copilotkit_flutter_workshop/.github/workflows/deploy_runtime.yaml at main · VeryGoodOpenSource/copilotkit_flutter_workshop · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
# Deploys the shared backend (runtime/) to Cloud Run on every change to it on main.
# One-time setup of Google Cloud: runtime/deploy/setup_gcp.sh, which also lists the
# GitHub secrets this workflow needs.
name: deploy_runtime

on:
  push:
    branches: [main]
    paths:
      - "runtime/**"
      - ".github/workflows/deploy_runtime.yaml"
  workflow_dispatch:

# Two deploys at once would race on the same service.
concurrency:
  group: deploy_runtime
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write # lets the job sign in to Google Cloud without a key file

env:
  PROJECT_ID: gen-lang-client-0563181971
  REGION: us-central1
  SERVICE: calaverita-runtime
  REGISTRY_REPOSITORY: calaverita
  RUNTIME_SERVICE_ACCOUNT: calaverita-runtime@gen-lang-client-0563181971.iam.gserviceaccount.com

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Sign in to Google Cloud
        id: auth
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
          token_format: access_token

      - name: Sign in to Artifact Registry
        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ${{ env.REGION }}-docker.pkg.dev
          username: oauth2accesstoken
          password: ${{ steps.auth.outputs.access_token }}

      - name: Build and push the image
        id: image
        env:
          IMAGE: ${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REGISTRY_REPOSITORY }}/runtime:${{ github.sha }}
        run: |
          docker build --tag "$IMAGE" runtime
          docker push "$IMAGE"
          echo "name=$IMAGE" >> "$GITHUB_OUTPUT"

      # The key and the password stay in Secret Manager: Cloud Run hands them to the
      # revision as environment variables, read as the runtime service account.
      - name: Deploy to Cloud Run
        id: deploy
        uses: google-github-actions/deploy-cloudrun@2028e2d7d30a78c6910e0632e48dd561b064884d # v3.0.1
        with:
          project_id: ${{ env.PROJECT_ID }}
          region: ${{ env.REGION }}
          service: ${{ env.SERVICE }}
          image: ${{ steps.image.outputs.name }}
          secrets: |
            ANTHROPIC_API_KEY=anthropic-api-key:latest
            WORKSHOP_CODE=workshop-code:latest
          flags: >-
            --service-account=${{ env.RUNTIME_SERVICE_ACCOUNT }}
            --max-instances=1
            --cpu-boost
            --memory=512Mi
            --timeout=900

      # The password gate is the point of this deployment, so check it is on.
      - name: Smoke test
        env:
          BASE: ${{ steps.deploy.outputs.url }}/api/copilotkit
        run: |
          curl --fail --silent --show-error --retry 5 --retry-delay 5 --retry-all-errors "$BASE/info" | jq -e '.agents.default' \
            || { echo "If this is a 403, the service is not public yet: run runtime/deploy/setup_gcp.sh again."; exit 1; }
          status=$(curl --silent --output /dev/null --write-out '%{http_code}' --request POST "$BASE/agent/default/run" --data '{}')
          test "$status" = 401 || { echo "Expected 401 without the workshop code, got $status"; exit 1; }
          echo "Deployed: $BASE"