Skip to content

Commit d5154ab

Browse files
chasinandrewchasinandrew
authored
Feature/buildpack workflow (#7)
<!-- Thank you for proposing a pull request! Please note that SOME TESTS WILL LIKELY FAIL due to how GitHub exposes secrets in Pull Requests from forks. Someone from the team will review your Pull Request and respond. Please describe your change and any implementation details below. - Adding a new example for building and publishing a container image with buildpacks. -->
1 parent dca5b53 commit d5154ab

File tree

4 files changed

+150
-1
lines changed

4 files changed

+150
-1
lines changed

‎properties/cloudrun-buildpacks.properties.json

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"name": "Build and Deploy to Cloud Run",
3+
"description": "Build a container image with Buildpacks, publish it to Google Artifact Registry, and deploy to Google Cloud Run.",
4+
"creator": "Google Cloud",
5+
"iconName": "google-cloud",
6+
"categories": ["Deployment", "Containers", "Buildpacks", "Cloud Run", "Serverless"]
7+
}

‎workflow.config.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,12 @@
2323
"workflowPath": "workflows/deploy-cloudrun/cloudrun-source.yml",
2424
"propertiesPath": "properties/cloudrun-source.properties.json"
2525
},
26+
"cloudrun-buildpacks": {
27+
"starter": true,
28+
"type": "deployments",
29+
"workflowPath": "workflows/deploy-cloudrun/cloudrun-buildpacks.yml",
30+
"propertiesPath": "properties/cloudrun-buildpacks.properties.json"
31+
},
2632
"gke-build-deploy": {
2733
"starter": true,
2834
"type": "deployments",

‎workflows/deploy-cloudrun/cloudrun-buildpacks.yml

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
# This workflow builds source code with buildpacks and deploys the resulting container image to Cloud Run when a commit is pushed to the $default-branch branch
2+
#
3+
# Overview:
4+
#
5+
# 1. Authenticate to Google Cloud
6+
# 2. Authenticate Docker to Artifact Registry
7+
# 3. Download Buildpack CLI
8+
# 4. Build code with Buildpacks
9+
# 5. Publish image to Google Artifact Registry
10+
# 6. Deploy it to Cloud Run
11+
#
12+
# To configure this workflow:
13+
#
14+
# 1. Ensure the required Google Cloud APIs are enabled:
15+
#
16+
# Cloud Run run.googleapis.com
17+
# Artifact Registry artifactregistry.googleapis.com
18+
#
19+
# 2. Create and configure Workload Identity Federation for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)
20+
#
21+
# 3. Ensure the required IAM permissions are granted
22+
#
23+
# Cloud Run
24+
# roles/run.admin
25+
# roles/iam.serviceAccountUser (to act as the Cloud Run runtime service account)
26+
#
27+
# Artifact Registry
28+
# roles/artifactregistry.admin (project or repository level)
29+
#
30+
# NOTE: You should always follow the principle of least privilege when assigning IAM roles
31+
#
32+
# 4. Create GitHub secrets for WIF_PROVIDER and WIF_SERVICE_ACCOUNT
33+
#
34+
# 5. Change the values for the PROJECT_ID, GAR_LOCATION, REPOSITORY, SERVICE, SOURCE_DIRECTORY and REGION environment variables (below).
35+
#
36+
# NOTE: To use Google Container Registry instead, replace ${{ env.GAR_LOCATION }}-docker.pkg.dev with gcr.io
37+
#
38+
# For more support on how to run this workflow, please visit https://github.com/marketplace/actions/deploy-to-cloud-run
39+
#
40+
# Further reading:
41+
# Cloud Run IAM permissions - https://cloud.google.com/run/docs/deploying
42+
# Artifact Registry IAM permissions - https://cloud.google.com/artifact-registry/docs/access-control#roles
43+
# Container Registry vs Artifact Registry - https://cloud.google.com/blog/products/application-development/understanding-artifact-registry-vs-container-registry
44+
# Principle of least privilege - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege
45+
# Buildpacks Overview - https://cloud.google.com/docs/buildpacks/overview
46+
# Build an Application with Buildpacks - https://cloud.google.com/docs/buildpacks/build-application
47+
48+
name: Build and Deploy to Cloud Run
49+
50+
on:
51+
push:
52+
branches:
53+
- $default-branch
54+
55+
env:
56+
PROJECT_ID: YOUR_PROJECT_ID # TODO: update Google Cloud project id
57+
GAR_LOCATION: YOUR_GAR_LOCATION # TODO: update Artifact Registry location
58+
REPOSITORY: YOUR_REPOSITORY_NAME # TODO: update Artifact Registry repository name
59+
SERVICE: YOUR_SERVICE_NAME # TODO: update Cloud Run service name
60+
REGION: YOUR_SERVICE_REGION # TODO: update Cloud Run service region
61+
SOURCE_DIRECTORY: YOUR_SOURCE_DIRECTORY #TODO: update source code directory
62+
63+
jobs:
64+
deploy:
65+
# Add 'id-token' with the intended permissions for workload identity federation
66+
permissions:
67+
contents: 'read'
68+
id-token: 'write'
69+
70+
runs-on: ubuntu-latest
71+
steps:
72+
- name: Checkout
73+
uses: actions/checkout@v3
74+
75+
- name: Google Auth
76+
id: auth
77+
uses: 'google-github-actions/auth@v0'
78+
with:
79+
token_format: 'access_token'
80+
workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider
81+
service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - [email protected]
82+
83+
# NOTE: Alternative option - authentication via credentials json
84+
# - name: Google Auth
85+
# id: auth
86+
# uses: 'google-github-actions/auth@v0'
87+
# with:
88+
# credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
89+
90+
# BEGIN - Docker auth
91+
92+
# Authenticate Docker to Google Cloud Artifact Registry
93+
- name: Docker Auth
94+
id: docker-auth
95+
uses: 'docker/login-action@v1'
96+
with:
97+
username: 'oauth2accesstoken'
98+
password: '${{ steps.auth.outputs.access_token }}'
99+
registry: '${{ env.GAR_LOCATION }}-docker.pkg.dev'
100+
101+
# NOTE: Alternative option - authentication via credentials json
102+
# - name: Docker Auth
103+
# id: docker-auth
104+
# uses: 'docker/login-action@v1'
105+
# with:
106+
# registry: ${{ env.GAR_LOCATION }}-docker.pkg.dev
107+
# username: _json_key
108+
# password: ${{ secrets.GCP_CREDENTIALS }}
109+
110+
# BEGIN - Pack download, build and publish
111+
112+
# Build and publish image to Artifact Registry
113+
- name: Build and Publish with Buildpacks
114+
uses: buildpacks/github-actions/[email protected]
115+
run: |-
116+
pack config default-builder gcr.io/buildpacks.builder:v1
117+
pack build ${{ env.SOURCE_CODE_DIRECTORY }}
118+
pack --publish ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.SERVICE }}:${{ github.sha }}
119+
120+
# END - Docker auth, pack download, buildpack build and publish
121+
122+
- name: Deploy to Cloud Run
123+
id: deploy
124+
uses: google-github-actions/deploy-cloudrun@v0
125+
with:
126+
service: ${{ env.SERVICE }}
127+
region: ${{ env.REGION }}
128+
image: ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.SERVICE }}:${{ github.sha }}
129+
# NOTE: You can also set env variables here:
130+
# env_vars: |
131+
# NODE_ENV=production
132+
# TOKEN_EXPIRE=6400
133+
134+
# If required, use the Cloud Run url output in later steps
135+
- name: Show Output
136+
run: echo ${{ steps.deploy.outputs.url }}

‎workflows/deploy-cloudrun/cloudrun-declarative.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ jobs:
107107
run: |-
108108
export IMAGE="${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}"
109109
export SERVICE="${{ env.SERVICE }}"
110-
envsubst < service.template.yaml > service.yaml
110+
envsubst < ./workflows/deploy-cloudrun/service.template.yaml > service.yaml
111111
112112
# Deploy Cloud Run Service from the YAML Service specification
113113
- name: Deploy to Cloud Run

0 commit comments

Comments
 (0)