ci(opax-mcp): add guarded no-traffic candidate deploy

opax-mcp.yaml

@@ -9,39 +9,25 @@ metadata:
     run.googleapis.com/build-source-location: gs://run-sources-propane-will-491900-m5-us-central1/services/opax-mcp/1782754930.916629-ba7acea7e3534f21b658e90dd918d952.zip#1782754931015737
     run.googleapis.com/ingress: all
     run.googleapis.com/ingress-status: all
-    run.googleapis.com/maxScale: '20'
-    run.googleapis.com/operation-id: 931f0012-fb7c-422c-b857-8e75cc298a5f
-    run.googleapis.com/urls: '["https://opax-mcp-357036551735.us-central1.run.app","https://opax-mcp-zjbqp3prqq-uc.a.run.app"]'
-    serving.knative.dev/creator: 357036551735-compute@developer.gserviceaccount.com
-    serving.knative.dev/lastModifier: chris.christiansen@vauco.no
-  creationTimestamp: '2026-06-10T01:03:48.098765Z'
-  generation: 57
-  labels:
-    cloud.googleapis.com/location: us-central1
   name: opax-mcp
   namespace: '357036551735'
-  resourceVersion: AAZVlY5b+Ro
-  selfLink: /apis/serving.knative.dev/v1/namespaces/357036551735/services/opax-mcp
-  uid: c95aae34-95db-474f-93dc-f8d89b55b2dd
 spec:
   template:
     metadata:
       annotations:
+        autoscaling.knative.dev/minScale: '0'
         autoscaling.knative.dev/maxScale: '5'
-        run.googleapis.com/client-name: gcloud
+        run.googleapis.com/vpc-access-egress: private-ranges-only
-        run.googleapis.com/client-version: 570.0.0
         run.googleapis.com/startup-cpu-boost: 'true'
-      labels:
-        client.knative.dev/nonce: zcdkbqbeua
-        run.googleapis.com/startupProbeType: Default
     spec:
+      serviceAccountName: jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com
       containerConcurrency: 80
       containers:
       - env:
         - name: GOOGLE_CLOUD_PROJECT
           value: propane-will-491900-m5
         - name: OLLAMA_BASE_URL
-          value: "http://34.67.252.59:11434"
+          value: "http://10.128.0.15:11434"
         - name: EMMA_MODEL
           value: "gemma3:4b"
         - name: EMMA_FAST_MODEL
@@ -109,7 +95,6 @@ spec:
           tcpSocket:
             port: 8080
           timeoutSeconds: 240
-      serviceAccountName: jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com
       timeoutSeconds: 60
   traffic:
   - latestRevision: true

scripts/deploy-mcp.sh

@@ -4,18 +4,22 @@ set -euo pipefail
 ROOT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "${ROOT_DIR}"
 
+if [[ -n "$(git status --porcelain)" ]]; then
+  echo "ERROR: Git working directory is not clean. Aborting." >&2
+  git status
+  exit 1
+fi
+echo "==> Git working directory is clean."
+
 PROJECT_ID="propane-will-491900-m5"
 REGION="us-central1"
 REPOSITORY="us-central1-docker.pkg.dev/${PROJECT_ID}/osvauco-repo"
 MCP_SERVICE="opax-mcp"
 MCP_IMAGE="${REPOSITORY}/opax-mcp"
 
-# Emma runtime requires Direct VPC egress to the internal Ollama host.
+# This is now aligned with opax-mcp.yaml
-# Keep this explicit: a prior manual deployment lost these settings.
-MCP_NETWORK="default"
-MCP_SUBNET="default"
-MCP_VPC_EGRESS="private-ranges-only"
 MCP_OLLAMA_BASE_URL="http://10.128.0.15:11434"
+COMMIT_SHA=$(git rev-parse --short HEAD)
 
 
 echo "==> Submitting MCP Cloud Build"
@@ -53,6 +57,12 @@ BUILD_STATUS="$(
     --format="value(status)"
 )"
 
+if [[ "${BUILD_STATUS}" != "SUCCESS" ]]; then
+  echo "ERROR: Cloud Build did not succeed. Status: ${BUILD_STATUS}. Aborting deploy." >&2
+  exit 1
+fi
+echo "==> Cloud Build status: SUCCESS."
+
 IMAGE_REF="$(
   gcloud builds describe "${BUILD_ID}" \
     --project="${PROJECT_ID}" \
@@ -83,7 +93,6 @@ else
   DEPLOY_IMAGE="${MCP_IMAGE}@${IMAGE_DIGEST}"
 fi
 
-echo "==> Cloud Build status: ${BUILD_STATUS}"
 echo "==> Deploying immutable MCP image:"
 echo "${DEPLOY_IMAGE}"
 
@@ -91,26 +100,26 @@ gcloud run deploy "${MCP_SERVICE}" \
   --project="${PROJECT_ID}" \
   --region="${REGION}" \
   --image="${DEPLOY_IMAGE}" \
-  --network="${MCP_NETWORK}" \
+  --tag="candidate-${COMMIT_SHA}" \
-  --subnet="${MCP_SUBNET}" \
+  --no-traffic \
-  --vpc-egress="${MCP_VPC_EGRESS}" \
+  --service-account="jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com" \
-  --update-env-vars="OLLAMA_BASE_URL=${MCP_OLLAMA_BASE_URL}" \
+  --port="8080" \
+  --min-instances="0" \
+  --max-instances="5" \
+  --cpu="1" \
+  --memory="512Mi" \
+  --concurrency="80" \
+  --timeout="60" \
+  --network="default" \
+  --subnet="default" \
+  --vpc-egress="private-ranges-only" \
+  --update-env-vars="^|^GOOGLE_CLOUD_PROJECT=propane-will-491900-m5|OLLAMA_BASE_URL=http://10.128.0.15:11434|EMMA_MODEL=gemma3:4b|EMMA_FAST_MODEL=gemma3:4b|EMMA_LIGHT_MODEL=qwen2.5:3b|GITEA_URL=https://git.vauco.no|GITEA_REPO=chris/OSVauco|STATIC_BUCKET=opax-vauco-static|CLOUD_RUN_SERVICE=osvauco-agent|CLOUD_BUILD_TRIGGER_ID=38423976-91ff-4ff4-859e-1f262344c609|OPAX_IAP_CLIENT_ID=357036551735-kq8nt7ld38hfqlcfb3n52ef7tala4meo.apps.googleusercontent.com|GMAIL_DEFAULT_SENDER=jason.vauger@vauco.no|GMAIL_ALLOWED_SENDERS=jason.vauger@vauco.no,emma.vauger@vauco.no|OSVAUCO_AGENT_URL=https://osvauco-agent-357036551735.us-central1.run.app" \
+  --update-secrets="GITEA_TOKEN=gitea-token:latest,INTERNAL_API_KEY=INTERNAL_API_KEY:latest,MCP_SECRET=mcp-server-key:latest,TWILIO_ACCOUNT_SID=TWILIO_ACCOUNT_SID:latest,TWILIO_AUTH_TOKEN=TWILIO_AUTH_TOKEN:latest,TWILIO_FROM_NUMBER=TWILIO_FROM_NUMBER:latest" \
   --quiet
 
 echo
-echo "==> Active MCP deployment"
+echo "==> Candidate revision created successfully."
-
+echo "Candidate tag: candidate-${COMMIT_SHA}"
-gcloud run services describe "${MCP_SERVICE}" \
-  --project="${PROJECT_ID}" \
-  --region="${REGION}" \
-  --format="table(
-    metadata.name,
-    status.url,
-    status.latestReadyRevisionName,
-    status.traffic[0].revisionName,
-    spec.template.spec.containers[0].image
-  )"
-
 echo
-echo "MCP deployment complete."
+echo "No production traffic has been promoted."
-echo "Cloud Build log exit code: ${BUILD_LOG_EXIT_CODE}"
+echo "Next steps: Perform health and smoke tests against the candidate URL, then promote traffic manually."