ci: pass all env vars & secrets to Google Cloud Run and Firebase Studio

[Copilot]

No CI/CD existed for Google Cloud deployment, and no development workspace config was defined for Firebase Studio. All 35+ env vars/secrets were scattered across the codebase with no single source of truth for deployment.

Changes

• Dockerfile — Containerizes the Flask API (api/) with Python 3.12-slim + Gunicorn; entry point for Cloud Run
• .github/workflows/deploy-cloud-run.yml — Builds image → Artifact Registry → deploys to Cloud Run on main push; sensitive vars injected via Google Secret Manager (secrets:), non-sensitive via env_vars:
• .idx/dev.nix — Firebase Studio workspace declaring all env-var stubs, required packages (python312, nodejs_20, corepack), and onStart commands for API + frontend
• scripts/setup_google_secrets.py — One-time helper to seed Google Secret Manager from a local .env.local; secret values are encoded to bytes before upload and never appear in any log output

Secrets coverage

Category	Variables
Secrets (Secret Manager → Cloud Run)	STRIPE_ENDPOINT_SECRET, GEMINI_API_KEY, GMAIL_*, GOOGLE_SERVICE_ACCOUNT_JSON, PENNYLANE_API_KEY, LINEAR_API_TOKEN, GOOGLE_SHEETS_*, PAU_TTS_*, and more
Plain env vars (GitHub vars.*)	LAFAYETTE_VERIFY_BASE_URL, JULES_MAIL_MAX_RESULTS, LINEAR_PAGE_SIZE, GOOGLE_SHEETS_RANGE, etc.
Vite build-time	VITE_OAUTH_PORTAL_URL, VITE_APP_ID, VITE_FRONTEND_FORGE_API_KEY, VITE_ANALYTICS_*

Required one-time setup

1. python scripts/setup_google_secrets.py --dry-run → then run without --dry-run to populate Secret Manager
2. Add GCP_PROJECT_ID as a GitHub Actions variable; add GCP_SA_KEY (service account JSON with Cloud Run + Secret Manager roles) as a secret
3. Create Artifact Registry repo named tryonyou in europe-west1

[LVT-ENG]

Yes

[LVT-ENG]

@cursoragent

[Copilot]

Pull request overview

Introduces a first-pass Google Cloud Run deployment pipeline for the Python API, plus a Firebase Studio (IDX) dev workspace definition and a helper script to seed Google Secret Manager from local env/.env files—centralizing environment variable/secret configuration for deployment and development.

Changes:

• Added a Dockerfile to containerize the Flask API for Cloud Run using Gunicorn.
• Added a GitHub Actions workflow to build/push to Artifact Registry and deploy to Cloud Run with env vars + Secret Manager bindings.
• Added Firebase Studio workspace config (.idx/dev.nix) and a secret-seeding helper script (scripts/setup_google_secrets.py).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 8 comments.

File	Description
scripts/setup_google_secrets.py	Adds a CLI utility to create/update Secret Manager secrets from env / .env.local.
Dockerfile	Defines the Cloud Run container image for the Python API (Gunicorn entrypoint).
.idx/dev.nix	Adds Firebase Studio workspace packages, env var stubs, and startup/preview commands.
.github/workflows/deploy-cloud-run.yml	Adds CI/CD workflow to deploy the API to Cloud Run and inject configuration via env/secrets.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[LVT-ENG]

Yes

[LVT-ENG]

Yee

[LVT-ENG]

Ejecuta