deploy.yaml

name: Deploy Production

on:
  push:
    tags:
      - '*' # Triggers on ANY tag push
  workflow_dispatch:
    inputs:
      tag:
        description: 'Git tag to deploy (e.g. v1.1.1)'
        required: true
        type: string

jobs:
  deploy_prod:
    runs-on: ubuntu-latest
    permissions:
      contents: 'read'
      id-token: 'write'

    steps:
      - uses: actions/checkout@v4
        with:
          # On manual dispatch, check out the tag supplied via the UI
          # instead of the branch selected in the dropdown.
          ref: ${{ inputs.tag || github.ref }}

      # SANITIZATION STEP
      - name: Sanitize Version
        id: vars
        run: |
          RAW_TAG='${{ inputs.tag || github.ref_name }}'
          # Strip a leading refs/tags/ prefix if the user pasted a full ref
          RAW_TAG="${RAW_TAG#refs/tags/}"
          # Lowercase -> Replace separators with hyphens -> Remove illegal chars
          CLEAN_VER=$(echo "$RAW_TAG" | tr '[:upper:]' '[:lower:]' | sed 's/[\._ ]/-/g' | sed 's/[^a-z0-9-]//g')
          echo "version=$CLEAN_VER" >> $GITHUB_OUTPUT

      - id: 'auth'
        uses: 'google-github-actions/auth@v2'
        with:
          credentials_json: '${{ secrets.GCP_SA_KEY }}'

      - name: 'Inject Secrets'
        run: |
          sudo apt-get install gettext-base
          envsubst < app.yaml > app.yaml.tmp && mv app.yaml.tmp app.yaml
        env:
          RECAPTCHA_SECRET_KEY: ${{ secrets.RECAPTCHA_SECRET_KEY }}
          ADMIN_EMAIL: ${{ secrets.ADMIN_EMAIL }}

      # DEPLOY STEP
      - id: 'deploy'
        uses: 'google-github-actions/deploy-appengine@v2'
        with:
          version: '${{ steps.vars.outputs.version }}'
          project_id: '${{ secrets.GCP_PROJECT_ID }}'
          promote: true
          stop_previous_version: true
          flags: '--verbosity=debug'