97 lines
3.6 KiB
YAML
97 lines
3.6 KiB
YAML
# Definitive CI/CD pipeline for the OPAX-MCP service.
|
|
|
|
# --- Pipeline Steps ---
|
|
steps:
|
|
# 0. Clone the specific branch from the repository
|
|
- name: 'gcr.io/cloud-builders/git'
|
|
id: 'Clone Repository'
|
|
args:
|
|
- 'clone'
|
|
- '--branch'
|
|
- '${_BRANCH_NAME}'
|
|
- '--single-branch'
|
|
- 'http://34.59.131.162:3000/chris/osvauco.git'
|
|
- '.' # Clone into the current directory (/workspace)
|
|
waitFor: ['-'] # Run first
|
|
|
|
# 1. Run Tyr Policy Check
|
|
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
|
|
id: 'Tyr Policy Check'
|
|
entrypoint: 'bash'
|
|
waitFor: ['Clone Repository']
|
|
args:
|
|
- '-c'
|
|
- |
|
|
echo "INFO: Simulating Tyr Policy Check for branch [${_BRANCH_NAME}]..."
|
|
# This step will be replaced with the actual Tyr CLI call.
|
|
# Example: tyr-cli validate --source=. --commit=${_SHORT_SHA} --branch=${_BRANCH_NAME}
|
|
# A non-zero exit code here will fail the build.
|
|
echo "SUCCESS: Tyr Policy Check passed."
|
|
|
|
# 2. Build and Push the image
|
|
- name: 'gcr.io/cloud-builders/docker'
|
|
id: 'Build and Push Image'
|
|
entrypoint: 'bash'
|
|
waitFor: ['Tyr Policy Check']
|
|
args:
|
|
- '-c'
|
|
- |
|
|
set -e
|
|
echo "INFO: Building Docker image for service [${_SERVICE_NAME}]."
|
|
docker build \
|
|
--no-cache \
|
|
-t "${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_SHORT_SHA}" \
|
|
-t "${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_BRANCH_NAME}" \
|
|
--build-arg "COMMIT_SHA=${_SHORT_SHA}" \
|
|
-f "${_DOCKERFILE_PATH}" .
|
|
|
|
echo "INFO: Pushing tags [${_SHORT_SHA}, ${_BRANCH_NAME}] to Artifact Registry."
|
|
docker push --all "${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}"
|
|
|
|
# 3. Conditionally deploy to Cloud Run
|
|
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
|
|
id: 'Deploy to Cloud Run'
|
|
entrypoint: 'bash'
|
|
waitFor: ['Build and Push Image']
|
|
args:
|
|
- '-c'
|
|
- |
|
|
set -e
|
|
if [[ "${_BRANCH_NAME}" == "main" || "${_BRANCH_NAME}" == opax-* ]]; then
|
|
echo "INFO: Branch [${_BRANCH_NAME}] is deployable. Deploying service [${_SERVICE_NAME}]..."
|
|
gcloud run deploy "${_SERVICE_NAME}" \
|
|
--project="${PROJECT_ID}" \
|
|
--region="${_REGION}" \
|
|
--image="${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_SHORT_SHA}" \
|
|
--platform="managed" \
|
|
--service-account="${_MCP_SA}" \
|
|
--set-secrets="MCP_SECRET=mcp-server-key:latest" \
|
|
--no-allow-unauthenticated \
|
|
--set-env-vars="BRANCH_NAME=${_BRANCH_NAME}" \
|
|
--update-labels="gcb-commit-sha=${_SHORT_SHA},branch-name=${_BRANCH_NAME}" \
|
|
--quiet
|
|
else
|
|
echo "INFO: Branch [${_BRANCH_NAME}] is not a deployable branch. Skipping deployment."
|
|
fi
|
|
|
|
# --- Images created by this build ---
|
|
images:
|
|
- '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_SHORT_SHA}'
|
|
- '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_BRANCH_NAME}'
|
|
|
|
# --- Substitutions ---
|
|
substitutions:
|
|
# Default values, can be overridden by triggers
|
|
_REGION: 'us-central1'
|
|
_REPOSITORY: 'osvauco-repo'
|
|
_SERVICE_NAME: 'opax-mcp'
|
|
_DOCKERFILE_PATH: 'opax-mcp/Dockerfile'
|
|
_MCP_SA: 'jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com'
|
|
# These are automatically populated by Cloud Build
|
|
_BRANCH_NAME: 'main' # Default for manual runs, will be overridden
|
|
_SHORT_SHA: 'manual'
|
|
|
|
options:
|
|
logging: CLOUD_LOGGING_ONLY
|
|
substitutionOption: ALLOW_LOOSE
|