TakoAPI/cloudbuild.yaml at main · oratis/TakoAPI · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
# Cloud Build pipeline for takoapi (Cloud Run, us-central1).
#
# Build → deploy. The deploy step uses --update-env-vars / --update-secrets
# (NOT --set-env-vars), so any existing bindings on the Cloud Run service —
# secrets, traffic splits, manual env tweaks — are preserved. Running this
# pipeline against the live service never wipes production credentials.
#
# Manual trigger:
#   gcloud builds submit --project=takoapi-491505 --config=cloudbuild.yaml .
#
# Build-only (rare): comment out the "deploy" step. Both image tags still
# get pushed via the `images:` block at the bottom.
#
# Rollback: each build pushes us-central1-docker.pkg.dev/.../takoapi:$BUILD_ID,
# which is immutable. To roll back, redeploy the desired BUILD_ID:
#   gcloud run deploy takoapi --region=us-central1 \
#     --image=us-central1-docker.pkg.dev/takoapi-491505/takoapi-repo/takoapi:<BUILD_ID>

steps:
  - id: build
    name: gcr.io/cloud-builders/docker
    args:
      - build
      - --tag=us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:$BUILD_ID
      - --tag=us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:latest
      - .

  - id: deploy
    name: gcr.io/google.com/cloudsdktool/cloud-sdk
    waitFor: [build]
    entrypoint: gcloud
    args:
      - run
      - deploy
      - takoapi
      - --region=us-central1
      - --image=us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:$BUILD_ID
      - --platform=managed
      - --allow-unauthenticated
      - --port=8080
      - --cpu=1
      - --memory=512Mi
      - --max-instances=20
      - --add-cloudsql-instances=$PROJECT_ID:us-central1:takoapi-db
      # --update-* (not --set-*): only the listed keys are touched.
      # Secrets are bound by reference; their values never appear in this file
      # or in build logs. Manage values via:
      #   gcloud secrets versions add <NAME> --data-file=-
      - --update-env-vars=NODE_ENV=production,AUTH_TRUST_HOST=true,NEXTAUTH_URL=https://takoapi.com,GOOGLE_CLIENT_ID=429522911261-t3s9v8av3n4saed95u4vkij5oqlfjoti.apps.googleusercontent.com,APPLE_CLIENT_ID=com.takoapi.auth
      - --update-secrets=DATABASE_URL=tako-database-url:latest,NEXTAUTH_SECRET=tako-nextauth-secret:latest,GOOGLE_CLIENT_SECRET=tako-google-client-secret:latest,APPLE_CLIENT_SECRET=tako-apple-client-secret:latest,RESEND_API_KEY=tako-resend-api-key:latest,CRON_SECRET=tako-cron-secret:latest

# Both tags are pushed automatically once all steps succeed.
images:
  - us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:$BUILD_ID
  - us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:latest

options:
  logging: CLOUD_LOGGING_ONLY