cloudbuild.yaml

steps:
  - name: 'gcr.io/cloud-builders/docker'
    entrypoint: 'bash'
    env:
      - 'DOCKER_BUILDKIT=1'
    args:
      - '-c'
      - |
        docker pull ${_LOCATION}-docker.pkg.dev/$PROJECT_ID/${_AR_REPOSITORY}/${_SERVICE_NAME}:latest || true
        docker build -t ${_LOCATION}-docker.pkg.dev/$PROJECT_ID/${_AR_REPOSITORY}/${_SERVICE_NAME} \
          --cache-from ${_LOCATION}-docker.pkg.dev/$PROJECT_ID/${_AR_REPOSITORY}/${_SERVICE_NAME}:latest \
          --build-arg BUILDKIT_INLINE_CACHE=1 \
          --build-arg DATABASE_URL="$$DATABASE_URL" \
          --build-arg TASK_SECRET="$$TASK_SECRET" \
          .
    secretEnv: ['DATABASE_URL', 'TASK_SECRET']

  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', '${_LOCATION}-docker.pkg.dev/$PROJECT_ID/${_AR_REPOSITORY}/${_SERVICE_NAME}']

  - name: 'gcr.io/cloud-builders/gcloud'
    entrypoint: 'bash'
    args: 
      - -c
      - |
        gcloud run deploy ${_SERVICE_NAME} \
          --image ${_LOCATION}-docker.pkg.dev/$PROJECT_ID/${_AR_REPOSITORY}/${_SERVICE_NAME} \
          --platform managed \
          --region ${_REGION} \
          --allow-unauthenticated \
          --update-secrets "DATABASE_URL=${_SECRET_PREFIX}DATABASE_URL:latest,TASK_SECRET=${_SECRET_PREFIX}TASK_SECRET:latest,GITHUB_TOKEN=${_SECRET_PREFIX}GITHUB_TOKEN:latest"
availableSecrets:
  secretManager:
    - versionName: projects/1023578240084/secrets/${_SECRET_PREFIX}DATABASE_URL/versions/latest
      env: DATABASE_URL
    - versionName: projects/1023578240084/secrets/${_SECRET_PREFIX}TASK_SECRET/versions/latest
      env: TASK_SECRET
substitutions:
  _LOCATION: asia-northeast1
  _REGION: asia-northeast1
  _AR_REPOSITORY: cloud-run-source-deploy
  _SERVICE_NAME: misskey-instance-list
  _SECRET_PREFIX: "" # Default empty, overridden by trigger
options:
  logging: CLOUD_LOGGING_ONLY