ci: automated deploy to GCP VM (WIF + IAP)

[timwangmusic]

Push-to-main auto-deploy for the planner backend (infra from PR #3). deploy.yml: WIF auth (no keys), build+push image to Artifact Registry, scp deploy files, run deploy.sh on planner-vm over IAP. workflow_dispatch tag input for rollback. Tag validated against docker-tag charset before any shell use (closes injection finding). go.yml gains workflow_call as the gate. Repo vars + deployer serviceAccountUser already set. 🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added automated production deployments triggered by changes to the main branch or manual requests.
  • Added deployment validation, testing, container publishing, and secure VM rollout steps.
  • Added serialized deployment handling to prevent concurrent production releases.

• Chores

  • Enabled the Go workflow to be reused by other automation workflows.

[coderabbitai]

Warning

Review limit reached

@timwangmusic, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 54 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4a501911-f046-4820-82e6-7f552c4e4bfc

📥 Commits

Reviewing files that changed from the base of the PR and between b4f7b26 and 9ce954c.

📒 Files selected for processing (1)

• .github/workflows/deploy.yml

📝 Walkthrough

Walkthrough

Adds a production deployment workflow for pushes to main and manual dispatch. The workflow runs reusable Go tests, validates an image tag, authenticates to GCP, optionally pushes an image, and deploys files to a VM over IAP.

Changes

Production deployment

Layer / File(s)	Summary
Workflow entry and test gating .github/workflows/deploy.yml, .github/workflows/go.yml	The deployment workflow defines triggers, permissions, and serialized concurrency. The Go workflow supports reusable invocation. Deployment waits for successful tests.
Image validation and preparation .github/workflows/deploy.yml	The workflow resolves and validates the image tag, authenticates to GCP with Workload Identity, and conditionally builds and pushes the image.
VM deployment over IAP .github/workflows/deploy.yml	The workflow creates a remote directory, copies production files to the VM, and runs the deployment script with the validated image tag.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHub as GitHub Actions
  participant GoWorkflow as Reusable Go workflow
  participant GCP as GCP
  participant Registry as Container registry
  participant VM as Production VM

  GitHub->>GoWorkflow: Run Go tests
  GoWorkflow-->>GitHub: Return test result
  GitHub->>GitHub: Resolve and validate image tag
  GitHub->>GCP: Authenticate with Workload Identity
  GitHub->>Registry: Build and push image when needed
  GitHub->>VM: Copy deployment files over IAP
  GitHub->>VM: Run deployment script with image tag

Loading

Possibly related PRs

• offerbee-ai/Vacation-Planner#3: Adds deployment scaffolding used by this workflow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the automated GCP VM deployment, including Workload Identity Federation and IAP.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/deploy-workflow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/deploy.yml:
- Around line 12-14: Keep only contents: read in the workflow-level permissions,
and move id-token: write into the permissions block for jobs.deploy. Ensure the
reusable test job no longer inherits OIDC token access while the deployment job
retains it.
- Line 28: Update the actions/checkout step to set persist-credentials to false,
ensuring the checkout token is removed from workspace Git configuration before
the image build.
- Around line 30-40: Update the “Resolve and validate image tag” step so the raw
inputs.tag value is passed through the step environment rather than interpolated
into the run script. In the shell, apply the github.sha fallback using that
environment variable, then validate the resulting tag and write it to
GITHUB_OUTPUT, preventing command substitution or other shell syntax from
executing before validation.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d41a2f57-5a76-4d00-a95b-04df9f7763a0

📥 Commits

Reviewing files that changed from the base of the PR and between e256ece and b4f7b26.

📒 Files selected for processing (2)

• .github/workflows/deploy.yml
• .github/workflows/go.yml