81 lines
2.7 KiB
Bash
81 lines
2.7 KiB
Bash
#!/usr/bin/env bash
|
|
# 06-cicd-setup.sh — Set up Cloud Build trigger + Artifact Registry for CI/CD
|
|
# Prerequisites: GitHub repo connected to Cloud Build via GCP Console FIRST:
|
|
# https://console.cloud.google.com/cloud-build/triggers/connect
|
|
# Source .env before running: source .env
|
|
set -euo pipefail
|
|
|
|
: "${PROJECT_ID:?Set PROJECT_ID}"
|
|
: "${REGION:?Set REGION}"
|
|
: "${GITHUB_OWNER:?Set GITHUB_OWNER}"
|
|
: "${GITHUB_REPO:?Set GITHUB_REPO}"
|
|
: "${ARTIFACT_REPO:?Set ARTIFACT_REPO}"
|
|
: "${CLOUD_RUN_SERVICE:?Set CLOUD_RUN_SERVICE}"
|
|
|
|
BRANCH_PATTERN="^main$"
|
|
|
|
echo "=== 06: CI/CD Setup for ${PROJECT_ID} ==="
|
|
|
|
bash "$(dirname "$0")/00-authcheck.sh"
|
|
|
|
gcloud services enable \
|
|
cloudbuild.googleapis.com \
|
|
artifactregistry.googleapis.com \
|
|
run.googleapis.com \
|
|
--project="${PROJECT_ID}" --quiet
|
|
|
|
# Create Artifact Registry repo (idempotent)
|
|
if ! gcloud artifacts repositories describe "${ARTIFACT_REPO}" \
|
|
--location="${REGION}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
|
|
gcloud artifacts repositories create "${ARTIFACT_REPO}" \
|
|
--repository-format=docker \
|
|
--location="${REGION}" \
|
|
--project="${PROJECT_ID}" --quiet
|
|
echo "✓ Artifact Registry repo created: ${ARTIFACT_REPO}"
|
|
else
|
|
echo "✓ Artifact Registry repo already exists"
|
|
fi
|
|
|
|
gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet
|
|
|
|
# Grant Cloud Build SA permissions
|
|
PROJECT_NUMBER=$(gcloud projects describe "${PROJECT_ID}" --format="value(projectNumber)")
|
|
CB_SA="${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com"
|
|
|
|
for ROLE in \
|
|
roles/run.admin \
|
|
roles/iam.serviceAccountUser \
|
|
roles/artifactregistry.writer \
|
|
roles/secretmanager.secretAccessor; do
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${CB_SA}" --role="${ROLE}" --quiet
|
|
done
|
|
echo "✓ Cloud Build SA IAM bindings applied"
|
|
|
|
# Create Cloud Build trigger
|
|
TRIGGER_NAME="${CLOUD_RUN_SERVICE}-main-trigger"
|
|
EXISTING=$(gcloud builds triggers list \
|
|
--filter="name=${TRIGGER_NAME}" \
|
|
--format="value(name)" 2>/dev/null | head -1 || true)
|
|
|
|
if [[ -z "${EXISTING}" ]]; then
|
|
gcloud builds triggers create github \
|
|
--name="${TRIGGER_NAME}" \
|
|
--repo-owner="${GITHUB_OWNER}" \
|
|
--repo-name="${GITHUB_REPO}" \
|
|
--branch-pattern="${BRANCH_PATTERN}" \
|
|
--build-config="cloudbuild.yaml" \
|
|
--project="${PROJECT_ID}" \
|
|
--quiet
|
|
echo "✓ Cloud Build trigger created: ${TRIGGER_NAME}"
|
|
else
|
|
echo "✓ Trigger already exists: ${TRIGGER_NAME}"
|
|
fi
|
|
|
|
echo ""
|
|
echo "=== 06: CI/CD Setup COMPLETE ==="
|
|
echo " NOTE: GitHub connection must be pre-authorized at:"
|
|
echo " https://console.cloud.google.com/cloud-build/triggers/connect?project=${PROJECT_ID}"
|
|
echo " After first deploy, switch traffic manually:"
|
|
echo " gcloud run services update-traffic ${CLOUD_RUN_SERVICE} --to-latest --region=${REGION}"
|