feat: GCF primary + Lambda fallback with quota-aware CF Worker routing #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Backend to Google Cloud Function | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'backend/**' | |
| - '.github/workflows/backend-deploy-gcf.yml' | |
| workflow_dispatch: | |
| jobs: | |
| deploy: | |
| name: Deploy to GCF (rootaccessctf) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.24' | |
| cache-dependency-path: backend/go.sum | |
| - name: Authenticate to GCP | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| credentials_json: ${{ secrets.GCP_ORION_SA_KEY }} | |
| - name: Set up gcloud | |
| uses: google-github-actions/setup-gcloud@v2 | |
| with: | |
| project_id: rootaccessctf | |
| - name: Enable required APIs | |
| run: | | |
| gcloud services enable \ | |
| cloudfunctions.googleapis.com \ | |
| cloudbuild.googleapis.com \ | |
| run.googleapis.com \ | |
| artifactregistry.googleapis.com \ | |
| --project=rootaccessctf | |
| - name: Deploy Cloud Function | |
| run: | | |
| gcloud functions deploy rootaccess-api \ | |
| --gen2 \ | |
| --project=rootaccessctf \ | |
| --region=us-east1 \ | |
| --runtime=go124 \ | |
| --source=backend/cloudfunction \ | |
| --entry-point=RootAccessAPI \ | |
| --trigger-http \ | |
| --allow-unauthenticated \ | |
| --memory=512Mi \ | |
| --timeout=60s \ | |
| --min-instances=0 \ | |
| --max-instances=10 \ | |
| --set-env-vars="APP_ENV=production,PORT=8080,TRUSTED_PROXIES=*,AWS_SSM_PATH=/RootAccess/Backend,AWS_REGION=us-east-1,CORS_ALLOWED_ORIGINS=https://rootaccessctf.web.app,https://rootaccess.live,https://ctf.rootaccess.live" \ | |
| --set-secrets="AWS_ACCESS_KEY_ID=gcf-aws-access-key-id:latest,AWS_SECRET_ACCESS_KEY=gcf-aws-secret-access-key:latest" | |
| - name: Get GCF URL | |
| id: gcf_url | |
| run: | | |
| URL=$(gcloud functions describe rootaccess-api \ | |
| --project=rootaccessctf \ | |
| --region=us-east1 \ | |
| --gen2 \ | |
| --format="value(serviceConfig.uri)") | |
| echo "url=$URL" >> $GITHUB_OUTPUT | |
| echo "GCF deployed at: $URL" | |
| - name: Update Cloudflare Worker GCF_BASE secret | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} | |
| run: | | |
| npm install -g wrangler | |
| echo "${{ steps.gcf_url.outputs.url }}" | \ | |
| wrangler secret put GCF_BASE \ | |
| --name rootaccess-api-router | |
| echo "CF Worker GCF_BASE updated to ${{ steps.gcf_url.outputs.url }}" |