sub-cloudrun-deploy.yml

name: Deploy to Cloud Run

on:
  workflow_call:
    inputs:
      app_name:
        required: true
        type: string
      registry:
        required: true
        type: string
      image_digest:
        required: true
        type: string
        description: The image digest to deploy
      project_id:
        required: false
        type: string
        description: The project to deploy to
      region:
        required: true
        type: string
        description: The region to deploy to
      environment:
        required: false
        type: string
        description: The environment to deploy to
      min_instances:
        required: false
        type: string
        description: The minimum number of instances to deploy
      max_instances:
        required: false
        type: string
        description: The maximum number of instances to deploy
      cpu:
        required: false
        type: string
        description: The number of CPUs to use for the service
      memory:
        required: false
        type: string
        description: The amount of memory to use for the service
      no_cpu_throttling:
        required: false
        type: boolean
        default: false
        description: >-
          Allocate CPU for the full instance lifetime (instance-based billing).
          Required for always-on workloads like Uptime Kuma, whose background
          monitoring loop is otherwise throttled/disconnected between requests.
      ingress:
        required: false
        type: string
        default: all
        description: Cloud Run ingress (all | internal-and-cloud-load-balancing).
      public_url:
        required: false
        type: string
        default: ''
        description: External URL (e.g. the LB domain) used for the Environment URL and smoke test when the *.run.app URL is closed.

# NOTE: do not use `read-all`. As a reusable workflow this may not request more
# permissions than the caller grants, and `read-all` now expands to include newer
# scopes (artifact-metadata, code-quality, models, vulnerability-alerts) that the
# callers don't grant -> the run is rejected at startup. Request only what's used;
# the deploy job additionally declares `id-token: write`.
permissions:
  contents: read

jobs:
  versioning:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.set.outputs.version }}
    steps:
      - name: Getting API Version
        id: get
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        if: ${{ github.event_name == 'release' }}
        with:
          result-encoding: string
          script: |
            return context.payload.release.tag_name.substring(0,2)
      - name: Setting API Version
        id: set
        env:
          VERSION: ${{ steps.get.outputs.result }}
        run: echo "version=${VERSION}" >> "$GITHUB_OUTPUT"

  deploy:
    name: Deploy to Cloud Run
    needs: [versioning]
    timeout-minutes: 10
    runs-on: ubuntu-latest
    environment:
      name: ${{ inputs.environment }}
      url: ${{ inputs.ingress == 'all' && steps.deploy.outputs.url || inputs.public_url }}
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Inject slug/short variables
        uses: rlespinasse/github-slug-action@ef93b2ea4b6405d06fd8684fc3ff795d262ecae8 # v5.7.0

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          workload_identity_provider: '${{ vars.GCP_WIF }}'
          project_id: '${{ vars.GCP_PROJECT }}'
          # Impersonate the deployments SA (matches the build job and zebra's
          # deploy). Without this, WIF auth has no identity to act as and the
          # Cloud Run deploy can't authorize.
          service_account: '${{ vars.GCP_DEPLOYMENTS_SA }}'

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1

      # Restricted ingress closes the *.run.app URL, so we need public_url for the
      # Environment URL and smoke test — fail fast instead of silently skipping it.
      - name: Require public_url for restricted ingress
        if: ${{ inputs.ingress != 'all' && inputs.public_url == '' }}
        env:
          INGRESS: ${{ inputs.ingress }}
        run: |
          echo "::error::ingress=${INGRESS} requires public_url (the *.run.app URL is closed)"
          exit 1

      - name: Deploy to cloud run
        id: deploy
        uses: google-github-actions/deploy-cloudrun@2028e2d7d30a78c6910e0632e48dd561b064884d # v3.0.1
        with:
          service: ${{ inputs.app_name }}-${{ needs.versioning.outputs.version || env.GITHUB_HEAD_REF_SLUG || inputs.environment }}
          image: ${{ inputs.registry }}/${{ inputs.app_name }}@${{ inputs.image_digest }}
          region: ${{ inputs.region }}
          gcloud_component: alpha
          env_vars: |
            UPTIME_KUMA_DB_TYPE=${{ vars.UPTIME_KUMA_DB_TYPE }}
            UPTIME_KUMA_DB_HOSTNAME=${{ vars.UPTIME_KUMA_DB_HOSTNAME }}
            UPTIME_KUMA_DB_PORT=${{ vars.UPTIME_KUMA_DB_PORT }}
            UPTIME_KUMA_DB_NAME=${{ vars.UPTIME_KUMA_DB_NAME }}
            UPTIME_KUMA_DB_USERNAME=${{ vars.UPTIME_KUMA_DB_USERNAME }}
          env_vars_update_strategy: overwrite
          secrets: |
            UPTIME_KUMA_DB_PASSWORD=UPTIME_KUMA_DB_PASSWORD:latest
          flags: |
            --min-instances=${{ inputs.min_instances }}
            --max-instances=${{ inputs.max_instances }}
            --cpu=${{ inputs.cpu }}
            --memory=${{ inputs.memory }}
            ${{ inputs.no_cpu_throttling && '--no-cpu-throttling' || '' }}
            --ingress=${{ inputs.ingress }}
            --service-account=${{ vars.GCP_BUCKET_SA }}
            --set-cloudsql-instances=${{ vars.CLOUDSQL_INSTANCE }}
            --add-volume=name=files,type=in-memory
            --add-volume-mount=volume=files,mount-path=/app/data
            --network=${{ vars.GCP_NETWORK }}
            --subnet=${{ vars.GCP_SUBNETWORK }}

      # Required even with internal ingress: the LB invokes Cloud Run unauthenticated.
      - name: Allow unauthenticated calls to the service
        env:
          SERVICE: ${{ inputs.app_name }}-${{ needs.versioning.outputs.version || env.GITHUB_HEAD_REF_SLUG || inputs.environment }}
          REGION: ${{ inputs.region }}
        run: |
          gcloud run services add-iam-policy-binding "$SERVICE" \
          --region="$REGION" --member=allUsers --role=roles/run.invoker --quiet

      # Curl the reachable URL: the direct one for `all`, else the public LB URL
      # (guaranteed present by the guard above).
      - name: Test service with cURL
        env:
          TARGET_URL: ${{ inputs.ingress == 'all' && steps.deploy.outputs.url || inputs.public_url }}
        run: curl --retry 5 --retry-all-errors --max-time 30 -fsSL "$TARGET_URL" -o /dev/null