build-and-push-web.yaml

name: Build and Push Web

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - "app/web/**"
      - ".github/workflows/build-and-push-web.yaml"
  pull_request:
    types: -opened
    branches:
      - main
    paths:
      - "app/web/**"

env:
  TAG: prod
  GAR: ${{ secrets.ARTIFACT_REGISTRY }}
  CR_SERVICE: project-ct
  CR_REGION: northamerica-northeast2

jobs:
  build-and-push-web:
    name: build-and-push-web
    runs-on: ubuntu-20.04

    permissions:
      contents: "read"
      id-token: "write"

    steps:
      - id: checkout
        name: Checkout
        uses: actions/checkout@v4

      - id: auth
        name: Authenticate with Google Cloud
        uses: google-github-actions/auth@v2
        with:
          token_format: access_token
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}
          access_token_lifetime: 300s

      - name: Login to Google Artifact Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ secrets.ARTIFACT_REGISTRY }}
          username: oauth2accesstoken
          password: ${{ steps.auth.outputs.access_token }}

      - name: Setup api url
        run: |
          API_URL=$(gcloud run services list | grep api | awk '{print $4}')
          echo "NEXT_PUBLIC_HOSTNAME=$API_URL/api" > app/web/.env.local

      - name: build-tag-push
        run: |
          export GAR=${{ env.GAR }}
          make build-push-web ${{ env.TAG }}
      - name: Redeploy Cloudrun Service
        run: |
          gcloud run services update ${{ env.CR_SERVICE }} --region=${{ env.CR_REGION }} --image=${{ env.GAR }}web:${{ env.TAG }}