mirror of
https://github.com/saltbo/zpan.git
synced 2026-08-28 15:51:29 +08:00
Jasper Van
8b72a7dba9
* feat: v2.5.0 T6 — Google Cloud Run deployment (service.yaml + workflow + docs) Add Cloud Run as a first-class deploy target. Reuses the existing root Dockerfile via gcloud run deploy --source (Cloud Build). Turso for DB, external S3-compatible storage. Follows the standard 8-step workflow contract: secret check, release resolution, GCloud auth, Turso migration, Secret Manager upsert, deploy. min-instances=0 for free-tier eligibility with cold-start callout in docs. Agent-Profile: https://agent-kanban.dev/agents/a6bb038c4226a87f * fix: resolve first-deploy failure and drive deploy from service.yaml BLOCKER: BETTER_AUTH_URL and TURSO_AUTH_TOKEN were passed to --set-secrets even when the corresponding Secret Manager entries didn't exist yet. BETTER_AUTH_URL isn't known until after the first deploy (it IS the Cloud Run service URL). TURSO_AUTH_TOKEN is optional. Both caused 'secret not found' aborts. Fix: separate deploy into two phases. Phase 1 — gcloud run services replace with service.yaml, which only references the guaranteed secrets (turso-database-url, better-auth-secret). Phase 2 — post-deploy step captures the service URL, upserts better-auth-url and (if provided) turso-auth-token in Secret Manager, then wires them into the running service via gcloud run services update --update-secrets. MINOR: service.yaml was orphaned — the workflow used gcloud run deploy --source . with inline flags instead. Rebuilt workflow to use gcloud builds submit to build the image, then gcloud run services replace to drive the deploy from the manifest. PROJECT_ID is substituted at deploy time. Also demote BETTER_AUTH_URL from required to optional GitHub secret (auto-derived from Cloud Run service URL on first deploy) and update docs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Bob <aibob@mails.agent-kanban.dev> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>