feat: update gcp action

[benjamin-747]

No description provided.

[github-actions]

Claude finished @benjamin-747's task in 2m 29s —— View job

---

Code Review Complete ✓

Tasks

• Gather context and read modified workflow files
• Analyze changes against origin/main
• Review for security issues
• Review for code quality and best practices
• Review for performance considerations
• Check documentation and provide comprehensive feedback

---

Summary

This PR adds GCP Artifact Registry support alongside existing AWS ECR for three deployment workflows. The changes enable pushing Docker images to both AWS and GCP registries simultaneously.

🔍 Detailed Review

🔴 Critical Issues (Must Fix Before Merge)

1. Security: GCP Service Account Key Usage

   • Location: All workflow files using credentials_json: ${{ secrets.GCP_SA_KEY }}
   • Issue: Using long-lived service account keys is a security anti-pattern. If compromised, attackers have long-term access.
   • Fix: Switch to Workload Identity Federation which provides short-lived tokens (~1 hour) with no stored credentials.

2. Bug: Buck2hub Manifest Job Will Fail (web-deploy.yml:107-151)

   • Issue: The manifest job runs for all environments including buck2hub, but buck2hub images are only pushed to GCP (lines 88-92), not AWS. The manifest job only authenticates to AWS ECR, so it will fail to find buck2hub images.
   • Fix: Either exclude buck2hub from the manifest matrix, or add conditional GCP authentication for buck2hub in the manifest job.

3. Missing PR Description

   • Issue: No description explaining why GCP was added, which environments use which registry, or what testing was performed.
   • Fix: Add comprehensive PR description with architecture decisions and testing notes.

⚠️ Important Issues (Should Fix)

4. Missing Image Verification

   • After pushing to GCP, there's no verification that images are actually accessible. Add a docker pull verification step to catch registry permission issues early.

5. Hard-coded GCP Region

   • us-central1 is hard-coded throughout. Extract to an environment variable (GCP_REGION) for easier maintenance.

6. Project ID with Date Range (GCP_PROJECT_ID: infra-20250121-20260121-0235)

   • The ID appears to contain dates Jan 2025 - Jan 2026. Is this a temporary project? If so, document the migration plan.

7. Missing Build Cache for Rust (mono-engine-deploy.yml, orion-server-deploy.yml)

   • The web workflow uses GitHub Actions cache (great!), but Rust builds don't. Adding --cache-from type=gha would significantly speed up builds.

💡 Nice-to-Have Improvements

8. Missing Documentation for Conditional Logic (web-deploy.yml:88-92)

   • The buck2hub conditional lacks comments explaining why it only uses GCP while others use AWS.

9. Inconsistent Conditional Removal

   • The original manifest job had if: ${{ github.repository == 'web3infra-foundation/mega' }} which was removed, but it's still in the deploy job. Was this intentional?

10. No Rollback Strategy

    • If GCP push fails but ECR succeeds (or vice versa), deployments may be in an inconsistent state. Consider adding retry logic or documenting expected behavior.

---

📊 Overall Assessment

Category	Rating	Critical Issues
Security	🔴 Needs Immediate Action	Service account keys (use Workload Identity instead)
Functionality	🔴 Has Bugs	Buck2hub manifest job will fail
Code Quality	🟢 Good	Clean structure, good use of set -euo pipefail
Performance	🟢 Good	Efficient single-build approach, web has caching
Documentation	🔴 Poor	No PR description, minimal inline comments

---

✅ What's Good

1. Single Build, Multiple Registries - Building once and tagging for both registries is efficient and ensures consistency
2. Good Error Handling - Use of set -euo pipefail throughout scripts
3. Clean Code Structure - Clear separation of AWS and GCP authentication steps with comment headers
4. GitHub Actions Cache - Added to web-deploy.yml (lines 96-97) for faster builds
5. Simplified Matrix Strategy - Removed complex multi-platform matrix, focusing on amd64 is cleaner

---

🎯 Action Items Before Merge

Must Fix:

• Replace service account key auth with Workload Identity Federation
• Fix buck2hub manifest job (exclude from matrix OR add GCP auth)
• Add PR description explaining changes and architecture

Should Fix:

• Add image pull verification after GCP push
• Extract hard-coded region to environment variable
• Document project ID date range intent
• Add build caching to Rust workflows

Nice to Have:

• Add inline comments for conditional buck2hub logic
• Document rollback strategy for partial registry failures

---

📚 References

• Google's Workload Identity Federation Guide
• GitHub Actions Docker Build Cache
• GCP Artifact Registry Best Practices

---

Note: I was unable to add inline comments directly to specific lines because this PR appears to have an unusual branch configuration (main → main). The review above covers all critical findings with file paths and line numbers for reference.

[Copilot]

Pull request overview

This PR updates the GitHub Actions deployment workflows to add GCP Cloud Run deployment capability and remove the "openatom" environment. The changes split the existing deployment job into separate AWS and GCP deployment jobs, allowing the repository to deploy services to both cloud providers.

Changes:

• Removed "openatom" from deployment environment matrices in web-deploy.yml
• Renamed the "deploy" job to "deploy-aws" in all three deployment workflows for clarity
• Added new "deploy-gcp" jobs that authenticate to GCP and deploy to Cloud Run services using a force-redeploy strategy

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/web-deploy.yml	Removed "openatom" from matrix, renamed deploy job to deploy-aws, added deploy-gcp job for buck2hub-ui service
.github/workflows/orion-server-deploy.yml	Renamed deploy job to deploy-aws, added deploy-gcp job for buck2hub-orion service (repository check commented out)
.github/workflows/mono-engine-deploy.yml	Renamed deploy job to deploy-aws, added deploy-gcp job for buck2hub-mono service (repository check commented out)

[Copilot]

The repository check is commented out for the deploy-gcp job, which means this deployment will run on all forks of the repository, not just the canonical web3infra-foundation/mega repository. This could lead to unauthorized deployments or failed deployments on forks that don't have the necessary GCP_SA_KEY secret configured.

The deploy-aws job on line 125 has this check enabled, and the deploy-gcp job in web-deploy.yml (line 178) also has it enabled. For consistency and security, this check should be uncommented.

Suggested change

	# if: ${{ github.repository == 'web3infra-foundation/mega' }}
	if: ${{ github.repository == 'web3infra-foundation/mega' }}

[Copilot]

The repository check is commented out for the deploy-gcp job, which means this deployment will run on all forks of the repository, not just the canonical web3infra-foundation/mega repository. This could lead to unauthorized deployments or failed deployments on forks that don't have the necessary GCP_SA_KEY secret configured.

The deploy-aws job on line 135 has this check enabled, and the deploy-gcp job in web-deploy.yml (line 178) also has it enabled. For consistency and security, this check should be uncommented.

Suggested change

	# if: ${{ github.repository == 'web3infra-foundation/mega' }}
	if: ${{ github.repository == 'web3infra-foundation/mega' }}