mirror of
https://github.com/saltbo/zpan.git
synced 2026-08-29 08:16:58 +08:00
Jasper Van
f701f4139a
Clears all 23 open CodeQL alerts:
- actions/missing-workflow-permissions (19, medium): add a top-level
least-privilege `permissions: contents: read` to ci.yml and the 7
deploy workflows. The one CI job that needs `packages: write` already
declares its own block; all deploys authenticate via static secrets
(no OIDC / id-token, no repo writes), so read is sufficient.
- js/insecure-randomness (1, high): `genPassword()` built share
passwords with Math.random(); switch to crypto.getRandomValues() over
the same unambiguous alphabet (length/charset/uniqueness preserved).
- js/incomplete-url-substring-sanitization (2, high): two test fetch
stubs routed on `String(url).includes('api.github.com')`; tighten to
`new URL(url).hostname === 'api.github.com'` — precise and no longer
flagged.
- js/stack-trace-exposure (1, medium): the E2E S3 mock echoed
error.message in 500 responses; log server-side and return a generic
body instead.
Verified: typecheck green; share-dialog/changelog/system.integration
tests pass.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
234 lines
8.6 KiB
YAML
234 lines
8.6 KiB
YAML
name: Deploy to Google Cloud Run
|
|
|
|
# Triggered by the top-level Deploy dispatcher (.github/workflows/deploy.yml)
|
|
# when GCP + Turso secrets are configured. Manual runs via the Actions UI
|
|
# also supported.
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
version:
|
|
type: string
|
|
required: false
|
|
region:
|
|
type: string
|
|
required: false
|
|
default: us-central1
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'Release tag to deploy (e.g. v2.5.0). Leave empty for latest.'
|
|
required: false
|
|
region:
|
|
description: 'GCP region (e.g. us-central1).'
|
|
required: false
|
|
default: us-central1
|
|
|
|
# Prevent overlapping deployments.
|
|
concurrency:
|
|
group: deploy-cloud-run
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
deploy:
|
|
name: Deploy
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check required secrets
|
|
env:
|
|
HAS_GCP_KEY: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY != '' }}
|
|
HAS_GCP_PROJECT: ${{ secrets.GCP_PROJECT_ID != '' }}
|
|
HAS_TURSO_URL: ${{ secrets.TURSO_DATABASE_URL != '' }}
|
|
run: |
|
|
missing=()
|
|
[ "$HAS_GCP_KEY" != "true" ] && missing+=(GCP_SERVICE_ACCOUNT_KEY)
|
|
[ "$HAS_GCP_PROJECT" != "true" ] && missing+=(GCP_PROJECT_ID)
|
|
[ "$HAS_TURSO_URL" != "true" ] && missing+=(TURSO_DATABASE_URL)
|
|
if [ ${#missing[@]} -gt 0 ]; then
|
|
echo "::error::Missing required secrets: ${missing[*]}. Go to Settings → Secrets and variables → Actions."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Resolve release tag
|
|
id: release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
INPUT_VERSION: ${{ inputs.version }}
|
|
run: |
|
|
if [ -n "$INPUT_VERSION" ]; then
|
|
TAG="$INPUT_VERSION"
|
|
else
|
|
TAG=$(gh api repos/saltbo/zpan/releases/latest --jq '.tag_name')
|
|
fi
|
|
if [ -z "$TAG" ]; then
|
|
echo "::error::No release found in saltbo/zpan"
|
|
exit 1
|
|
fi
|
|
echo "version=$TAG" >> "$GITHUB_OUTPUT"
|
|
echo "### 🚀 Deploying $TAG to Cloud Run" >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
repository: saltbo/zpan
|
|
ref: ${{ steps.release.outputs.version }}
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: Authenticate to Google Cloud
|
|
uses: google-github-actions/auth@v2
|
|
with:
|
|
credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
|
|
|
|
- name: Set up Cloud SDK
|
|
uses: google-github-actions/setup-gcloud@v2
|
|
with:
|
|
project_id: ${{ secrets.GCP_PROJECT_ID }}
|
|
|
|
- name: Apply Turso migrations
|
|
env:
|
|
TURSO_DATABASE_URL: ${{ secrets.TURSO_DATABASE_URL }}
|
|
TURSO_AUTH_TOKEN: ${{ secrets.TURSO_AUTH_TOKEN }}
|
|
run: |
|
|
pnpm install --frozen-lockfile
|
|
pnpm db:migrate
|
|
|
|
- name: Store required secrets in Secret Manager
|
|
env:
|
|
GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
|
|
TURSO_DATABASE_URL: ${{ secrets.TURSO_DATABASE_URL }}
|
|
run: |
|
|
upsert_secret() {
|
|
local name="$1" value="$2"
|
|
EXISTS=$(gcloud secrets describe "$name" \
|
|
--project "$GCP_PROJECT_ID" \
|
|
--format="value(name)" 2>/dev/null || true)
|
|
if [ -z "$EXISTS" ]; then
|
|
printf '%s' "$value" | gcloud secrets create "$name" \
|
|
--project "$GCP_PROJECT_ID" --data-file=-
|
|
else
|
|
printf '%s' "$value" | gcloud secrets versions add "$name" \
|
|
--project "$GCP_PROJECT_ID" --data-file=-
|
|
fi
|
|
}
|
|
upsert_secret turso-database-url "$TURSO_DATABASE_URL"
|
|
|
|
- name: Ensure BETTER_AUTH_SECRET in Secret Manager
|
|
id: auth_secret
|
|
env:
|
|
GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
|
|
USER_SECRET: ${{ secrets.BETTER_AUTH_SECRET }}
|
|
run: |
|
|
EXISTS=$(gcloud secrets describe better-auth-secret \
|
|
--project "$GCP_PROJECT_ID" \
|
|
--format="value(name)" 2>/dev/null || true)
|
|
if [ -n "$USER_SECRET" ]; then
|
|
if [ -z "$EXISTS" ]; then
|
|
printf '%s' "$USER_SECRET" | gcloud secrets create better-auth-secret \
|
|
--project "$GCP_PROJECT_ID" --data-file=-
|
|
else
|
|
printf '%s' "$USER_SECRET" | gcloud secrets versions add better-auth-secret \
|
|
--project "$GCP_PROJECT_ID" --data-file=-
|
|
fi
|
|
echo "Set BETTER_AUTH_SECRET from GitHub secret."
|
|
elif [ -z "$EXISTS" ]; then
|
|
openssl rand -base64 32 | gcloud secrets create better-auth-secret \
|
|
--project "$GCP_PROJECT_ID" --data-file=-
|
|
echo "auto_generated=true" >> "$GITHUB_OUTPUT"
|
|
echo "Auto-generated BETTER_AUTH_SECRET and stored in Secret Manager."
|
|
else
|
|
echo "BETTER_AUTH_SECRET already exists in Secret Manager, skipping."
|
|
fi
|
|
|
|
- name: Build container image
|
|
env:
|
|
GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
|
|
VERSION: ${{ steps.release.outputs.version }}
|
|
run: |
|
|
gcloud builds submit \
|
|
--tag "gcr.io/$GCP_PROJECT_ID/zpan:$VERSION" \
|
|
--project "$GCP_PROJECT_ID" \
|
|
.
|
|
|
|
- name: Deploy service from manifest
|
|
id: deploy
|
|
env:
|
|
GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
|
|
REGION: ${{ inputs.region || 'us-central1' }}
|
|
VERSION: ${{ steps.release.outputs.version }}
|
|
run: |
|
|
# Substitute PROJECT_ID placeholder and pin the image tag
|
|
sed -i \
|
|
-e "s|PROJECT_ID|$GCP_PROJECT_ID|g" \
|
|
-e "s|zpan:latest|zpan:$VERSION|g" \
|
|
deploy/cloud-run/service.yaml
|
|
|
|
# Create or update the service from the manifest
|
|
gcloud run services replace deploy/cloud-run/service.yaml \
|
|
--region "$REGION" \
|
|
--project "$GCP_PROJECT_ID"
|
|
|
|
# Allow public unauthenticated access
|
|
gcloud run services add-iam-policy-binding zpan \
|
|
--region "$REGION" \
|
|
--project "$GCP_PROJECT_ID" \
|
|
--member=allUsers \
|
|
--role=roles/run.invoker
|
|
|
|
# Capture the service URL for the post-deploy step
|
|
SERVICE_URL=$(gcloud run services describe zpan \
|
|
--region "$REGION" \
|
|
--project "$GCP_PROJECT_ID" \
|
|
--format="value(status.url)")
|
|
echo "url=$SERVICE_URL" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Wire BETTER_AUTH_URL and optional secrets
|
|
env:
|
|
GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
|
|
REGION: ${{ inputs.region || 'us-central1' }}
|
|
TURSO_AUTH_TOKEN: ${{ secrets.TURSO_AUTH_TOKEN }}
|
|
BETTER_AUTH_URL: ${{ secrets.BETTER_AUTH_URL }}
|
|
SERVICE_URL: ${{ steps.deploy.outputs.url }}
|
|
run: |
|
|
upsert_secret() {
|
|
local name="$1" value="$2"
|
|
EXISTS=$(gcloud secrets describe "$name" \
|
|
--project "$GCP_PROJECT_ID" \
|
|
--format="value(name)" 2>/dev/null || true)
|
|
if [ -z "$EXISTS" ]; then
|
|
printf '%s' "$value" | gcloud secrets create "$name" \
|
|
--project "$GCP_PROJECT_ID" --data-file=-
|
|
else
|
|
printf '%s' "$value" | gcloud secrets versions add "$name" \
|
|
--project "$GCP_PROJECT_ID" --data-file=-
|
|
fi
|
|
}
|
|
|
|
# BETTER_AUTH_URL: user-supplied custom domain takes priority; fall back to the
|
|
# service URL assigned by Cloud Run on first deploy.
|
|
EFFECTIVE_URL="${BETTER_AUTH_URL:-$SERVICE_URL}"
|
|
upsert_secret better-auth-url "$EFFECTIVE_URL"
|
|
UPDATE_SECRETS="BETTER_AUTH_URL=better-auth-url:latest"
|
|
|
|
# TURSO_AUTH_TOKEN is optional (omit for file:// local Turso URLs).
|
|
if [ -n "$TURSO_AUTH_TOKEN" ]; then
|
|
upsert_secret turso-auth-token "$TURSO_AUTH_TOKEN"
|
|
UPDATE_SECRETS="$UPDATE_SECRETS,TURSO_AUTH_TOKEN=turso-auth-token:latest"
|
|
fi
|
|
|
|
gcloud run services update zpan \
|
|
--region "$REGION" \
|
|
--project "$GCP_PROJECT_ID" \
|
|
--update-secrets="$UPDATE_SECRETS"
|
|
|
|
echo "**Deployed to:** $SERVICE_URL" >> "$GITHUB_STEP_SUMMARY"
|
|
if [ "${{ steps.auth_secret.outputs.auto_generated }}" = "true" ]; then
|
|
echo "" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "> ⚠️ **BETTER_AUTH_SECRET was auto-generated** and stored in Secret Manager. Back it up from the GCP console before rotating." >> "$GITHUB_STEP_SUMMARY"
|
|
fi
|