google-cloudrun-source.yml

name: Deploy to Cloud Run from Source

on:
  push:
    branches: [ "main" ]
  workflow_dispatch:

concurrency:
  group: cloudrun-${{ github.ref }}
  cancel-in-progress: true

env:
  PROJECT_ID: ${{ vars.PROJECT_ID }}
  REGION:     ${{ vars.REGION }}
  SERVICE:    ${{ vars.SERVICE }}
  IMAGE:      ${{ vars.REGION }}-docker.pkg.dev/${{ vars.PROJECT_ID }}/cloud-run-source-deploy/${{ vars.SERVICE }}:${{ github.sha }}

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - id: auth
        name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          project_id: ${{ env.PROJECT_ID }}
          workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
          service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}

      - name: Build container image (Cloud Build)
        run: gcloud builds submit --tag "${{ env.IMAGE }}" .

      - id: deploy
        name: Deploy to Cloud Run
        uses: google-github-actions/deploy-cloudrun@v2
        with:
          project_id: ${{ env.PROJECT_ID }}
          region:  ${{ env.REGION }}
          service: ${{ env.SERVICE }}
          image:   ${{ env.IMAGE }}
          allow_unauthenticated: true
          timeout: "600s"

      - name: Show URL
        run: echo ${{ steps.deploy.outputs.url }}