deploy.yml

name: Build & Deploy to Cloud Run

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

env:
  PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
  REGION: us-central1
  SERVICE: a0p
  REGISTRY: us-central1-docker.pkg.dev

jobs:
  provider-contracts:
    name: Provider adapter contracts
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - name: Install uv
        uses: astral-sh/setup-uv@v8.1.0
        with:
          version: "0.11.18"
          enable-cache: true

      - name: Install Python dependencies
        run: uv sync --frozen

      - name: Run provider contracts
        run: |
          uv run pytest -q tests/test_open_comp_prov_v0.0.0alpha.py tests/test_open_comp_rout_v0.0.0alpha.py tests/test_aone_open_comp_adap_v0.0.0alpha.py tests/test_a0_package.py
          uv run python -m python.tests.contract_runner --only check_openai_compatible_registry_wiring --only check_openai_compatible_repair_regressions

  check-console-tabs:
    name: Console tab regression guard
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: a0p_check
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10

    env:
      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/a0p_check
      SESSION_SECRET: ci-session-secret
      INTERNAL_API_SECRET: ci-internal-secret-for-console-tab-check

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version: '22'
          cache: npm

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - name: Install uv
        uses: astral-sh/setup-uv@v8.1.0
        with:
          version: "0.11.18"
          enable-cache: true

      - name: Install Node dependencies
        run: npm ci

      - name: Install Python dependencies
        run: uv sync --frozen --no-dev

      - name: Apply database schema
        run: npm run db:push

      - name: Boot Python backend
        run: |
          uv run uvicorn python.main:app --host 127.0.0.1 --port 8001 \
            > /tmp/uvicorn.log 2>&1 &
          echo $! > /tmp/uvicorn.pid
          for i in $(seq 1 30); do
            if curl -fsS http://127.0.0.1:8001/api/health > /dev/null; then
              echo "backend up after ${i}s"
              exit 0
            fi
            sleep 1
          done
          echo "backend failed to start"
          cat /tmp/uvicorn.log
          exit 1

      - name: Run console-tab regression guard
        run: API_BASE=http://127.0.0.1:8001 node scripts/check-console-tabs.mjs

      - name: Stop Python backend
        if: always()
        run: |
          if [ -f /tmp/uvicorn.pid ]; then
            kill "$(cat /tmp/uvicorn.pid)" 2>/dev/null || true
          fi

  deployment-readiness:
    name: Google Cloud deployment readiness
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    env:
      GCP_DEPLOY_ENABLED: ${{ vars.GCP_DEPLOY_ENABLED }}
      GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
      GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
    steps:
      - name: Validate deployment configuration without exposing credentials
        shell: bash
        run: |
          if [ "$GCP_DEPLOY_ENABLED" != "true" ]; then
            echo "::notice::BLOCKED: set repository variable GCP_DEPLOY_ENABLED=true after configuring GCP_PROJECT_ID and GCP_SA_KEY secrets."
            exit 0
          fi

          missing=()
          [ -n "$GCP_PROJECT_ID" ] || missing+=(GCP_PROJECT_ID)
          [ -n "$GCP_SA_KEY" ] || missing+=(GCP_SA_KEY)
          if [ "${#missing[@]}" -ne 0 ]; then
            printf -v missing_names '%s, ' "${missing[@]}"
            echo "::error::Google Cloud deployment is enabled but required repository secret(s) are absent: ${missing_names%, }."
            exit 1
          fi

          echo "Google Cloud deployment configuration is present; credential values remain masked."

  deploy:
    name: Build, push, deploy
    needs: [provider-contracts, check-console-tabs, deployment-readiness]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.GCP_DEPLOY_ENABLED == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@v3.0.0
        with:
          project_id: ${{ env.PROJECT_ID }}
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Configure Docker for Artifact Registry
        run: gcloud auth configure-docker ${{ env.REGISTRY }} --quiet

      - name: Build Docker image
        run: |
          docker build \
            --tag ${{ env.REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.SERVICE }}/${{ env.SERVICE }}:${{ github.sha }} \
            --tag ${{ env.REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.SERVICE }}/${{ env.SERVICE }}:latest \
            .

      - name: Push Docker image
        run: |
          docker push ${{ env.REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.SERVICE }}/${{ env.SERVICE }}:${{ github.sha }}
          docker push ${{ env.REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.SERVICE }}/${{ env.SERVICE }}:latest

      - name: Deploy to Cloud Run
        run: |
          gcloud run deploy ${{ env.SERVICE }} \
            --image=${{ env.REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.SERVICE }}/${{ env.SERVICE }}:${{ github.sha }} \
            --region=${{ env.REGION }} \
            --platform=managed \
            --allow-unauthenticated \
            --port=5000 \
            --min-instances=0 \
            --max-instances=10 \
            --memory=512Mi \
            --cpu=1 \
            --set-secrets="DATABASE_URL=a0p-database-url:latest,SESSION_SECRET=a0p-session-secret:latest,XAI_API_KEY=a0p-xai-api-key:latest,DEEPSEEK_API_KEY=a0p-deepseek-api-key:latest,STRIPE_SECRET_KEY=a0p-stripe-secret-key:latest,STRIPE_WEBHOOK_SECRET=a0p-stripe-webhook-secret:latest"