Salvage: cloudbuild safety + tsx devDependency (May 10 local commits)

.dockerignore

@@ -0,0 +1,41 @@
+# Build artifacts and dependencies — installed cleanly inside the image.
+# Including local node_modules (especially macOS-built native binaries) would
+# overwrite the linux ones from the deps stage and break the runtime.
+node_modules
+.next
+.next-build-cache
+
+# Source control + editor + OS noise
+.git
+.gitignore
+.gitattributes
+.vscode
+.idea
+.DS_Store
+**/.DS_Store
+
+# Local databases and env (never bake credentials into the image)
+prisma/dev.db
+prisma/test.db
+*.db
+.env
+.env.local
+.env.*.local
+
+# Project meta — not needed at runtime
+README.md
+CHANGELOG.md
+LICENSE
+docs
+e2e
+scripts/local
+.github
+
+# Logs and TS incremental cache
+*.log
+tsconfig.tsbuildinfo
+
+# Cloud Build / deployment configs — they live outside the image
+cloudbuild.yaml
+.gcloudignore
+.dockerignore

.gcloudignore

@@ -0,0 +1,40 @@
+# Files NOT uploaded to Cloud Build's source bundle.
+# Without this file, gcloud auto-derives one from .gitignore — BUT explicit
+# is better, especially for safety-critical exclusions like .env.
+#
+# Reference: https://cloud.google.com/sdk/gcloud/reference/topic/gcloudignore
+
+# Build artifacts (rebuilt inside the container; don't ship local copies)
+node_modules
+.next
+.next-build-cache
+
+# Local databases (have prod credentials in URL; never upload)
+prisma/dev.db
+prisma/test.db
+*.db
+
+# Secrets — defense in depth even though they shouldn't exist in the repo
+.env
+.env.local
+.env.*.local
+*.pem
+*.key
+
+# Source control + editor + OS noise
+.git
+.gitignore
+.gitattributes
+.vscode
+.idea
+.DS_Store
+**/.DS_Store
+
+# Logs / caches
+*.log
+tsconfig.tsbuildinfo
+
+# Big stuff that doesn't belong in a build context
+docs
+e2e
+scripts/local

cloudbuild.yaml

@@ -1,43 +1,58 @@
-steps:
-  # Build the container image
-  - name: 'gcr.io/cloud-builders/docker'
-    args:
-      - 'build'
-      - '-t'
-      - 'us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:latest'
-      - '.'
+# Cloud Build pipeline for takoapi (Cloud Run, us-central1).
+#
+# Build → deploy. The deploy step uses --update-env-vars / --update-secrets
+# (NOT --set-env-vars), so any existing bindings on the Cloud Run service —
+# secrets, traffic splits, manual env tweaks — are preserved. Running this
+# pipeline against the live service never wipes production credentials.
+#
+# Manual trigger:
+#   gcloud builds submit --project=takoapi-491505 --config=cloudbuild.yaml .
+#
+# Build-only (rare): comment out the "deploy" step. Both image tags still
+# get pushed via the `images:` block at the bottom.
+#
+# Rollback: each build pushes us-central1-docker.pkg.dev/.../takoapi:$BUILD_ID,
+# which is immutable. To roll back, redeploy the desired BUILD_ID:
+#   gcloud run deploy takoapi --region=us-central1 \
+#     --image=us-central1-docker.pkg.dev/takoapi-491505/takoapi-repo/takoapi:<BUILD_ID>
 
-  # Push the container image to Artifact Registry
-  - name: 'gcr.io/cloud-builders/docker'
+steps:
+  - id: build
+    name: gcr.io/cloud-builders/docker
     args:
-      - 'push'
-      - 'us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:latest'
+      - build
+      - --tag=us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:$BUILD_ID
+      - --tag=us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:latest
+      - .
 
-  # Deploy container image to Cloud Run
-  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
+  - id: deploy
+    name: gcr.io/google.com/cloudsdktool/cloud-sdk
+    waitFor: [build]
     entrypoint: gcloud
     args:
-      - 'run'
-      - 'deploy'
-      - 'takoapi'
-      - '--image'
-      - 'us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:latest'
-      - '--region'
-      - 'us-central1'
-      - '--platform'
-      - 'managed'
-      - '--allow-unauthenticated'
-      - '--port'
-      - '8080'
-      - '--memory'
-      - '512Mi'
-      - '--add-cloudsql-instances'
-      - 'takoapi-491505:us-central1:takoapi-db'
-      - '--set-env-vars'
-      - 'NODE_ENV=production,AUTH_TRUST_HOST=true,DATABASE_URL=postgresql://USER:PASSWORD@localhost/takoapi?host=/cloudsql/PROJECT:REGION:INSTANCE,NEXTAUTH_URL=https://takoapi.com,NEXTAUTH_SECRET=your-secret-here,GOOGLE_CLIENT_ID=your-google-client-id,GOOGLE_CLIENT_SECRET=your-google-client-secret,APPLE_CLIENT_ID=your-apple-client-id,APPLE_CLIENT_SECRET=your-apple-client-secret'
+      - run
+      - deploy
+      - takoapi
+      - --region=us-central1
+      - --image=us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:$BUILD_ID
+      - --platform=managed
+      - --allow-unauthenticated
+      - --port=8080
+      - --cpu=1
+      - --memory=512Mi
+      - --max-instances=20
+      - --add-cloudsql-instances=$PROJECT_ID:us-central1:takoapi-db
+      # --update-* (not --set-*): only the listed keys are touched.
+      # Secrets are bound by reference; their values never appear in this file
+      # or in build logs. Manage values via:
+      #   gcloud secrets versions add <NAME> --data-file=-
+      - --update-env-vars=NODE_ENV=production,AUTH_TRUST_HOST=true,NEXTAUTH_URL=https://takoapi.com,GOOGLE_CLIENT_ID=429522911261-t3s9v8av3n4saed95u4vkij5oqlfjoti.apps.googleusercontent.com,APPLE_CLIENT_ID=com.takoapi.auth
+      - --update-secrets=DATABASE_URL=tako-database-url:latest,NEXTAUTH_SECRET=tako-nextauth-secret:latest,GOOGLE_CLIENT_SECRET=tako-google-client-secret:latest,APPLE_CLIENT_SECRET=tako-apple-client-secret:latest,RESEND_API_KEY=tako-resend-api-key:latest,CRON_SECRET=tako-cron-secret:latest
 
+# Both tags are pushed automatically once all steps succeed.
 images:
-  - 'us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:latest'
+  - us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:$BUILD_ID
+  - us-central1-docker.pkg.dev/$PROJECT_ID/takoapi-repo/takoapi:latest
 
 options:
   logging: CLOUD_LOGGING_ONLY