Add GitHub Actions Cloud Run deploy path

[Pigbibi]

Summary

• add a Dockerfile so GitHub Actions can build a deployable Cloud Run image
• add an opt-in ENABLE_GITHUB_CLOUD_RUN_DEPLOY path alongside the existing env sync path
• keep multi-service IBKR targets driven by CLOUD_RUN_SERVICE_TARGETS_JSON / CLOUD_RUN_SERVICES, with Artifact Registry host configurable or derived from CLOUD_RUN_REGION

Validation

• git diff --check
• npx prettier --check parsed the workflow; it reported formatting warnings only, so I did not rewrite the whole workflow

Rollout

• leave existing Cloud Build triggers enabled until one GitHub Actions deploy is verified
• then set ENABLE_GITHUB_CLOUD_RUN_DEPLOY=true and disable the old trigger for this repo

[Pigbibi]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c9ea35de7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Exclude workspace credentials from the image context

When ENABLE_GITHUB_CLOUD_RUN_DEPLOY=true, the workflow authenticates with google-github-actions/auth before docker build, and that action creates gha-creds-*.json in $GITHUB_WORKSPACE by default; with no .dockerignore, COPY . . bakes that temporary GCP credential file (and the checked-out .git metadata) into the pushed Cloud Run image. Add a .dockerignore for gha-creds-*.json, .git/, etc. or build before creating the credentials file.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Put the commit label on the revision template

In the deploy+env-sync path, the later wait loop reads spec.template.metadata.labels.commit-sha, but this deploy only passes --labels, which Cloud Run documents as service metadata.labels rather than revision-template spec.template.metadata.labels. With both ENABLE_GITHUB_CLOUD_RUN_DEPLOY=true and ENABLE_GITHUB_ENV_SYNC=true, the image deploy can succeed but the wait step never observes the SHA and times out before syncing env vars.

Useful? React with 👍 / 👎.