CustomCodeConnectForFlutterFlow/.github/workflows/deploy-runner.yml at main · sgardoll/CustomCodeConnectForFlutterFlow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
name: Deploy runner

# Deploy the FlutterFlow AI runner to Cloud Run whenever cloud-run/** changes
# land on main, so a merged runner fix actually ships instead of sitting in the
# repo. Additive only: it never touches branch protection and never runs on
# pull requests.

on:
  push:
    branches: [main]
    paths:
      - "cloud-run/**"
  # Deploys can fail for reasons outside the code (a missing IAM grant, a Cloud
  # Build outage). Without this the only way to retry was to push a no-op
  # commit, which is worse than useless on the branch that deploys production.
  workflow_dispatch:

# The deploy script needs `gcloud` (auth + setup-gcloud below). No write access
# to this repository itself is required.
permissions:
  contents: read

concurrency:
  group: deploy-runner
  cancel-in-progress: true

jobs:
  deploy-runner:
    runs-on: ubuntu-latest
    steps:
      # The secret cannot gate the job itself: the `secrets` context is not
      # available in a job-level `if` (only github/needs/vars/inputs are), and
      # using it there makes the whole workflow file invalid. It is available to
      # a step, so the gate is a first step that reports whether the key exists
      # and every step that needs it skips while it does not. The intent is
      # unchanged: pushes before one-time setup complete are skipped quietly
      # rather than failing.
      - name: Check for deploy credentials
        id: creds
        env:
          SA_KEY_JSON: ${{ secrets.CCC_FFAI_RUNNER_SA_KEY_JSON }}
        run: |
          if [ -n "$SA_KEY_JSON" ]; then
            echo "present=true" >> "$GITHUB_OUTPUT"
          else
            echo "present=false" >> "$GITHUB_OUTPUT"
            echo "::notice::CCC_FFAI_RUNNER_SA_KEY_JSON is not set, so the runner was not deployed. See DEPLOYMENT.md for the one-time setup."
          fi

      - name: Checkout
        if: steps.creds.outputs.present == 'true'
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Authenticate to Google Cloud
        if: steps.creds.outputs.present == 'true'
        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2
        with:
          # JSON of a service account with roles/run.admin + roles/cloudbuild.builds.editor + roles/iam.serviceAccountUser.
          credentials_json: ${{ secrets.CCC_FFAI_RUNNER_SA_KEY_JSON }}

      - name: Set up gcloud
        if: steps.creds.outputs.present == 'true'
        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2
        with:
          project_id: ${{ vars.CCC_PROJECT_ID || 'low-code-connect' }}

      - name: Deploy the FlutterFlow AI runner
        if: steps.creds.outputs.present == 'true'
        run: |
          PROJECT_ID="${{ vars.CCC_PROJECT_ID || 'low-code-connect' }}" \
          REGION="${{ vars.CCC_REGION || 'us-west1' }}" \
          ./scripts/deploy_cloud_run_ffai.sh