From 5aa0ef179b23bce462c9714803d7447e9a07d77b Mon Sep 17 00:00:00 2001
From: Amr Gaber <amrtgaber@gmail.com>
Date: Fri, 10 Apr 2026 23:54:43 -0500
Subject: [PATCH] Add Cloud Run deploy workflow

- Add deploy.yml: on push to main, runs CI then builds Docker image
  and deploys to Cloud Run via Workload Identity Federation
- Update ci.yml: add workflow_call trigger so deploy can reuse it,
  bump actions/checkout to v6 and astral-sh/setup-uv to v7
---
 .github/workflows/ci.yml     |  9 +++---
 .github/workflows/deploy.yml | 58 ++++++++++++++++++++++++++++++++++++
 2 files changed, 63 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/deploy.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index de9d4d3..2c32034 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,13 +5,14 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  workflow_call:
 
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v7
       - run: uv sync
       - run: uv run ruff check .
       - run: uv run ruff format --check .
@@ -19,7 +20,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v7
       - run: uv sync
       - run: uv run pytest
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..6fa03d3
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,58 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: deploy-production
+  cancel-in-progress: false
+
+env:
+  GCP_PROJECT: trove-prod-485922
+  GCP_REGION: us-east1
+  SERVICE_NAME: trove-api
+  IMAGE: us-east1-docker.pkg.dev/trove-prod-485922/trove-api/trove-api
+
+jobs:
+  ci:
+    uses: ./.github/workflows/ci.yml
+
+  deploy:
+    needs: ci
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: google-github-actions/auth@v3
+        with:
+          workload_identity_provider: projects/505795335067/locations/global/workloadIdentityPools/github-actions/providers/github-provider
+          service_account: github-actions-deploy@trove-prod-485922.iam.gserviceaccount.com
+
+      - uses: google-github-actions/setup-gcloud@v3
+
+      - run: gcloud auth configure-docker us-east1-docker.pkg.dev --quiet
+
+      - name: Build and push
+        run: |
+          docker build -t $IMAGE:$GITHUB_SHA -t $IMAGE:latest .
+          docker push $IMAGE:$GITHUB_SHA
+          docker push $IMAGE:latest
+        env:
+          IMAGE: ${{ env.IMAGE }}
+
+      - name: Deploy to Cloud Run
+        run: |
+          gcloud run services update $SERVICE_NAME \
+            --image $IMAGE:$GITHUB_SHA \
+            --region $GCP_REGION \
+            --project $GCP_PROJECT
+        env:
+          IMAGE: ${{ env.IMAGE }}
+          SERVICE_NAME: ${{ env.SERVICE_NAME }}
+          GCP_REGION: ${{ env.GCP_REGION }}
+          GCP_PROJECT: ${{ env.GCP_PROJECT }}