Fix CI deploy: skip API/IAM bootstrap, match prod env. #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Cloud Run CD — mirrors `backend/deployment/deploy.py --apply` (see docs/DEMO_RUNBOOK.md). | |
| # | |
| # Secrets (repository settings → Secrets and variables → Actions): | |
| # GCP_SA_KEY — JSON key for a deployer SA (needs run.admin, cloudbuild, iam.serviceAccountUser, | |
| # secretmanager accessor as deploy.py grants). Same pattern as the manual `live` job in ci.yml. | |
| # GOOGLE_CLOUD_PROJECT — optional repo variable; defaults below match the hackathon project. | |
| # | |
| # Automatic deploy on push to main runs ONLY when GCP_SA_KEY is set. Otherwise use Actions → Deploy → Run workflow. | |
| # Future: replace GCP_SA_KEY with Workload Identity Federation (keyless GitHub OIDC → GCP). | |
| name: deploy | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| jobs: | |
| deploy-cloud-run: | |
| name: deploy Cloud Run (deploy.py --apply) | |
| runs-on: ubuntu-latest | |
| env: | |
| GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }} | |
| GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_CLOUD_PROJECT || 'gen-lang-client-0190297078' }} | |
| GOOGLE_CLOUD_LOCATION: us-central1 | |
| GOOGLE_GENAI_USE_VERTEXAI: "true" | |
| # Match local demo redeploy (docs/DEMO_RUNBOOK.md §3); override via repo variables if needed. | |
| DEPLOY_SKIP_BOOTSTRAP: "1" | |
| CLOUD_SQL_INSTANCE: ${{ vars.CLOUD_SQL_INSTANCE || 'gen-lang-client-0190297078:us-central1:dry-lab-sessions' }} | |
| ARTIFACT_BUCKET: ${{ vars.ARTIFACT_BUCKET || 'dry-lab-spine-gen-lang-client-0190297078' }} | |
| DRYLAB_PROVENANCE_BUCKET: ${{ vars.DRYLAB_PROVENANCE_BUCKET || 'gen-lang-client-0190297078-drylab-provenance' }} | |
| BQ_DATASET: dry_lab | |
| FIVETRAN_TRANSFORMATION_ID: ${{ vars.FIVETRAN_TRANSFORMATION_ID || 'asthma_craft' }} | |
| FIVETRAN_CONNECTION_ID: ${{ vars.FIVETRAN_CONNECTION_ID || 'inauguration_multiplying' }} | |
| FIVETRAN_SAMPLES_CONNECTION_ID: ${{ vars.FIVETRAN_SAMPLES_CONNECTION_ID || 'stark_male' }} | |
| FIVETRAN_ALLOW_WRITES: "true" | |
| WIRE_FIVETRAN_SECRETS: "1" | |
| WIRE_ACTIVATION_SECRET: "1" | |
| FIVETRAN_ACTIVATION_ID: ${{ vars.FIVETRAN_ACTIVATION_ID || '3564985' }} | |
| CLOUD_RUN_MIN_INSTANCES: ${{ vars.CLOUD_RUN_MIN_INSTANCES || '1' }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - id: auth | |
| if: ${{ env.GCP_SA_KEY != '' }} | |
| run: echo "has_key=true" >> "$GITHUB_OUTPUT" | |
| - name: Skip (no GCP_SA_KEY on push) | |
| if: ${{ env.GCP_SA_KEY == '' }} | |
| run: | | |
| echo "GCP_SA_KEY is not configured — skipping deploy." | |
| echo "Add the secret or run this workflow manually after configuring WIF/SA key." | |
| exit 0 | |
| - uses: google-github-actions/auth@v2 | |
| if: ${{ env.GCP_SA_KEY != '' }} | |
| with: | |
| credentials_json: ${{ secrets.GCP_SA_KEY }} | |
| - uses: google-github-actions/setup-gcloud@v2 | |
| if: ${{ env.GCP_SA_KEY != '' }} | |
| - name: Deploy via deployment.deploy --apply | |
| if: ${{ env.GCP_SA_KEY != '' }} | |
| working-directory: backend | |
| run: python3 -m deployment.deploy --apply |