deploy.yml

name: Deploy MCP to Cloud Run

# Auto-deploy the hosted Clockchain MCP server (mcp.clockchain.network) on push to
# main. Keyless auth via Workload Identity Federation (no SA key stored in GitHub).
# `gcloud run deploy --source` preserves the service's existing env/secrets/scaling.

on:
  push:
    branches: [main]
    paths:
      # Only packages baked into the deployed image trigger a redeploy.
      # Other workspaces (clock-sdk, web-demo, verify) + docs/examples do NOT.
      - "packages/mcp-server/**"
      - "packages/core/**"
      - "Dockerfile"
      - ".dockerignore"
      - "package.json"
      - "package-lock.json"
      - ".github/workflows/deploy.yml"
  workflow_dispatch: {}

permissions:
  contents: read
  id-token: write

concurrency:
  group: deploy-cloud-run
  cancel-in-progress: false

jobs:
  # Gate the deploy on a green build + tests, so a compiling-but-broken image
  # can never reach production.
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npm install --no-audit --no-fund
      - run: npm run build
      - run: npm test

  deploy:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - id: auth
        uses: google-github-actions/auth@v2
        with:
          project_id: clockchain-mcp
          workload_identity_provider: projects/886160542191/locations/global/workloadIdentityPools/github/providers/github-provider
          service_account: gh-deploy@clockchain-mcp.iam.gserviceaccount.com

      - uses: google-github-actions/setup-gcloud@v2

      - name: Deploy to Cloud Run
        run: |
          gcloud run deploy clockchain-mcp \
            --source . \
            --region us-central1 \
            --quiet

      - name: Smoke test the deployment
        run: |
          URL=$(gcloud run services describe clockchain-mcp --region us-central1 --format='value(status.url)')
          code=$(curl -s -o /dev/null -w '%{http_code}' "$URL/health")
          echo "health -> $code"
          test "$code" = "200"