deploy.yml

name: Deploy to Cloud Run

on:
  push:
    branches: ["master"]

concurrency:
  group: deploy-main
  cancel-in-progress: true

permissions:
  contents: read
  id-token: write

env:
  # Default values; you can override these with GitHub Variables
  DOCKERHUB_REPO: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/webnotetakingapp
  GCP_REGION: ${{ vars.GCP_REGION || 'europe-west1' }}
  SERVICE_NAME: ${{ vars.SERVICE_NAME || 'webnotetakingapp-service' }}

jobs:
  deploy:
    name: Build, Push, and Deploy
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Derive short SHA
        id: vars
        shell: bash
        run: |
          echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"

      - name: Build and push image (cached)
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          provenance: false
          tags: |
            ${{ env.DOCKERHUB_REPO }}:${{ steps.vars.outputs.SHORT_SHA }}
            ${{ env.DOCKERHUB_REPO }}:main
            ${{ env.DOCKERHUB_REPO }}:latest
          cache-from: |
            type=gha
            type=registry,ref=${{ env.DOCKERHUB_REPO }}:buildcache
          cache-to: |
            type=gha,mode=max
            type=registry,ref=${{ env.DOCKERHUB_REPO }}:buildcache,mode=max,compression=zstd

      - name: Authenticate to Google Cloud (Workload Identity Federation)
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT_EMAIL }}

      - name: Set up gcloud SDK
        uses: google-github-actions/setup-gcloud@v3

      - name: Deploy to Cloud Run
        shell: bash
        env:
          IMAGE: ${{ env.DOCKERHUB_REPO }}:${{ steps.vars.outputs.SHORT_SHA }}
        run: |
          if [[ -z "${SERVICE_NAME}" ]]; then
            echo "SERVICE_NAME variable is not set (Repository variable)." >&2
            exit 1
          fi

          gcloud run deploy "${SERVICE_NAME}" \
            --image "$IMAGE" \
            --region "${GCP_REGION}" \
            --platform managed \
            --allow-unauthenticated \
            --port 3000 \
            --set-env-vars NODE_ENV=production,\
            --set-secrets MONGODB_URI=NOTE_MONGODB_URI:latest,SESSION_SECRET=NOTE_SESSION_SECRET:latest,GOOGLE_CLIENT_ID=NOTE_GOOGLE_CLIENT_ID:latest,GOOGLE_CLIENT_SECRET=NOTE_GOOGLE_CLIENT_SECRET:latest,GOOGLE_CALLBACK_URI=NOTE_GOOGLE_CALLBACK_URI:latest \
            --min-instances=0 --max-instances=2