Deploy #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| on: | |
| workflow_run: | |
| # Gate on CI passing — this workflow only fires after lint/typecheck/format/test succeeds | |
| workflows: ["Lint/Typecheck/Format/Test"] | |
| types: [completed] | |
| # Only watch these branches — PRs from feature branches don't trigger this | |
| branches: [develop, main] | |
| # Required for google-github-actions/auth to request an OIDC token from GitHub | |
| permissions: | |
| id-token: write | |
| contents: read | |
| jobs: | |
| deploy-dev: | |
| # Three conditions must all be true: | |
| # 1. CI passed (not cancelled or failed) | |
| # 2. This was a push (merge), not a PR CI run | |
| # 3. The push was to develop specifically | |
| if: > | |
| github.event.workflow_run.conclusion == 'success' && | |
| github.event.workflow_run.event == 'push' && | |
| github.event.workflow_run.head_branch == 'develop' | |
| runs-on: ubuntu-latest | |
| # Scopes WIF_PROVIDER and WIF_SERVICE_ACCOUNT vars to the dev environment | |
| environment: dev | |
| steps: | |
| # Check out the exact commit that triggered CI — not just the branch HEAD | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.workflow_run.head_sha }} | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: ".nvmrc" | |
| cache: "npm" | |
| - name: Install dependencies | |
| run: npm ci | |
| # Exchange GitHub's OIDC token for a short-lived GCP access token | |
| # via Workload Identity Federation. Sets GOOGLE_APPLICATION_CREDENTIALS. | |
| - name: Authenticate to Google Cloud | |
| uses: google-github-actions/auth@v3 | |
| with: | |
| workload_identity_provider: ${{ vars.WIF_PROVIDER }} | |
| service_account: ${{ vars.WIF_SERVICE_ACCOUNT }} | |
| # Build + copy .clasp.dev.json + push using ADC credentials from the step above. | |
| # Note: the existing deploy:dev npm script calls clasp push without --adc, | |
| # so we inline the commands here instead. | |
| - name: Deploy to dev | |
| run: npm run build && cp .clasp.dev.json .clasp.json && npx clasp push --adc | |
| deploy-prod: | |
| # Same gate logic, but only fires on pushes to main | |
| if: > | |
| github.event.workflow_run.conclusion == 'success' && | |
| github.event.workflow_run.event == 'push' && | |
| github.event.workflow_run.head_branch == 'main' | |
| runs-on: ubuntu-latest | |
| environment: prod | |
| steps: | |
| # Check out the exact commit that triggered CI — not just the branch HEAD | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.workflow_run.head_sha }} | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: ".nvmrc" | |
| cache: "npm" | |
| - name: Install dependencies | |
| run: npm ci | |
| # Exchange GitHub's OIDC token for a short-lived GCP access token | |
| # via Workload Identity Federation. Sets GOOGLE_APPLICATION_CREDENTIALS. | |
| - name: Authenticate to Google Cloud | |
| uses: google-github-actions/auth@v3 | |
| with: | |
| workload_identity_provider: ${{ vars.WIF_PROVIDER }} | |
| service_account: ${{ vars.WIF_SERVICE_ACCOUNT }} | |
| # Build + copy .clasp.prod.json + push using ADC credentials from the step above. | |
| - name: Deploy to prod | |
| run: npm run build && cp .clasp.prod.json .clasp.json && npx clasp push --adc |