feat: deploy from CI

.github/workflows/deploy.yaml

@@ -19,7 +19,7 @@ jobs:
       with:
         project_id: '${{ vars.GCP_PROJECT_ID }}'
         workload_identity_provider: 'projects/${{ vars.GCP_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/github/providers/github-cwarck-hfe-bot'
-    
+
     - name: 'Set up Cloud SDK'
       uses: 'google-github-actions/setup-gcloud@v2'
       with:
@@ -28,9 +28,31 @@ jobs:
     - name: 'Docker auth'
       run: |-
         gcloud auth configure-docker ${{ vars.GAR_LOCATION }}-docker.pkg.dev
-    
+
     - name: 'Build and push image'
       run: |-
         IMAGE="${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.GCP_PROJECT_ID }}/hfe-bot/hfe-bot:${{ github.sha }}"
         docker build -t $IMAGE .
         docker push $IMAGE
+
+  deploy:
+    needs: build-push
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+
+    steps:
+    - uses: 'actions/checkout@v4'
+
+    - uses: 'google-github-actions/auth@v2'
+      with:
+        project_id: '${{ vars.GCP_PROJECT_ID }}'
+        workload_identity_provider: 'projects/${{ vars.GCP_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/github/providers/github-cwarck-hfe-bot'
+
+    - uses: 'google-github-actions/deploy-cloudrun@v2'
+      with:
+        service: 'hfe-bot'
+        region: '${{ vars.GAR_LOCATION }}'
+        image: '${{ vars.GAR_LOCATION }}-docker.pkg.dev/${{ vars.GCP_PROJECT_ID }}/hfe-bot/hfe-bot:${{ github.sha }}'

deploy/terraform/main.tf

@@ -1,3 +1,9 @@
+locals {
+  name                    = "hfe-bot"
+  github_repository_name  = "cwarck/hfe-bot"
+  github_actions_identity = "principalSet://iam.googleapis.com/projects/${data.google_project.this.number}/locations/global/workloadIdentityPools/github/attribute.repository/${local.github_repository_name}"
+}
+
 data "google_project" "this" {}
 
 resource "google_project_service" "required_apis" {
@@ -19,21 +25,25 @@ resource "google_project_service" "required_apis" {
 
 # Add this service account to the target Google Sheets spreadsheet with the "Editor" role
 resource "google_service_account" "app" {
-  account_id   = "hfe-bot"
-  display_name = "Service Account for hfe-bot"
+  account_id   = local.name
+  display_name = "Service Account for ${local.name}"
   project      = var.project_id
 }
 
+resource "google_service_account_iam_binding" "iam_serviceaccount_user" {
+  service_account_id = google_service_account.app.name
+  role               = "roles/iam.serviceAccountUser"
+  members            = [local.github_actions_identity]
+}
+
 resource "google_artifact_registry_repository" "app" {
   location      = var.region
-  repository_id = "hfe-bot"
-  description   = "Docker repository for hfe-bot"
+  repository_id = local.name
+  description   = "Docker repository for ${local.name}"
   format        = "DOCKER"
   project       = var.project_id
 
-  depends_on = [
-    google_project_service.required_apis
-  ]
+  depends_on = [google_project_service.required_apis]
 }
 
 # Allow to push from Github Actions using Workload Identity Federation
@@ -42,13 +52,11 @@ resource "google_artifact_registry_repository_iam_binding" "binding" {
   location   = google_artifact_registry_repository.app.location
   repository = google_artifact_registry_repository.app.name
   role       = "roles/artifactregistry.writer"
-  members = [
-    "principalSet://iam.googleapis.com/projects/${data.google_project.this.number}/locations/global/workloadIdentityPools/github/attribute.repository/cwarck/hfe-bot"
-  ]
+  members    = [local.github_actions_identity]
 }
 
 resource "google_cloud_run_v2_service" "app" {
-  name                = "hfe-bot"
+  name                = local.name
   location            = var.region
   deletion_protection = false
   ingress             = "INGRESS_TRAFFIC_ALL"
@@ -103,7 +111,14 @@ resource "google_cloud_run_v2_service_iam_binding" "noauth" {
   location = google_cloud_run_v2_service.app.location
   name     = google_cloud_run_v2_service.app.name
   role     = "roles/run.invoker"
-  members = [
-    "allUsers",
-  ]
+  members  = ["allUsers"]
+}
+
+# Allow to uptdate the Cloud Run service from Github Actions
+resource "google_cloud_run_v2_service_iam_binding" "admin" {
+  project  = google_cloud_run_v2_service.app.project
+  location = google_cloud_run_v2_service.app.location
+  name     = google_cloud_run_v2_service.app.name
+  role     = "roles/run.admin"
+  members  = [local.github_actions_identity]
 }