name: Deploy to Google Cloud Run # Triggered by the top-level Deploy dispatcher (.github/workflows/deploy.yml) # when GCP + Turso secrets are configured. Manual runs via the Actions UI # also supported. on: workflow_call: inputs: version: type: string required: false region: type: string required: false default: us-central1 workflow_dispatch: inputs: version: description: 'Release tag to deploy (e.g. v2.5.0). Leave empty for latest.' required: false region: description: 'GCP region (e.g. us-central1).' required: false default: us-central1 # Prevent overlapping deployments. concurrency: group: deploy-cloud-run cancel-in-progress: false permissions: contents: read jobs: deploy: name: Deploy runs-on: ubuntu-latest steps: - name: Check required secrets env: HAS_GCP_KEY: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY != '' }} HAS_GCP_PROJECT: ${{ secrets.GCP_PROJECT_ID != '' }} HAS_TURSO_URL: ${{ secrets.TURSO_DATABASE_URL != '' }} run: | missing=() [ "$HAS_GCP_KEY" != "true" ] && missing+=(GCP_SERVICE_ACCOUNT_KEY) [ "$HAS_GCP_PROJECT" != "true" ] && missing+=(GCP_PROJECT_ID) [ "$HAS_TURSO_URL" != "true" ] && missing+=(TURSO_DATABASE_URL) if [ ${#missing[@]} -gt 0 ]; then echo "::error::Missing required secrets: ${missing[*]}. Go to Settings → Secrets and variables → Actions." exit 1 fi - name: Resolve release tag id: release env: GH_TOKEN: ${{ github.token }} INPUT_VERSION: ${{ inputs.version }} run: | if [ -n "$INPUT_VERSION" ]; then TAG="$INPUT_VERSION" else TAG=$(gh api repos/saltbo/zpan/releases/latest --jq '.tag_name') fi if [ -z "$TAG" ]; then echo "::error::No release found in saltbo/zpan" exit 1 fi echo "version=$TAG" >> "$GITHUB_OUTPUT" echo "### 🚀 Deploying $TAG to Cloud Run" >> "$GITHUB_STEP_SUMMARY" - uses: actions/checkout@v4 with: repository: saltbo/zpan ref: ${{ steps.release.outputs.version }} - uses: pnpm/action-setup@v4 - uses: actions/setup-node@v4 with: node-version: 24 cache: pnpm - name: Authenticate to Google Cloud uses: google-github-actions/auth@v2 with: credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }} - name: Set up Cloud SDK uses: google-github-actions/setup-gcloud@v2 with: project_id: ${{ secrets.GCP_PROJECT_ID }} - name: Apply Turso migrations env: TURSO_DATABASE_URL: ${{ secrets.TURSO_DATABASE_URL }} TURSO_AUTH_TOKEN: ${{ secrets.TURSO_AUTH_TOKEN }} run: | pnpm install --frozen-lockfile pnpm db:migrate - name: Store required secrets in Secret Manager env: GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }} TURSO_DATABASE_URL: ${{ secrets.TURSO_DATABASE_URL }} run: | upsert_secret() { local name="$1" value="$2" EXISTS=$(gcloud secrets describe "$name" \ --project "$GCP_PROJECT_ID" \ --format="value(name)" 2>/dev/null || true) if [ -z "$EXISTS" ]; then printf '%s' "$value" | gcloud secrets create "$name" \ --project "$GCP_PROJECT_ID" --data-file=- else printf '%s' "$value" | gcloud secrets versions add "$name" \ --project "$GCP_PROJECT_ID" --data-file=- fi } upsert_secret turso-database-url "$TURSO_DATABASE_URL" - name: Ensure BETTER_AUTH_SECRET in Secret Manager id: auth_secret env: GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }} USER_SECRET: ${{ secrets.BETTER_AUTH_SECRET }} run: | EXISTS=$(gcloud secrets describe better-auth-secret \ --project "$GCP_PROJECT_ID" \ --format="value(name)" 2>/dev/null || true) if [ -n "$USER_SECRET" ]; then if [ -z "$EXISTS" ]; then printf '%s' "$USER_SECRET" | gcloud secrets create better-auth-secret \ --project "$GCP_PROJECT_ID" --data-file=- else printf '%s' "$USER_SECRET" | gcloud secrets versions add better-auth-secret \ --project "$GCP_PROJECT_ID" --data-file=- fi echo "Set BETTER_AUTH_SECRET from GitHub secret." elif [ -z "$EXISTS" ]; then openssl rand -base64 32 | gcloud secrets create better-auth-secret \ --project "$GCP_PROJECT_ID" --data-file=- echo "auto_generated=true" >> "$GITHUB_OUTPUT" echo "Auto-generated BETTER_AUTH_SECRET and stored in Secret Manager." else echo "BETTER_AUTH_SECRET already exists in Secret Manager, skipping." fi - name: Build container image env: GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }} VERSION: ${{ steps.release.outputs.version }} run: | gcloud builds submit \ --tag "gcr.io/$GCP_PROJECT_ID/zpan:$VERSION" \ --project "$GCP_PROJECT_ID" \ . - name: Deploy service from manifest id: deploy env: GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }} REGION: ${{ inputs.region || 'us-central1' }} VERSION: ${{ steps.release.outputs.version }} run: | # Substitute PROJECT_ID placeholder and pin the image tag sed -i \ -e "s|PROJECT_ID|$GCP_PROJECT_ID|g" \ -e "s|zpan:latest|zpan:$VERSION|g" \ deploy/cloud-run/service.yaml # Create or update the service from the manifest gcloud run services replace deploy/cloud-run/service.yaml \ --region "$REGION" \ --project "$GCP_PROJECT_ID" # Allow public unauthenticated access gcloud run services add-iam-policy-binding zpan \ --region "$REGION" \ --project "$GCP_PROJECT_ID" \ --member=allUsers \ --role=roles/run.invoker # Capture the service URL for the post-deploy step SERVICE_URL=$(gcloud run services describe zpan \ --region "$REGION" \ --project "$GCP_PROJECT_ID" \ --format="value(status.url)") echo "url=$SERVICE_URL" >> "$GITHUB_OUTPUT" - name: Wire BETTER_AUTH_URL and optional secrets env: GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }} REGION: ${{ inputs.region || 'us-central1' }} TURSO_AUTH_TOKEN: ${{ secrets.TURSO_AUTH_TOKEN }} BETTER_AUTH_URL: ${{ secrets.BETTER_AUTH_URL }} SERVICE_URL: ${{ steps.deploy.outputs.url }} run: | upsert_secret() { local name="$1" value="$2" EXISTS=$(gcloud secrets describe "$name" \ --project "$GCP_PROJECT_ID" \ --format="value(name)" 2>/dev/null || true) if [ -z "$EXISTS" ]; then printf '%s' "$value" | gcloud secrets create "$name" \ --project "$GCP_PROJECT_ID" --data-file=- else printf '%s' "$value" | gcloud secrets versions add "$name" \ --project "$GCP_PROJECT_ID" --data-file=- fi } # BETTER_AUTH_URL: user-supplied custom domain takes priority; fall back to the # service URL assigned by Cloud Run on first deploy. EFFECTIVE_URL="${BETTER_AUTH_URL:-$SERVICE_URL}" upsert_secret better-auth-url "$EFFECTIVE_URL" UPDATE_SECRETS="BETTER_AUTH_URL=better-auth-url:latest" # TURSO_AUTH_TOKEN is optional (omit for file:// local Turso URLs). if [ -n "$TURSO_AUTH_TOKEN" ]; then upsert_secret turso-auth-token "$TURSO_AUTH_TOKEN" UPDATE_SECRETS="$UPDATE_SECRETS,TURSO_AUTH_TOKEN=turso-auth-token:latest" fi gcloud run services update zpan \ --region "$REGION" \ --project "$GCP_PROJECT_ID" \ --update-secrets="$UPDATE_SECRETS" echo "**Deployed to:** $SERVICE_URL" >> "$GITHUB_STEP_SUMMARY" if [ "${{ steps.auth_secret.outputs.auto_generated }}" = "true" ]; then echo "" >> "$GITHUB_STEP_SUMMARY" echo "> ⚠️ **BETTER_AUTH_SECRET was auto-generated** and stored in Secret Manager. Back it up from the GCP console before rotating." >> "$GITHUB_STEP_SUMMARY" fi