CI CD Pipeline

CI/CD Pipeline

GitHub Actions (.github/workflows/ci.yml) builds, tests, publishes the image, and deploys to Cloud Run — with keyless authentication (no service-account JSON key in GitHub).

flowchart LR
  A["Push to main"] --> B["Build and test (Gradle)"]
  B --> C["Build full-stack image"]
  C --> D["Push to GHCR and Artifact Registry"]
  D --> E["Deploy to Cloud Run (keyless WIF)"]

Loading

Jobs

• build — JDK 21 + Gradle; runs the full test suite (including the Testcontainers Redis test); uploads reports.
• image — builds the full-stack Docker image and pushes it to GHCR (on non-PR pushes).
• deploy (push to main only) — authenticates via Workload Identity Federation, builds and pushes the image to Artifact Registry, then runs gcloud run deploy.

Keyless auth (Workload Identity Federation)

terraform/cicd.tf provisions a Workload Identity pool + GitHub OIDC provider (locked to the repo by an attribute condition) and a deployer service account with run.admin, artifactregistry.writer, and serviceAccountUser on the runtime SA — no long-lived keys.

Enable it with:

terraform apply -var github_repository=owner/repo

then set the repo Actions variables:

Variable	Value
GCP_PROJECT_ID	your project id
GCP_REGION	e.g. europe-west2
GCP_WORKLOAD_IDENTITY_PROVIDER	terraform output -raw cicd_workload_identity_provider
GCP_DEPLOYER_SA	terraform output -raw cicd_deployer_service_account

Terraform ignores the Cloud Run image afterward, so CI owns the running image. See Deployment for the infrastructure side.