117 lines
4.1 KiB
YAML
117 lines
4.1 KiB
YAML
# cloudbuild.yaml — Auto-build, cost-check og deploy osvauco-agent på push til main
|
|
steps:
|
|
# Steg 1: Kost-sjekk før deploy
|
|
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
|
|
id: cost-check
|
|
entrypoint: bash
|
|
args:
|
|
- '-c'
|
|
- |
|
|
echo "=== Cost Check ==="
|
|
bash infrastructure/09-cost-check.sh || true
|
|
echo "=== Cost Check ferdig ==="
|
|
|
|
# Steg 2: Bygg Docker-image
|
|
- name: 'gcr.io/cloud-builders/docker'
|
|
id: build
|
|
waitFor: ['cost-check']
|
|
args:
|
|
- 'build'
|
|
- '-t'
|
|
- '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_ARTIFACT_REPO}/osvauco-agent:$BUILD_ID'
|
|
- '-t'
|
|
- '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_ARTIFACT_REPO}/osvauco-agent:latest'
|
|
- '.'
|
|
- '-f'
|
|
- 'agents/core-logic/Dockerfile'
|
|
|
|
# Steg 3: Push image
|
|
- name: 'gcr.io/cloud-builders/docker'
|
|
id: push
|
|
waitFor: ['build']
|
|
args:
|
|
- 'push'
|
|
- '--all-tags'
|
|
- '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_ARTIFACT_REPO}/osvauco-agent'
|
|
|
|
# Steg 4: Deploy til Cloud Run
|
|
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
|
|
id: deploy
|
|
waitFor: ['push']
|
|
entrypoint: gcloud
|
|
args:
|
|
- 'run'
|
|
- 'deploy'
|
|
- '${_CLOUD_RUN_SERVICE}'
|
|
- '--image=${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_ARTIFACT_REPO}/osvauco-agent:$BUILD_ID'
|
|
- '--region=${_REGION}'
|
|
- '--project=${PROJECT_ID}'
|
|
- '--service-account=${_AGENT_SA}'
|
|
- '--set-env-vars=GOOGLE_CLOUD_PROJECT=${PROJECT_ID},GOOGLE_CLOUD_LOCATION=${_GEMINI_LOCATION},GOOGLE_GENAI_USE_VERTEXAI=True,BILLING_TABLE=billing_export.gcp_billing_export_v1_0171F6_057E6B_A260BA'
|
|
- '--update-secrets=MCP_SECRET=mcp-server-key:latest,GOOGLE_CLIENT_ID=GOOGLE_CLIENT_ID:1,SESSION_SECRET=SESSION_SECRET:1,GOOGLE_CLIENT_SECRET=GOOGLE_CLIENT_SECRET:1'
|
|
- '--no-allow-unauthenticated'
|
|
- '--port=8080'
|
|
- '--memory=1Gi'
|
|
- '--cpu=1'
|
|
- '--min-instances=0'
|
|
- '--max-instances=3'
|
|
- '--quiet'
|
|
|
|
# Steg 5: Smoke test — verifiser at agenten svarer etter deploy
|
|
# Bruker gcloud auth print-identity-token med impersonation (løser 2nd gen token-problem)
|
|
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
|
|
id: smoke-test
|
|
waitFor: ['deploy']
|
|
entrypoint: bash
|
|
args:
|
|
- '-c'
|
|
- |
|
|
echo "=== Smoke Test ==="
|
|
TOKEN=$$(gcloud auth print-identity-token \
|
|
--impersonate-service-account=${_AGENT_SA} \
|
|
--audiences="https://${_CLOUD_RUN_URL}") \
|
|
|| { echo "❌ Kunne ikke hente identity token"; exit 1; }
|
|
|
|
RESPONSE=$$(curl -sf \
|
|
-H "Authorization: Bearer $$TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"user_id": "ci", "session_id": "smoke-$BUILD_ID", "message": "ping"}' \
|
|
"https://${_CLOUD_RUN_URL}/run") \
|
|
|| { echo "❌ Smoke test feilet — /run svarte ikke"; exit 1; }
|
|
|
|
echo "✅ Smoke test OK: $$RESPONSE"
|
|
echo "=== Smoke Test ferdig ==="
|
|
|
|
# Steg 6: Deploy-notifikasjon til webhook/chat-app
|
|
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
|
|
id: notify
|
|
waitFor: ['smoke-test']
|
|
entrypoint: bash
|
|
args:
|
|
- '-c'
|
|
- |
|
|
WH_URL=$$(gcloud secrets versions access latest \
|
|
--secret=webhook-url \
|
|
--project=${PROJECT_ID} 2>/dev/null || echo "")
|
|
if [[ -n "$$WH_URL" ]]; then
|
|
NOTIFY_MSG="✅ *OSVauco Deploy fullført*\nCommit: \`$COMMIT_SHA\`\nService: \`${_CLOUD_RUN_SERVICE}\`\nRegion: \`${_REGION}\`\nSmoke test: ✅"
|
|
curl -s -X POST "$$WH_URL" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "{\"text\": \"$$NOTIFY_MSG\"}" || true
|
|
echo "✓ Deploy-notifikasjon sendt"
|
|
else
|
|
echo "⚠️ Ingen webhook-url i Secret Manager — hopper over varsling"
|
|
fi
|
|
|
|
substitutions:
|
|
_REGION: us-central1
|
|
_ARTIFACT_REPO: osvauco-repo
|
|
_CLOUD_RUN_SERVICE: osvauco-agent
|
|
_CLOUD_RUN_URL: osvauco-agent-zjbqp3prqq-uc.a.run.app
|
|
_AGENT_SA: osvauco-agent-sa@propane-will-491900-m5.iam.gserviceaccount.com
|
|
_GEMINI_LOCATION: global
|
|
|
|
options:
|
|
substitutionOption: ALLOW_LOOSE
|
|
logging: CLOUD_LOGGING_ONLY
|