Clean up backend docs and add docs directory #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Backend to Google Cloud Function | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'backend/**' | |
| - '.github/workflows/backend-deploy-gcf.yml' | |
| workflow_dispatch: | |
| jobs: | |
| deploy: | |
| name: Deploy to GCF (rootaccessctf) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.24' | |
| cache-dependency-path: backend/go.sum | |
| - name: Authenticate to GCP | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| credentials_json: ${{ secrets.GCP_ORION_SA_KEY }} | |
| - name: Set up gcloud | |
| uses: google-github-actions/setup-gcloud@v2 | |
| with: | |
| project_id: rootaccessctf | |
| - name: Enable required APIs | |
| run: | | |
| gcloud services enable \ | |
| cloudfunctions.googleapis.com \ | |
| cloudbuild.googleapis.com \ | |
| run.googleapis.com \ | |
| artifactregistry.googleapis.com \ | |
| --project=rootaccessctf | |
| - name: Create Artifact Registry repository | |
| run: | | |
| gcloud artifacts repositories create gcf-artifacts \ | |
| --repository-format=docker \ | |
| --location=us-east1 \ | |
| --project=rootaccessctf \ | |
| --description="GCF container images for rootaccess-api" 2>&1 || \ | |
| echo "Repository already exists, skipping." | |
| - name: Write env-vars file | |
| run: | | |
| cat > /tmp/gcf-env.yaml <<'EOF' | |
| APP_ENV: "production" | |
| TRUSTED_PROXIES: "*" | |
| AWS_SSM_PATH: "/RootAccess/Backend" | |
| AWS_REGION: "us-east-1" | |
| CORS_ALLOWED_ORIGINS: "https://rootaccessctf.web.app,https://rootaccess.live,https://ctf.rootaccess.live" | |
| EOF | |
| - name: Deploy Cloud Function | |
| run: | | |
| gcloud functions deploy rootaccess-api \ | |
| --gen2 \ | |
| --project=rootaccessctf \ | |
| --region=us-east1 \ | |
| --runtime=go124 \ | |
| --source=backend \ | |
| --entry-point=RootAccessAPI \ | |
| --trigger-http \ | |
| --allow-unauthenticated \ | |
| --memory=512Mi \ | |
| --timeout=60s \ | |
| --min-instances=0 \ | |
| --max-instances=1 \ | |
| --env-vars-file=/tmp/gcf-env.yaml \ | |
| --set-secrets="AWS_ACCESS_KEY_ID=gcf-aws-access-key-id:latest,AWS_SECRET_ACCESS_KEY=gcf-aws-secret-access-key:latest" | |
| - name: Get GCF URL | |
| id: gcf_url | |
| run: | | |
| URL=$(gcloud functions describe rootaccess-api \ | |
| --project=rootaccessctf \ | |
| --region=us-east1 \ | |
| --gen2 \ | |
| --format="value(serviceConfig.uri)") | |
| echo "url=$URL" >> $GITHUB_OUTPUT | |
| echo "GCF deployed at: $URL" | |
| - name: Cleanup — Artifact Registry (keep last 3 images) | |
| run: | | |
| # Set cleanup policy on the GCF container repo — keep only 3 most recent, | |
| # delete anything older than 7 days. Stays well within 0.5 GB free tier. | |
| REPO="us-east1-docker.pkg.dev/rootaccessctf/gcf-artifacts" | |
| # Wait briefly for the repo to exist after first deploy | |
| sleep 5 | |
| gcloud artifacts repositories set-cleanup-policies gcf-artifacts \ | |
| --project=rootaccessctf \ | |
| --location=us-east1 \ | |
| --policy=<(cat <<'EOF' | |
| [ | |
| { | |
| "name": "keep-last-3", | |
| "action": {"type": "Keep"}, | |
| "mostRecentVersions": {"keepCount": 3} | |
| }, | |
| { | |
| "name": "delete-older-than-7d", | |
| "action": {"type": "Delete"}, | |
| "condition": {"olderThan": "604800s"} | |
| } | |
| ] | |
| EOF | |
| ) 2>&1 || echo "Cleanup policy skipped (repo may not exist yet on first deploy)" | |
| - name: Cleanup — Cloud Build GCS artifacts (keep 3 days) | |
| run: | | |
| # Find the Cloud Build staging bucket and set a 3-day lifecycle rule | |
| BUCKET=$(gcloud storage buckets list \ | |
| --project=rootaccessctf \ | |
| --filter="name~gcf" \ | |
| --format="value(name)" 2>/dev/null | head -1) | |
| if [ -n "$BUCKET" ]; then | |
| echo "Setting lifecycle on gs://$BUCKET" | |
| cat > /tmp/gcs-lifecycle.json <<'EOF' | |
| { | |
| "rule": [ | |
| { | |
| "action": {"type": "Delete"}, | |
| "condition": {"age": 3} | |
| } | |
| ] | |
| } | |
| EOF | |
| gcloud storage buckets update "gs://$BUCKET" \ | |
| --lifecycle-file=/tmp/gcs-lifecycle.json | |
| else | |
| echo "No GCF build bucket found yet — skipping." | |
| fi | |
| - name: Update Cloudflare Worker GCF_BASE secret | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} | |
| run: | | |
| npm install -g wrangler | |
| echo "${{ steps.gcf_url.outputs.url }}" | \ | |
| wrangler secret put GCF_BASE \ | |
| --name rootaccess-api-router | |
| echo "CF Worker GCF_BASE updated to ${{ steps.gcf_url.outputs.url }}" |