steps:
  # 1. Build the container image
  - name: 'gcr.io/cloud-builders/docker'
    id: build-image
    args:
      - 'build'
      - '-t'
      - 'us-central1-docker.pkg.dev/${PROJECT_ID}/cloud-run-source-deploy/opax-mcp:${BUILD_ID}'
      - '-f'
      - 'opax-mcp/Dockerfile'
      - 'opax-mcp'

  # 2. Push the image to Artifact Registry
  - name: 'gcr.io/cloud-builders/docker'
    id: push-image
    args:
      - 'push'
      - 'us-central1-docker.pkg.dev/${PROJECT_ID}/cloud-run-source-deploy/opax-mcp:${BUILD_ID}'
    waitFor: ['build-image']

  # 3. Deploy to Cloud Run with secure secret handling
  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    id: deploy-service
    entrypoint: 'gcloud'
    args:
      - 'run'
      - 'deploy'
      - 'opax-mcp'
      - '--image=us-central1-docker.pkg.dev/${PROJECT_ID}/cloud-run-source-deploy/opax-mcp:${BUILD_ID}'
      - '--region=us-central1'
      - '--project=${PROJECT_ID}'
      - '--service-account=jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com'
      - '--set-secrets=MCP_SECRET=MCP_SECRET:latest' # Securely mount the MCP_SECRET
      - '--allow-unauthenticated' # Allow public ingress for Perplexity; app-level auth provides security
      - '--port=8080'
      - '--memory=512Mi'
      - '--cpu=1'
      - '--min-instances=0'
      - '--max-instances=2'
      - '--quiet'
    waitFor: ['push-image']

images:
  - 'us-central1-docker.pkg.dev/${PROJECT_ID}/cloud-run-source-deploy/opax-mcp:${BUILD_ID}'

options:
  logging: CLOUD_LOGGING_ONLY