gcp_frontend.yml

name: Deploy Frontend to Cloud Run

on:
  push:
    branches: ["main", "development"]
    paths:
      - 'web/frontend/**'
      - 'config/public-build-*.json'
      - '.github/actions/deploy-public-build/**'
      - '.github/actions/prepare-public-build/**'
      - '.github/actions/public-build-candidate-promotion/**'
      - '.github/scripts/preflight_public_build_config.py'
      - '.github/scripts/preflight_public_build_runtime.py'
      - '.github/scripts/smoke_public_build_browser.py'
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy to'
        required: false
        default: 'prod'
        type: choice
        options: [development, prod]
      release_version:
        description: 'Release version (optional)'
        required: false
        default: ''

concurrency:
  group: deploy-cloud-run-frontend-${{ github.event_name == 'workflow_dispatch' && github.event.inputs.environment || github.ref == 'refs/heads/development' && 'development' || github.ref == 'refs/heads/main' && 'prod' || format('nondeploy-{0}', github.run_id) }}
  cancel-in-progress: false

jobs:
  deploy:
    environment: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.environment || (github.ref == 'refs/heads/development' && 'development') || 'prod' }}
    permissions:
      actions: read
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Validate trusted frontend service identity contract
        env:
          PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_INVOKER_SA: ${{ vars.PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_INVOKER_SA }}
          PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE: ${{ vars.PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE }}
        run: |
          set -euo pipefail
          user_sa='^[a-z][a-z0-9-]{4,28}[a-z0-9]@[a-z][a-z0-9-]+\.iam\.gserviceaccount\.com$'
          compute_sa='^[0-9]+-compute@developer\.gserviceaccount\.com$'
          audience='^https://[A-Za-z0-9.-]+$'
          if [[ ! "$PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_INVOKER_SA" =~ $user_sa &&
                ! "$PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_INVOKER_SA" =~ $compute_sa ]]; then
            echo "PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_INVOKER_SA is not a Cloud Run service-account identity" >&2
            exit 1
          fi
          if [[ ! "$PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE" =~ $audience ]]; then
            echo "PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE is not an origin-only HTTPS audience" >&2
            exit 1
          fi

      - name: Deploy checked public-build candidate
        id: public-build-deploy
        uses: ./.github/actions/deploy-public-build
        with:
          target: frontend
          environment: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.environment || (github.ref == 'refs/heads/development' && 'development') || 'prod' }}
          project_id: ${{ vars.GCP_PROJECT_ID }}
          gcp_credentials: ${{ secrets.GCP_CREDENTIALS }}
          service_account: ${{ vars.PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_INVOKER_SA }}
          runtime_env_vars: PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE=${{ vars.PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE }}

      - name: Verify Cloud Run rollout
        run: |
          python3 backend/scripts/deploy_status_report.py \
            --env ${{ vars.ENV }} \
            --project ${{ vars.GCP_PROJECT_ID }} \
            --region ${{ steps.public-build-deploy.outputs.region }} \
            --include-cloud-run \
            --cloud-run-service ${{ steps.public-build-deploy.outputs.service }}