Chris Christiansen
7f7a46ec51
Refactors the Cloud Build pipelines to a modular and branch-aware setup, resolving redundancy and adding core features. - `cloudbuild.opax-mcp.yaml`: A new, single pipeline for the OPAX-MCP service. It supports building from any branch, tags images with both branch name and commit SHA, and includes a placeholder for Tyr policy validation. Deployment to Cloud Run is conditional, running only for `main` and `opax-*` branches. - `cloudbuild.base.yaml`: A new architecture file that explains the CI/CD structure. It clarifies that `cloudbuild.opax-mcp.yaml` is the single source of truth. - `cloudbuild.yaml`, `cloudbuild.mcp.yaml`: These files are now deprecated. Their contents have been replaced with a notice pointing to the new pipeline to avoid confusion.
98 lines
3.6 KiB
YAML
98 lines
3.6 KiB
YAML
# Definitive CI/CD pipeline for the OPAX-MCP service.
|
|
# Uses YAML anchors for readable and reusable steps.
|
|
|
|
# --- Reusable Step Definitions (YAML Anchors) ---
|
|
x-reusable-steps:
|
|
# Anchor for Tyr Policy Check
|
|
- &tyr-policy-check
|
|
name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
|
|
id: 'Tyr Policy Check'
|
|
entrypoint: 'bash'
|
|
args:
|
|
- '-c'
|
|
- |
|
|
echo "INFO: Simulating Tyr Policy Check for branch [${_BRANCH_NAME}]..."
|
|
# This step will be replaced with the actual Tyr CLI call.
|
|
# Example: tyr-cli validate --source=. --commit=${_SHORT_SHA} --branch=${_BRANCH_NAME}
|
|
# A non-zero exit code here will fail the build.
|
|
echo "SUCCESS: Tyr Policy Check passed."
|
|
|
|
# Anchor for Building and Pushing the Docker image
|
|
- &docker-build-and-push
|
|
name: 'gcr.io/cloud-builders/docker'
|
|
id: 'Build and Push Image'
|
|
entrypoint: 'bash'
|
|
args:
|
|
- '-c'
|
|
- |
|
|
set -e
|
|
echo "INFO: Building Docker image for service [${_SERVICE_NAME}]."
|
|
docker build \
|
|
-t "${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_SHORT_SHA}" \
|
|
-t "${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_BRANCH_NAME}" \
|
|
--build-arg "COMMIT_SHA=${_SHORT_SHA}" \
|
|
-f "${_DOCKERFILE_PATH}" .
|
|
|
|
echo "INFO: Pushing tags [${_SHORT_SHA}, ${_BRANCH_NAME}] to Artifact Registry."
|
|
docker push --all "${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}"
|
|
|
|
# Anchor for Conditional Deployment to Cloud Run
|
|
- &deploy-to-cloud-run
|
|
name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
|
|
id: 'Deploy to Cloud Run'
|
|
entrypoint: 'bash'
|
|
args:
|
|
- '-c'
|
|
- |
|
|
set -e
|
|
if [[ "${_BRANCH_NAME}" == "main" || "${_BRANCH_NAME}" == opax-* ]]; then
|
|
echo "INFO: Branch [${_BRANCH_NAME}] is deployable. Deploying service [${_SERVICE_NAME}]..."
|
|
gcloud run deploy "${_SERVICE_NAME}" \
|
|
--project="${PROJECT_ID}" \
|
|
--region="${_REGION}" \
|
|
--image="${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_SHORT_SHA}" \
|
|
--platform="managed" \
|
|
--service-account="${_MCP_SA}" \
|
|
--set-secrets="MCP_SECRET=mcp-server-key:latest" \
|
|
--no-allow-unauthenticated \
|
|
--set-env-vars="BRANCH_NAME=${_BRANCH_NAME}" \
|
|
--update-labels="gcb-commit-sha=${_SHORT_SHA},branch-name=${_BRANCH_NAME}" \
|
|
--quiet
|
|
else
|
|
echo "INFO: Branch [${_BRANCH_NAME}] is not a deployable branch. Skipping deployment."
|
|
fi
|
|
|
|
# --- Pipeline Steps ---
|
|
steps:
|
|
# 1. Run Tyr Policy Check
|
|
- <<: *tyr-policy-check
|
|
|
|
# 2. Build and Push the image
|
|
- <<: *docker-build-and-push
|
|
waitFor: ['Tyr Policy Check']
|
|
|
|
# 3. Conditionally deploy to Cloud Run
|
|
- <<: *deploy-to-cloud-run
|
|
waitFor: ['Build and Push Image']
|
|
|
|
# --- Images created by this build ---
|
|
images:
|
|
- '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_SHORT_SHA}'
|
|
- '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_BRANCH_NAME}'
|
|
|
|
# --- Substitutions ---
|
|
substitutions:
|
|
# Default values, can be overridden by triggers
|
|
_REGION: 'us-central1'
|
|
_REPOSITORY: 'osvauco-repo'
|
|
_SERVICE_NAME: 'opax-mcp'
|
|
_DOCKERFILE_PATH: 'opax-mcp/Dockerfile'
|
|
_MCP_SA: 'jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com'
|
|
# These are automatically populated by Cloud Build
|
|
_BRANCH_NAME: ${BRANCH_NAME}
|
|
_SHORT_SHA: ${SHORT_SHA}
|
|
|
|
options:
|
|
logging: CLOUD_LOGGING_ONLY
|
|
substitutionOption: ALLOW_LOOSE
|