58 lines
2.1 KiB
YAML
58 lines
2.1 KiB
YAML
# agents/mcp_server/cloudbuild.yaml
|
|
# Deploy opax-mcp som separat Cloud Run-tjeneste
|
|
# Trigger: path filter agents/mcp_server/** på branch main
|
|
|
|
substitutions:
|
|
_TAG: 'latest'
|
|
_OSVAUCO_TRIGGER_ID: '38423976-91ff-4ff4-859e-1f262344c609'
|
|
|
|
steps:
|
|
- name: 'python:3.11-slim'
|
|
id: 'SecurityScan'
|
|
entrypoint: 'bash'
|
|
args:
|
|
- '-c'
|
|
- |
|
|
pip install bandit pip-audit
|
|
echo "=== SAST (bandit) ==="
|
|
bandit -r . -ll -ii || true
|
|
echo "=== Dependency scan (pip-audit) ==="
|
|
pip-audit -r agents/mcp_server/requirements.txt || true
|
|
|
|
- name: 'gcr.io/cloud-builders/docker'
|
|
entrypoint: bash
|
|
args:
|
|
- '-c'
|
|
- |
|
|
TAG="${SHORT_SHA:-${_TAG}}"
|
|
docker build \
|
|
-t us-central1-docker.pkg.dev/$PROJECT_ID/osvauco-repo/opax-mcp:$$TAG \
|
|
-f agents/mcp_server/Dockerfile \
|
|
agents/mcp_server
|
|
docker push us-central1-docker.pkg.dev/$PROJECT_ID/osvauco-repo/opax-mcp:$$TAG
|
|
echo "$$TAG" > /workspace/image_tag.txt
|
|
|
|
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
|
|
entrypoint: bash
|
|
args:
|
|
- '-c'
|
|
- |
|
|
TAG=$(cat /workspace/image_tag.txt)
|
|
gcloud run deploy opax-mcp \
|
|
--image=us-central1-docker.pkg.dev/$PROJECT_ID/osvauco-repo/opax-mcp:$$TAG \
|
|
--region=us-central1 \
|
|
--platform=managed \
|
|
--no-allow-unauthenticated \
|
|
--service-account=jason-vauger@$PROJECT_ID.iam.gserviceaccount.com \
|
|
--set-env-vars=OSVX_MCP_URL=https://osvx-mcp-zjbqp3prqq-uc.a.run.app,GOOGLE_CLOUD_PROJECT=$PROJECT_ID,STATIC_BUCKET=opax-vauco-static,CLOUD_RUN_SERVICE=osvauco-agent,CLOUD_BUILD_TRIGGER_ID=${_OSVAUCO_TRIGGER_ID},OPAX_IAP_CLIENT_ID=357036551735-kq8nt7ld38hfqlcfb3n52ef7tala4meo.apps.googleusercontent.com \
|
|
--update-secrets=MCP_SECRET=mcp-server-key:latest,GITEA_TOKEN=gitea-token:latest,GITHUB_PAT=github-pat:latest \
|
|
--memory=512Mi \
|
|
--cpu=1 \
|
|
--min-instances=0 \
|
|
--max-instances=5 \
|
|
--timeout=60
|
|
|
|
options:
|
|
logging: CLOUD_LOGGING_ONLY
|
|
defaultLogsBucketBehavior: REGIONAL_USER_OWNED_BUCKET
|