerability scanning"
+  description   = "Local private registry for Creative Studio with vulnerability scanning"
   format        = "DOCKER"
 
-  # Remote Repository Mode
-  mode = "REMOTE_REPOSITORY"
-
-  remote_repository_config {
-    description = "Proxy for GitHub Container Registry"
-    docker_repository {
-      custom_repository {
-        uri = var.remote_uri
-      }
-    }
-  }
-
   # Explicitly enable vulnerability scanning
   # Note: This requires 'containerscanning.googleapis.com' to be enabled in the project
   # Ensure the mirror scans every image it caches
@@ -35,7 +23,7 @@ resource "google_artifact_registry_repository" "ghcr_proxy" {
   }
 
   labels = merge(var.labels, {
-    component = "security-mirror"
+    component = "artifact-registry"
     region    = var.region
   })
 }

infrastructure/modules/artifact/outputs.tf

@@ -1,14 +1,16 @@
 output "repository_id" {
   description = "The ID of the Artifact Registry repository."
-  value       = google_artifact_registry_repository.ghcr_proxy.repository_id
+  value       = google_artifact_registry_repository.cstudio_repo.repository_id
 }
 
 output "repository_name" {
   description = "The fully qualified name of the repository."
-  value       = google_artifact_registry_repository.ghcr_proxy.name
+  value       = google_artifact_registry_repository.cstudio_repo.name
 }
 
+
 output "repository_url" {
-  description = "The URL of the repository (without image name)."
-  value       = "${var.region}-docker.pkg.dev/${var.project_id}/${google_artifact_registry_repository.ghcr_proxy.repository_id}"
+  description = "The fully qualified URL to the local Docker repository."
+  # Format: us-central1-docker.pkg.dev/project-id/cs-dev-repo
+  value       = "${google_artifact_registry_repository.cstudio_repo.location}-docker.pkg.dev/${google_artifact_registry_repository.cstudio_repo.project}/${google_artifact_registry_repository.cstudio_repo.repository_id}"
 }

infrastructure/modules/compute/main.tf

@@ -42,7 +42,7 @@ locals {
 
 resource "google_cloud_run_v2_service" "backend" {
   name                = var.service_name
-  location            = var.gcp_region
+  location            = var.region
   custom_audiences    = var.custom_audiences
   deletion_protection = false
 

infrastructure/modules/compute/variables.tf

@@ -138,3 +138,9 @@ variable "run_sa_project_roles" {
     "roles/secretmanager.secretAccessor",
   ]
 }
+
+variable "app_version" {
+  type = string
+  description = "version of the creative studio app we're deploying"
+  default = "latest"
+}

infrastructure/data.tf infrastructure/storage.tfinfrastructure/data.tf renamed to infrastructure/storage.tf

@@ -82,4 +82,8 @@ variable "labels" {
   default     = {}
 }
 
-
+variable "app_version" {
+  type = string
+  description = "version of the creative studio app we're deploying"
+  default = "latest"
+}