# Cloud Build config for OSVx MCP (opax-mcp)
#
# Usage:
#   gcloud builds submit . --config=opax-mcp/cloudbuild.yaml --substitutions=_ENV=staging
#   gcloud builds submit . --config=opax-mcp/cloudbuild.yaml --substitutions=_ENV=prod
#
# This build:
#   - Builds the Docker image with a commit-SHA label
#   - Pushes to Artifact Registry
#   - Deploys to the appropriate Cloud Run service (staging or prod)

steps:
  # 1. Build the container image
  - name: 'gcr.io/cloud-builders/docker'
    id: build-image
    args:
      - 'build'
      - '-t'
      - '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/opax-mcp:${SHORT_SHA}'
      - '--build-arg'
      - 'COMMIT_SHA=${SHORT_SHA}'
      - '-f'
      - 'opax-mcp/Dockerfile'
      - 'opax-mcp'
    waitFor: ['-']

  # 2. Push the image (explicit push step for clarity)
  - name: 'gcr.io/cloud-builders/docker'
    id: push-image
    args:
      - 'push'
      - '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/opax-mcp:${SHORT_SHA}'
    waitFor: ['build-image']

  # 3. Deploy to Cloud Run (staging or prod)
  - name: 'gcr.io/cloud-builders/gcloud'
    id: deploy-cloud-run
    entrypoint: 'bash'
    args:
      - '-c'
      - |
        set -e
        if [ "${_ENV}" = "prod" ]; then
          SERVICE="osvx-mcp-prod"
        elif [ "${_ENV}" = "staging" ]; then
          SERVICE="osvx-mcp-staging"
        else
          echo "Unknown _ENV: ${_ENV}. Use 'staging' or 'prod'."
          exit 1
        fi

        gcloud run deploy "${SERVICE}"           --project=${PROJECT_ID}           --region=${_REGION}           --image=${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/opax-mcp:${SHORT_SHA}           --platform=managed           --allow-unauthenticated=false           --set-env-vars="MCP_SECRET=${_MCP_SECRET}"           --set-labels="gcb-commit-sha=${SHORT_SHA},env=${_ENV}"
    waitFor: ['push-image']

images:
  - '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/opax-mcp:${SHORT_SHA}'

# Optional: store build artifacts / manifest
artifacts:
  objects:
    location: 'gs://${PROJECT_ID}-builds/artifacts'
    paths: ['cloudbuild.yaml']

# Substitutions (defaults can be overridden via --substitutions)
substitutions:
  _REGION: us-central1
  _REPOSITORY: osvx-images
  _ENV: staging          # 'staging' or 'prod'
  _MCP_SECRET: MCP_SECRET

options:
  logging: CLOUD_LOGGING_ONLY
  substitutionOption: ALLOW_LOOSE