ci: automated deploy to GCP VM (WIF + IAP)

.github/workflows/deploy.yml

@@ -0,0 +1,71 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing image tag to (re)deploy; empty = build current SHA"
+        required: false
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: deploy-production
+  cancel-in-progress: false
+
+jobs:
+  test:
+    uses: ./.github/workflows/go.yml
+
+  deploy:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Resolve and validate image tag
+        id: tag
+        run: |
+          tag="${{ inputs.tag != '' && inputs.tag || github.sha }}"
+          # tag flows into shell commands below and a docker reference; allow
+          # only the characters valid in a docker tag so it cannot inject.
+          if ! printf '%s' "$tag" | grep -Eq '^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$'; then
+            echo "refusing unsafe image tag: $tag" >&2
+            exit 1
+          fi
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+
+      - uses: google-github-actions/auth@v3
+        with:
+          workload_identity_provider: ${{ vars.GCP_WIF_PROVIDER }}
+          service_account: ${{ vars.GCP_DEPLOYER_SA }}
+
+      - uses: google-github-actions/setup-gcloud@v3
+
+      - name: Build and push image
+        if: inputs.tag == ''
+        env:
+          IMAGE: ${{ vars.GCP_IMAGE }}
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          gcloud auth configure-docker us-west1-docker.pkg.dev --quiet
+          docker build -t "${IMAGE}:${TAG}" .
+          docker push "${IMAGE}:${TAG}"
+
+      - name: Deploy to VM over IAP
+        env:
+          ZONE: ${{ vars.GCP_ZONE }}
+          VM: ${{ vars.GCP_VM }}
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          gcloud compute ssh "$VM" --zone "$ZONE" --tunnel-through-iap \
+            --command='mkdir -p /tmp/planner-deploy'
+          gcloud compute scp deploy/docker-compose.prod.yml deploy/Caddyfile \
+            deploy/env.production deploy/deploy.sh \
+            "$VM":/tmp/planner-deploy/ --zone "$ZONE" --tunnel-through-iap
+          gcloud compute ssh "$VM" --zone "$ZONE" --tunnel-through-iap \
+            --command="sudo bash -c 'cp /tmp/planner-deploy/* /opt/planner/ && bash /opt/planner/deploy.sh ${TAG}'"

.github/workflows/go.yml

@@ -2,48 +2,41 @@ name: Go
 
 on:
   push:
-    branches: [master]
+    branches: [main]
   pull_request:
-    branches: [master]
+    branches: [main]
+  workflow_call:
 
 jobs:
   golangci:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v3
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
         with:
-          go-version: ^1.23
-      - uses: actions/checkout@v3
+          go-version-file: go.mod
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@v9
         with:
           version: latest
+          only-new-issues: true
 
   build:
     name: Build
     runs-on: ubuntu-latest
     steps:
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v6
+
       - name: Set up Go 1.x
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v6
         with:
-          go-version: ^1.23
+          go-version-file: go.mod
         id: go
 
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-
-      - name: Get dependencies
-        run: |
-          go get -v -t -d ./...
-          if [ -f Gopkg.toml ]; then
-              curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
-              dep ensure
-          fi
-
       - name: Build
         run: go build -v .
-        working-directory: .
 
       - name: Test
         run: go test -v ./...

.gitignore

@@ -1,7 +1,13 @@
 .env
 .docker_build/
+
+# Apple Maps private keys. Apple allows exactly one download of a .p8 and
+# offers no way to retrieve it again, so a leak means revoking the key.
+*.p8
+
 vendor
 bin/
 .idea
 .DS_Store
 node_modules/
+Vacation-planner

Dockerfile

@@ -1,12 +1,17 @@
-FROM golang:1.21-alpine
-
-ENV GO111MODULE=on
-
-COPY . /app/
-WORKDIR /app/
-
-RUN go build -v .
+FROM golang:1.24-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -o /out/vacation-planner .
 
+FROM alpine:3.20
+RUN apk add --no-cache ca-certificates tzdata && \
+    addgroup -S app && adduser -S app -G app
+WORKDIR /app
+COPY --from=build /out/vacation-planner ./vacation-planner
+COPY config/ ./config/
+COPY assets/ ./assets/
+USER app
 EXPOSE 10000
-
-CMD ["./Vacation-planner"]
+CMD ["./vacation-planner"]