From 8832e44a18a1c264a9513ed316a86fd44312c95d Mon Sep 17 00:00:00 2001
From: Amr Gaber <amrtgaber@gmail.com>
Date: Tue, 16 Jun 2026 16:05:40 -0500
Subject: [PATCH] ci: build the API image on the runner instead of Cloud Build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cloud Build's log streaming requires project Viewer/Owner, which the scoped
github-deployer SA intentionally lacks, so gcloud builds submit returned
non-zero despite the build succeeding. Build with docker on the runner and push
to Artifact Registry (the deploy SA already has artifactregistry.writer) — no
Cloud Build, no log streaming.
---
 .github/workflows/deploy.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 7f2b599..9ab4c0a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -35,13 +35,13 @@ jobs:
 
       - uses: google-github-actions/setup-gcloud@v2
 
-      - name: Build & push image (Cloud Build)
+      - name: Build & push image
         run: |
           IMAGE="us-east1-docker.pkg.dev/treepolitics-prod/api/api:${GITHUB_SHA::7}"
           echo "IMAGE=$IMAGE" >> "$GITHUB_ENV"
-          # --suppress-logs: the scoped deploy SA can't stream Cloud Build logs
-          # (that needs project Viewer/Owner); gcloud still waits for the build.
-          gcloud builds submit --tag "$IMAGE" --project=treepolitics-prod --suppress-logs
+          gcloud auth configure-docker us-east1-docker.pkg.dev --quiet
+          docker build -t "$IMAGE" .
+          docker push "$IMAGE"
 
       - name: Deploy to Cloud Run
         run: |