deploy-backend.yml

# Deploy backend/ → Cloud Run on push to main.
# Uses Workload Identity Federation (no long-lived JSON key in repo).
#
# Required secrets / vars:
#   GCP_WORKLOAD_IDENTITY_PROVIDER  (full resource name)
#   GCP_SERVICE_ACCOUNT             (deployer SA email)
# Optional secrets/vars:
#   GCP_PROJECT_ID                  (default: project-dace7531-ac79-4f81-bd2)
#   CLOUD_RUN_SERVICE               (default: midsphere-api)
#   CLOUD_RUN_REGION                (default: us-central1)
#
# Docs: https://github.com/google-github-actions/auth
#       https://cloud.google.com/run/docs/continuous-deployment-with-github

name: Deploy Backend (Cloud Run)

on:
  push:
    branches: [main]
    paths:
      - "backend/**"
      - ".github/workflows/deploy-backend.yml"
  workflow_dispatch:

concurrency:
  group: deploy-backend-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  id-token: write   # required for Workload Identity Federation

jobs:
  test:
    name: Unit tests
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: backend
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: backend/requirements.txt

      - name: Install deps
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install pytest

      - name: Run pytest
        env:
          ANTIGRAVITY_ENABLED: "false"
          USE_OFFICIAL_MCP: "false"
        run: python -m pytest tests/ -q --tb=short

  deploy:
    name: Deploy to Cloud Run
    needs: test
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      PROJECT_ID: ${{ vars.GCP_PROJECT_ID || secrets.GCP_PROJECT_ID || 'project-dace7531-ac79-4f81-bd2' }}
      SERVICE: ${{ vars.CLOUD_RUN_SERVICE || 'midsphere-api' }}
      REGION: ${{ vars.CLOUD_RUN_REGION || 'us-central1' }}

    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud (WIF)
        id: auth
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
          project_id: ${{ env.PROJECT_ID }}

      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@v2
        with:
          project_id: ${{ env.PROJECT_ID }}

      - name: Deploy source to Cloud Run
        working-directory: backend
        run: |
          set -euo pipefail
          # --env-vars-file replaces the entire env map. Preserve a live GMS URL
          # (set by start-now / manual update) so redeploy does not force localhost.
          PREV_GMS=""
          if gcloud run services describe "$SERVICE" \
              --region "$REGION" --project "$PROJECT_ID" >/dev/null 2>&1; then
            PREV_GMS=$(gcloud run services describe "$SERVICE" \
              --region "$REGION" --project "$PROJECT_ID" --format=json \
              | python3 -c 'import json,sys; d=json.load(sys.stdin); env=(d.get("spec") or {}).get("template",{}).get("spec",{}).get("containers",[{}])[0].get("env") or []; print(next((e.get("value") or "" for e in env if e.get("name")=="DATAHUB_GMS_URL"), ""))' \
              || true)
          fi
          echo "Pre-deploy DATAHUB_GMS_URL=${PREV_GMS:-unset}"

          gcloud run deploy "$SERVICE" \
            --source . \
            --region "$REGION" \
            --project "$PROJECT_ID" \
            --allow-unauthenticated \
            --env-vars-file cloudrun-env.yaml \
            --quiet

          # Restore non-localhost GMS so judges keep catalog reachability.
          if [[ -n "${PREV_GMS}" && "${PREV_GMS}" != "http://localhost:8080" && "${PREV_GMS}" != "http://127.0.0.1:8080" ]]; then
            echo "Restoring DATAHUB_GMS_URL=${PREV_GMS}"
            gcloud run services update "$SERVICE" \
              --region "$REGION" --project "$PROJECT_ID" \
              --update-env-vars="DATAHUB_GMS_URL=${PREV_GMS}" \
              --quiet
          else
            echo "No live GMS URL to restore (set via scripts/gce_datahub_schedule.sh start-now)."
          fi

      - name: Resolve service URL
        id: url
        run: |
          URL=$(gcloud run services describe "$SERVICE" \
            --region "$REGION" \
            --project "$PROJECT_ID" \
            --format='value(status.url)')
          echo "url=$URL" >> "$GITHUB_OUTPUT"
          echo "Service URL: $URL"
          # Smoke health (best-effort; cold start ok)
          curl -fsS --max-time 60 "${URL}/v1/health" | head -c 500 || true

      - name: Summary
        run: |
          {
            echo "### Backend deploy"
            echo ""
            echo "- **Service:** \`${{ env.SERVICE }}\`"
            echo "- **Region:** \`${{ env.REGION }}\`"
            echo "- **URL:** ${{ steps.url.outputs.url }}"
            echo "- **Commit:** \`${{ github.sha }}\`"
          } >> "$GITHUB_STEP_SUMMARY"