omi/.github/workflows/gcp_frontend.yml at websearch-dev-test · ghzhost/omi · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: Deploy Frontend to Cloud Run

on:
  push:
    branches: ["main", "development"]
    paths:
      - 'web/frontend/**'
      - 'config/public-build-*.json'
      - '.github/actions/deploy-public-build/**'
      - '.github/actions/prepare-public-build/**'
      - '.github/actions/public-build-candidate-promotion/**'
      - '.github/scripts/preflight_public_build_config.py'
      - '.github/scripts/preflight_public_build_runtime.py'
      - '.github/scripts/smoke_public_build_browser.py'
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy to'
        required: false
        default: 'prod'
        type: choice
        options: [development, prod]
      release_version:
        description: 'Release version (optional)'
        required: false
        default: ''

concurrency:
  group: deploy-cloud-run-frontend-${{ github.event_name == 'workflow_dispatch' && github.event.inputs.environment || github.ref == 'refs/heads/development' && 'development' || github.ref == 'refs/heads/main' && 'prod' || format('nondeploy-{0}', github.run_id) }}
  cancel-in-progress: false

jobs:
  deploy:
    environment: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.environment || (github.ref == 'refs/heads/development' && 'development') || 'prod' }}
    permissions:
      actions: read
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Validate trusted frontend service identity contract
        env:
          PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_INVOKER_SA: ${{ vars.PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_INVOKER_SA }}
          PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE: ${{ vars.PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE }}
        run: |
          test -n "$PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_INVOKER_SA"
          test -n "$PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE"

      - name: Deploy checked public-build candidate
        id: public-build-deploy
        uses: ./.github/actions/deploy-public-build
        with:
          target: frontend
          environment: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.environment || (github.ref == 'refs/heads/development' && 'development') || 'prod' }}
          project_id: ${{ vars.GCP_PROJECT_ID }}
          gcp_credentials: ${{ secrets.GCP_CREDENTIALS }}
          service_account: ${{ vars.PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_INVOKER_SA }}
          runtime_env_vars: PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE=${{ vars.PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE }}

      - name: Verify Cloud Run rollout
        run: |
          python3 backend/scripts/deploy_status_report.py \
            --env ${{ vars.ENV }} \
            --project ${{ vars.GCP_PROJECT_ID }} \
            --region ${{ steps.public-build-deploy.outputs.region }} \
            --include-cloud-run \
            --cloud-run-service ${{ steps.public-build-deploy.outputs.service }}