DO NOT MERGE - Track to upstream #3
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| name: Build and Push to Google Artifact Registry | ||
|
|
||
| on: | ||
| push: | ||
| tags: | ||
| - "*.*.*" | ||
| branches: | ||
| - kencove | ||
|
|
||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Authenticate to Google Cloud | ||
| id: auth | ||
| uses: google-github-actions/auth@v2 | ||
| with: | ||
| workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} | ||
| service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} | ||
|
|
||
| - name: Set up Cloud SDK | ||
| uses: google-github-actions/setup-gcloud@v2 | ||
|
|
||
| - name: Determine image tag | ||
| id: tag | ||
| run: | | ||
| if [[ "${{ github.ref_type }}" == "tag" ]]; then | ||
| echo "img_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "img_tag=$(echo ${{ github.sha }} | cut -c1-8)" >> "$GITHUB_OUTPUT" | ||
| fi | ||
|
|
||
| - name: Trigger Cloud Build | ||
| run: | | ||
| gcloud builds submit \ | ||
| --config=cloudbuild.yaml \ | ||
| --project=kencove-prod \ | ||
| --substitutions=_IMG_TAG=${{ steps.tag.outputs.img_tag }} \ | ||
| --async | ||
|
Comment on lines
+42
to
+48
There was a problem hiding this comment.
Two distinct issues in this block:
🛠️ Proposed fix — block on result and quote the substitution - name: Trigger Cloud Build
+ timeout-minutes: 120
run: |
gcloud builds submit \
--config=cloudbuild.yaml \
--project=kencove-prod \
- --substitutions=_IMG_TAG=${{ steps.tag.outputs.img_tag }} \
- --async
+ --substitutions="_IMG_TAG=${{ steps.tag.outputs.img_tag }}"
-
- timeout-minutes: 5
+ timeout-minutes: 130If keeping async is a deliberate choice (e.g., to avoid long-running Actions minutes), at minimum add the quote and document that build status must be monitored in Cloud Build console. 🤖 Prompt for AI Agents |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overly broad tag glob may fire on non-semver tags.
The pattern
*.*.*matches any tag with two dots (e.g.,release.candidate.1,hotfix.pr.42). Restrict to semver if that is the intent:🛠️ Tighter semver pattern
Or use the semver filter from
docker/metadata-actionand drop this restriction entirely.📝 Committable suggestion
🤖 Prompt for AI Agents