fix: wait for SA propagation before IAM bindings #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy to Cloud Run | |
| on: | |
| push: | |
| branches: [main, master] | |
| workflow_dispatch: # allow manual trigger from GitHub UI | |
| env: | |
| PROJECT_ID: ${{ vars.GCP_PROJECT_ID }} | |
| REGION: us-central1 | |
| SERVICE: shipment-ai | |
| REPO: shipment-ai | |
| IMAGE: app | |
| jobs: | |
| deploy: | |
| name: Build & Deploy | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write # required for Workload Identity Federation | |
| steps: | |
| # ── 1. Checkout ────────────────────────────────────────────────────── | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| # ── 2. Authenticate to GCP via Workload Identity Federation ────────── | |
| # No long-lived service account key needed — uses OIDC token. | |
| # Set GCP_WORKLOAD_IDENTITY_PROVIDER and GCP_SERVICE_ACCOUNT in | |
| # GitHub repo → Settings → Secrets and variables → Actions → Variables. | |
| - name: Authenticate to Google Cloud | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} | |
| # ── 3. Set up Cloud SDK ─────────────────────────────────────────────── | |
| - name: Set up Cloud SDK | |
| uses: google-github-actions/setup-gcloud@v2 | |
| # ── 4. Configure Docker auth for Artifact Registry ─────────────────── | |
| - name: Configure Docker for Artifact Registry | |
| run: gcloud auth configure-docker ${{ env.REGION }}-docker.pkg.dev --quiet | |
| # ── 5. Build and push container image ──────────────────────────────── | |
| - name: Build and push image | |
| run: | | |
| IMAGE_URI="${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPO }}/${{ env.IMAGE }}" | |
| docker build \ | |
| -t "${IMAGE_URI}:${{ github.sha }}" \ | |
| -t "${IMAGE_URI}:latest" \ | |
| . | |
| docker push --all-tags "${IMAGE_URI}" | |
| # ── 6. Deploy to Cloud Run ──────────────────────────────────────────── | |
| # Stamps the commit SHA into service.yaml before deploying so each | |
| # rollout is pinned to an immutable image tag. | |
| - name: Deploy to Cloud Run | |
| run: | | |
| IMAGE_URI="${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPO }}/${{ env.IMAGE }}:${{ github.sha }}" | |
| sed "s|:latest|:${{ github.sha }}|g" service.yaml \ | |
| | sed "s|YOUR_PROJECT_ID|${{ env.PROJECT_ID }}|g" \ | |
| > /tmp/service_deploy.yaml | |
| gcloud run services replace /tmp/service_deploy.yaml \ | |
| --region ${{ env.REGION }} \ | |
| --project ${{ env.PROJECT_ID }} | |
| # ── 7. Print live URL ───────────────────────────────────────────────── | |
| - name: Get service URL | |
| run: | | |
| URL=$(gcloud run services describe ${{ env.SERVICE }} \ | |
| --region ${{ env.REGION }} \ | |
| --project ${{ env.PROJECT_ID }} \ | |
| --format='value(status.url)') | |
| echo "Deployed to: $URL" | |
| echo "url=$URL" >> $GITHUB_OUTPUT |