cloudbuild.yaml

steps:
  # pull image from container registry to build from cache, bypasses error if first time building image
  - id: "pull docker image"
    name: "gcr.io/cloud-builders/docker"
    entrypoint: "sh"
    args:
      - "-c"
      - |
        docker pull gcr.io/$PROJECT_ID/dash-cloudrun-demo:latest || true

  # build docker image in target project with git commit tag and latest
  # cache the previous build as a starting point for subsequent builds
  - id: "build docker image from cache"
    name: "gcr.io/cloud-builders/docker"
    args:
      [
        "build",
        "-t",
        "gcr.io/$PROJECT_ID/dash-cloudrun-demo:${SHORT_SHA}",
        "-t",
        "gcr.io/$PROJECT_ID/dash-cloudrun-demo:latest",
        "--cache-from",
        "gcr.io/$PROJECT_ID/dash-cloudrun-demo:latest",
        ".",
      ]

  # push docker image with git commit to container registry
  - id: "push docker image"
    name: "gcr.io/cloud-builders/docker"
    args: ["push", "gcr.io/$PROJECT_ID/dash-cloudrun-demo"]

  - id: "download encrypted secrets only during build"
    name: "gcr.io/cloud-builders/gsutil"
    args:
      [
        "cp",
        "gs://$PROJECT_ID-secure-bucket-secrets/ciphertext_file.enc",
        "ciphertext_file.enc",
      ]

  - id: "decrypt secrets only during build"
    name: "gcr.io/cloud-builders/gcloud"
    args:
      [
        "kms",
        "decrypt",
        "--ciphertext-file",
        "ciphertext_file.enc",
        "--plaintext-file",
        "service_account.json",
        "--location",
        "global",
        "--keyring",
        "$PROJECT_ID-keyring",
        "--key",
        "$PROJECT_ID-key",
      ]

  ###############################################
  # deploy terraform infrastructure
  - id: "branch name"
    name: "alpine"
    entrypoint: "sh"
    args:
      - "-c"
      - |
        echo "***********************"
        echo "$BRANCH_NAME"
        echo "***********************"

  - id: "tf init"
    name: "hashicorp/terraform:0.12.9"
    entrypoint: "sh"
    args:
      - "-c"
      - |
        cd tf_modules/
        terraform init

  # [START tf-plan]
  - id: "tf plan"
    name: "hashicorp/terraform:0.12.9"
    entrypoint: "sh"
    args:
      - "-c"
      - |
        cd tf_modules/
        terraform plan
  # [END tf-plan]

  # [START tf-apply]
  - id: "tf apply"
    name: "hashicorp/terraform:0.12.9"
    entrypoint: "sh"
    args:
      - "-c"
      - |
        cd tf_modules/
        terraform apply -auto-approve
  # [END tf-apply]

  # must set cloudbuild service account with Cloud Run Admin role
  - id: "allow cloud run unauthenticated"
    name: "gcr.io/cloud-builders/gcloud"
    args:
      [
        "beta",
        "run",
        "services",
        "add-iam-policy-binding",
        "tf-dash-cloud-run-demo",
        "--member",
        "allUsers",
        "--region",
        "us-central1",
        "--role",
        "roles/run.invoker",
        "--platform",
        "managed",
      ]

  - id: "upgrade container memory limit"
    name: "gcr.io/cloud-builders/gcloud"
    args:
      [
        "beta",
        "run",
        "services",
        "update",
        "tf-dash-cloud-run-demo",
        "--memory",
        "1Gi",
        "--region",
        "us-central1",
        "--platform",
        "managed",
      ]