migrate-cloud-run

.github/workflows/google-cloudrun-docker.yml

@@ -0,0 +1,150 @@
+name: Build and Deploy to Cloud Run
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
+  PROJECT_REGION: ${{ vars.GCP_PROJECT_REGION }}
+  SERVICE_NAME: ${{ vars.GCP_SERVICE_API_NAME }}
+  JOB_NAME: ${{ vars.GCP_SERVICE_API_NAME }}-update-groups
+  ARTIFACT_REGISTRY: ${{ vars.GCP_ARTIFACT_REGISTRY }}
+
+jobs:
+  build-and-push:
+    name: Build and Push to Artifact Registry
+    runs-on: ubuntu-latest
+    environment: GCP-Rozen
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Authenticate Cloud CLI
+        uses: 'google-github-actions/auth@v2'
+        with:
+          credentials_json: ${{ secrets.GCP_SA_KEY }}
+
+      - name: Set up Cloud SDK
+        uses: 'google-github-actions/setup-gcloud@v2'
+
+      - name: Authorize Docker push
+        run: gcloud auth configure-docker ${{ env.PROJECT_REGION }}-docker.pkg.dev
+
+      - name: Define image tag
+        id: image_tag
+        run: echo "TAG=${{ env.PROJECT_REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.ARTIFACT_REGISTRY }}/${{ env.SERVICE_NAME }}:${{ github.sha }}" >> $GITHUB_ENV
+
+      - name: Build and Push Docker Image
+        run: |-
+          docker build -t $TAG .
+          docker push $TAG
+
+  deploy-to-cloud-run:
+    name: Deploy Service to Cloud Run
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    environment: GCP-Rozen
+    if: github.event_name == 'push' || github.event_name == 'pull_request'
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+
+    steps:
+      - name: Authenticate Cloud CLI
+        uses: 'google-github-actions/auth@v2'
+        with:
+          credentials_json: ${{ secrets.GCP_SA_KEY }}
+
+      - name: Set up Cloud SDK
+        uses: 'google-github-actions/setup-gcloud@v2'
+
+      - name: Define image tag for deployment
+        id: image_tag
+        run: echo "TAG=${{ env.PROJECT_REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.ARTIFACT_REGISTRY }}/${{ env.SERVICE_NAME }}:${{ github.sha }}" >> $GITHUB_ENV
+
+      - name: Get existing service URL
+        id: get_url
+        run: echo "URL=$(gcloud run services describe ${{ env.SERVICE_NAME }} --platform managed --region ${{ env.PROJECT_REGION }} --format 'value(status.url)')" >> $GITHUB_ENV
+
+      - name: Deploy to Cloud Run
+        run: |-
+          gcloud run deploy ${{ env.SERVICE_NAME }} \
+            --image $TAG \
+            --region ${{ env.PROJECT_REGION }} \
+            --service-account ${{ vars.GCP_SA_EMAIL }} \
+            --max-instances=${{ vars.GCP_SERVICE_API_MAX_INSTANCES }} \
+            --set-secrets=TELEGRAM_BOT_TOKEN=${{ vars.GCP_SECRET_TG_BOT_TOKEN }}:latest \
+            --set-secrets=DB_USER=${{ vars.GCP_SECRET_DB_USER }}:latest \
+            --set-secrets=DB_PASSWORD=${{ vars.GCP_SECRET_DB_PASSWORD }}:latest \
+            --set-secrets=DB_URL=${{ vars.GCP_SECRET_DB_URL }}:latest \
+            --set-env-vars=DB_PORT=${{ vars.GCP_DB_PORT }} \
+            --set-secrets=S3_ACCESS_ID=${{ vars.GCP_SECRET_S3_ACCESS_ID }}:latest \
+            --set-secrets=S3_ACCESS_SECRET=${{ vars.GCP_SECRET_S3_ACCESS_SECRET }}:latest \
+            --set-secrets=S3_HOST=${{ vars.GCP_SECRET_S3_HOST }}:latest \
+            --set-env-vars=S3_BUCKET=${{ vars.GCP_S3_BUCKET }} \
+            --set-env-vars=WEBHOOK_URL=${{ env.URL }} \
+            --platform managed \
+            --allow-unauthenticated
+
+  deploy-and-schedule-job:
+    name: Deploy and Schedule Job
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    environment: GCP-Rozen
+    if: github.event_name == 'push'
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+
+    steps:
+      - name: Authenticate Cloud CLI
+        uses: 'google-github-actions/auth@v2'
+        with:
+          credentials_json: ${{ secrets.GCP_SA_KEY }}
+
+      - name: Set up Cloud SDK
+        uses: 'google-github-actions/setup-gcloud@v2'
+
+      - name: Define image tag for deployment
+        run: echo "TAG=${{ env.PROJECT_REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.ARTIFACT_REGISTRY }}/${{ env.SERVICE_NAME }}:${{ github.sha }}" >> $GITHUB_ENV
+
+      - name: Deploy Cloud Run Job
+        run: |-
+          gcloud run jobs deploy ${{ env.JOB_NAME }} \
+            --image $TAG \
+            --region ${{ env.PROJECT_REGION }} \
+            --command=python \
+            --args=cron.py \
+            --service-account ${{ vars.GCP_SA_EMAIL }} \
+            --set-secrets=TELEGRAM_BOT_TOKEN=${{ vars.GCP_SECRET_TG_BOT_TOKEN }}:latest \
+            --set-secrets=DB_USER=${{ vars.GCP_SECRET_DB_USER }}:latest \
+            --set-secrets=DB_PASSWORD=${{ vars.GCP_SECRET_DB_PASSWORD }}:latest \
+            --set-secrets=DB_URL=${{ vars.GCP_SECRET_DB_URL }}:latest \
+            --set-env-vars=DB_PORT=${{ vars.GCP_DB_PORT }}
+
+      - name: Create or Update Cloud Scheduler Job
+        run: |
+          if gcloud scheduler jobs describe ${{ env.JOB_NAME }} --location=${{ env.PROJECT_REGION }} >/dev/null 2>&1; then
+            echo "Updating existing Cloud Scheduler job"
+            gcloud scheduler jobs update http ${{ env.JOB_NAME }} \
+              --location=${{ env.PROJECT_REGION }} \
+              --schedule="0 0 * * *" \
+              --uri="https://${{ env.PROJECT_REGION }}-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${{ env.PROJECT_ID }}/jobs/${{ env.JOB_NAME }}:run" \
+              --http-method=POST \
+              --oauth-service-account-email=${{ vars.GCP_SA_EMAIL }}
+          else
+            echo "Creating new Cloud Scheduler job"
+            gcloud scheduler jobs create http ${{ env.JOB_NAME }} \
+              --location=${{ env.PROJECT_REGION }} \
+              --schedule="0 0 * * *" \
+              --time-zone="America/Argentina/Buenos_Aires" \
+              --uri="https://${{ env.PROJECT_REGION }}-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${{ env.PROJECT_ID }}/jobs/${{ env.JOB_NAME }}:run" \
+              --http-method=POST \
+              --oauth-service-account-email=${{ vars.GCP_SA_EMAIL }}
+          fi

Dockerfile

@@ -0,0 +1,30 @@
+FROM python:3.11-slim as builder
+
+# Install uv
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+# Configure UV for container environment
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy
+
+WORKDIR /app
+
+# Copy dependency files
+COPY pyproject.toml uv.lock ./
+
+# Install dependencies (creates an isolated virtual environment at /app/.venv)
+RUN uv sync --frozen --no-install-project --no-dev
+
+FROM gcr.io/distroless/python3-debian12
+
+WORKDIR /app
+
+# Copy the dependencies from the builder's virtual environment
+COPY --from=builder /app/.venv/lib/python3.11/site-packages /app/packages
+
+COPY . .
+
+ENV PYTHONPATH=/app/packages
+
+ENTRYPOINT ["python"]
+CMD ["main.py"]