javaMate/.github/workflows/deploy.yml at main · sanjaygupta45/javaMate · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
name: Deploy to Cloud Run

on:
  push:
    branches:
      - main

env:
  PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
  REGION: us-central1
  SERVICE_NAME: javamate
  ARTIFACT_REGISTRY: us-central1-docker.pkg.dev
  REPOSITORY: javamate-repo

jobs:
  # -------------------------------
  # 1. Build & Test
  # -------------------------------
  build-and-test:
    name: Build & Test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: maven

      - name: Build with Maven
        run: ./mvnw clean package -DskipTests

      - name: Run Tests
        run: ./mvnw test
        continue-on-error: true

      - name: Upload JAR artifact
        uses: actions/upload-artifact@v4
        with:
          name: app-jar
          path: target/*.jar
          retention-days: 1

  # -------------------------------
  # 2. Docker Build & Push
  # -------------------------------
  docker-build-push:
    name: Docker Build & Push
    runs-on: ubuntu-latest
    needs: build-and-test

    permissions:
      contents: read
      id-token: write   # REQUIRED for OIDC

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Download JAR artifact
        uses: actions/download-artifact@v4
        with:
          name: app-jar
          path: target/

      # OIDC Authentication (using WIP secret)
      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.WIP }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v2
        with:
          project_id: ${{ env.PROJECT_ID }}

      - name: Configure Docker
        run: gcloud auth configure-docker ${{ env.ARTIFACT_REGISTRY }} --quiet

      - name: Build Docker Image
        run: |
          docker build -t ${{ env.ARTIFACT_REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.SERVICE_NAME }}:${{ github.sha }} .
          docker tag ${{ env.ARTIFACT_REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.SERVICE_NAME }}:${{ github.sha }} \
                     ${{ env.ARTIFACT_REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.SERVICE_NAME }}:latest

      - name: Push Docker Image
        run: |
          docker push ${{ env.ARTIFACT_REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.SERVICE_NAME }}:${{ github.sha }}
          docker push ${{ env.ARTIFACT_REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.SERVICE_NAME }}:latest

  # -------------------------------
  # 3. Deploy to Cloud Run
  # -------------------------------
  deploy:
    name: Deploy to Cloud Run
    runs-on: ubuntu-latest
    needs: docker-build-push

    permissions:
      contents: read
      id-token: write   # REQUIRED for OIDC

    steps:
      # OIDC Authentication again (fresh token)
      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.WIP }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      - name: Deploy to Cloud Run
        uses: google-github-actions/deploy-cloudrun@v2
        with:
          service: ${{ env.SERVICE_NAME }}
          region: ${{ env.REGION }}
          image: ${{ env.ARTIFACT_REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.SERVICE_NAME }}:${{ github.sha }}
          flags: |
            --allow-unauthenticated
            --port=8080
            --memory=1Gi
            --cpu=1
            --min-instances=0
            --max-instances=3
            --timeout=300
            --cpu-boost
            --service-account=github-actions-deploye@${{ env.PROJECT_ID }}.iam.gserviceaccount.com
            --set-env-vars=SPRING_PROFILES_ACTIVE=prod
            --set-env-vars=SERVER_PORT=8080
            --set-env-vars=CLOUD_SQL_DATABASE=javamate
            --set-env-vars=CLOUD_SQL_USERNAME=javamate
            --set-secrets=CLOUD_SQL_HOST=CLOUD_SQL_HOST:latest
            --set-secrets=MYSQL_PASSWORD=MYSQL_PASSWORD:latest
            --set-secrets=MISTRAL_API_KEY=MISTRAL_API_KEY:latest
            --set-secrets=JWT_SECRET=JWT_SECRET:latest
            --set-secrets=QDRANT_API_KEY=QDRANT_API_KEY:latest
            --set-secrets=GOOGLE_OAUTH_CLIENT_IDS=GOOGLE_OAUTH_CLIENT_IDS:latest
            --set-secrets=TAVILY_API_KEY=TAVILY_API_KEY:latest


      - name: Show Deployed URL
        run: |
          echo "Deployment successful!"
          echo "https://${{ env.SERVICE_NAME }}-${{ secrets.GCP_PROJECT_ID }}.run.app"