name: Deploy Graph API to Cloud Run
on:
push:
branches:
- main
paths:
- 'packages/graph-api/**'
- '.github/workflows/deploy-graph-api.yml'
workflow_dispatch:
env:
PROJECT_ID: canada-gpt-ca
REGION: us-central1
SERVICE_NAME: canadagpt-graph-api
REGISTRY: us-central1-docker.pkg.dev
REPOSITORY: canadagpt
NEO4J_INTERNAL_IP: '10.128.0.3'
jobs:
deploy:
name: Build and Deploy Graph API
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Authenticate to Google Cloud
uses: google-github-actions/auth@v2
with:
credentials_json: ${{ secrets.GCP_SA_KEY }}
- name: Set up Cloud SDK
uses: google-github-actions/setup-gcloud@v2
- name: Configure Docker for Artifact Registry
run: |
gcloud auth configure-docker ${{ env.REGISTRY }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build and Push Docker image
run: |
cd packages/graph-api
docker buildx build \
--platform linux/amd64 \
--no-cache \
-t ${{ env.REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/graph-api:${{ github.sha }} \
-t ${{ env.REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/graph-api:latest \
--push \
.
- name: Deploy to Cloud Run
run: |
gcloud run deploy ${{ env.SERVICE_NAME }} \
--image=${{ env.REGISTRY }}/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/graph-api:${{ github.sha }} \
--platform=managed \
--region=${{ env.REGION }} \
--project=${{ env.PROJECT_ID }} \
--allow-unauthenticated \
--port=4000 \
--memory=1Gi \
--cpu=1 \
--min-instances=0 \
--max-instances=10 \
--timeout=300 \
--set-env-vars="NEO4J_URI=bolt://${{ env.NEO4J_INTERNAL_IP }}:7687,NEO4J_USER=neo4j,NODE_ENV=production,CORS_ORIGINS=https://canadagpt.ca;http://localhost:3000;https://www.canadagpt.ca,GRAPHQL_INTROSPECTION=false,GRAPHQL_PLAYGROUND=false,GRAPHIQL_ALLOWED_IPS=,AUTH_REQUIRED=true" \
--set-secrets="NEO4J_PASSWORD=neo4j-password:latest,FRONTEND_API_KEY=canadagpt-frontend-api-key:latest,PUBLIC_API_KEY=canadagpt-public-api-key:latest,ADMIN_API_KEY=canadagpt-admin-api-key:latest,JWT_SECRET=canadagpt-jwt-secret:latest" \
--service-account=canadagpt-graph-api-sa@canada-gpt-ca.iam.gserviceaccount.com \
--vpc-connector=canadagpt-connector \
--vpc-egress=private-ranges-only
- name: Smoke Test
run: |
SERVICE_URL=$(gcloud run services describe ${{ env.SERVICE_NAME }} --region=${{ env.REGION }} --format='value(status.url)')
echo "Testing GraphQL endpoint: $SERVICE_URL/graphql"
# Test basic connectivity
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$SERVICE_URL/graphql?query={__typename}")
if [ "$HTTP_STATUS" -eq 200 ]; then
echo "✅ GraphQL endpoint responding (HTTP $HTTP_STATUS)"
else
echo "❌ GraphQL endpoint returned HTTP $HTTP_STATUS"
exit 1
fi
- name: Deployment Summary
run: |
SERVICE_URL=$(gcloud run services describe ${{ env.SERVICE_NAME }} --region=${{ env.REGION }} --format='value(status.url)')
echo "🚀 Graph API deployment completed!"
echo "GraphQL URL: $SERVICE_URL/graphql"
