Invoke Cloud Run #21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Invoke Cloud Run | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| environment: | |
| description: "GitHub Environment to invoke" | |
| required: true | |
| default: "longbridge-sg" | |
| type: choice | |
| options: | |
| - longbridge-hk | |
| - longbridge-paper | |
| - longbridge-sg | |
| path: | |
| description: "HTTP path to call" | |
| required: false | |
| default: "/" | |
| type: string | |
| env: | |
| GCP_PROJECT_ID: longbridgequant | |
| GCP_WORKLOAD_IDENTITY_PROVIDER: projects/252919773759/locations/global/workloadIdentityPools/github-actions/providers/github-main | |
| GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT: longbridge-platform-deploy@longbridgequant.iam.gserviceaccount.com | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref_name }} | |
| cancel-in-progress: false | |
| jobs: | |
| invoke: | |
| name: Invoke ${{ inputs.environment }} Cloud Run | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| environment: ${{ inputs.environment }} | |
| env: | |
| CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }} | |
| CLOUD_RUN_SERVICE: ${{ vars.CLOUD_RUN_SERVICE }} | |
| steps: | |
| - name: Validate inputs | |
| run: | | |
| set -euo pipefail | |
| case "${{ inputs.environment }}" in | |
| longbridge-hk|longbridge-paper|longbridge-sg) ;; | |
| *) | |
| echo "Unsupported environment: ${{ inputs.environment }}" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| if [ -z "${CLOUD_RUN_REGION:-}" ] || [ -z "${CLOUD_RUN_SERVICE:-}" ]; then | |
| echo "CLOUD_RUN_REGION and CLOUD_RUN_SERVICE are required on ${{ inputs.environment }}." >&2 | |
| exit 1 | |
| fi | |
| - name: Authenticate to Google Cloud | |
| uses: google-github-actions/auth@v3 | |
| with: | |
| workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ env.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }} | |
| - name: Set up gcloud | |
| uses: google-github-actions/setup-gcloud@v3 | |
| with: | |
| project_id: ${{ env.GCP_PROJECT_ID }} | |
| version: ">= 416.0.0" | |
| - name: Resolve service URL | |
| id: service | |
| run: | | |
| set -euo pipefail | |
| raw_path="${{ inputs.path }}" | |
| if [ -z "${raw_path}" ]; then | |
| raw_path="/" | |
| fi | |
| if [[ "${raw_path}" != /* ]]; then | |
| raw_path="/${raw_path}" | |
| fi | |
| service_url="$( | |
| gcloud run services describe "${CLOUD_RUN_SERVICE}" \ | |
| --region "${CLOUD_RUN_REGION}" \ | |
| --format='value(status.url)' | |
| )" | |
| if [ -z "${service_url}" ]; then | |
| echo "Unable to resolve Cloud Run service URL." >&2 | |
| exit 1 | |
| fi | |
| echo "url=${service_url}" >> "$GITHUB_OUTPUT" | |
| echo "path=${raw_path}" >> "$GITHUB_OUTPUT" | |
| - name: Authenticate for service invocation | |
| id: invoke-auth | |
| uses: google-github-actions/auth@v3 | |
| with: | |
| workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ env.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }} | |
| token_format: id_token | |
| id_token_audience: ${{ steps.service.outputs.url }} | |
| id_token_include_email: true | |
| - name: Invoke service | |
| run: | | |
| set -euo pipefail | |
| curl --fail-with-body --show-error --silent \ | |
| --request POST \ | |
| --header "Authorization: Bearer ${{ steps.invoke-auth.outputs.id_token }}" \ | |
| "${{ steps.service.outputs.url }}${{ steps.service.outputs.path }}" |