GitLab CI/CD Pipeline for Backend API Deployment on Google Cloud Run

# =============================================================================
# GitLab CI/CD Pipeline for Backend API Deployment on Google Cloud Run
# =============================================================================
# This pipeline builds and deploys backend APIs to Google Cloud Run
# Supports multiple environments (staging/production) with customizable settings
# Optimized for Node.js, Python, Java, Go, and other backend frameworks
# Author: EkaivaKriti/Suraj Anand
# Last Updated: 06-07-2025
# =============================================================================

# Base Docker image with Google Cloud SDK pre-installed
# Alternative: Use 'alpine/gcloud' for smaller image size
image: google/cloud-sdk:latest

# =============================================================================
# GLOBAL VARIABLES
# =============================================================================
# These variables can be customized based on your project requirements
# Set these in GitLab CI/CD Variables (Settings > CI/CD > Variables)
variables:
  # Application Configuration
  APP_NAME: "my-app"                    # Change to your application name
  
  # Staging Environment Variables
  STAGING_SERVICE_NAME: "staging-${APP_NAME}-service"
  STAGING_IMAGE: "gcr.io/${STAGING_GOOGLE_PROJECT_ID}/staging-${APP_NAME}:${CI_COMMIT_SHORT_SHA}"
  STAGING_BRANCH: "develop"             # Branch that triggers staging deployment
  
  # Production Environment Variables
  PROD_SERVICE_NAME: "prod-${APP_NAME}-service"
  PROD_IMAGE: "gcr.io/${PROD_GOOGLE_PROJECT_ID}/prod-${APP_NAME}:${CI_COMMIT_SHORT_SHA}"
  PROD_BRANCH: "main"                   # Branch that triggers production deployment
  
  # Container Configuration (customize as needed)
  CONTAINER_PORT: "8080"                # Port your application listens on
  MEMORY_LIMIT: "2Gi"                   # Memory allocation (512Mi, 1Gi, 2Gi, 4Gi, 8Gi)
  TIMEOUT: "300s"                       # Request timeout (max: 3600s)
  MAX_INSTANCES: "100"                  # Maximum number of instances (optional)
  
  # Security Configuration
  ALLOW_UNAUTHENTICATED: "true"         # Set to "false" for private services

# =============================================================================
# PIPELINE STAGES
# =============================================================================
# Stages define the order of operations in your pipeline
# You can add more stages like: test, security-scan, etc.
stages:
  - build       # Build and push Docker images
  - deploy      # Deploy to Cloud Run

# =============================================================================
# REUSABLE SCRIPT TEMPLATES
# =============================================================================
# These templates can be extended by jobs to avoid code duplication

.gcp_auth_template: &gcp_auth
  # Install Docker (required for gcloud builds submit)
  - apt-get update && apt-get install -y docker.io
  # Authenticate with Google Cloud using service account key
  - echo "${GCP_SERVICE_KEY}" > "${CI_PROJECT_DIR}/key.json"
  - gcloud auth activate-service-account --key-file="${CI_PROJECT_DIR}/key.json"
  - gcloud config set project "${GOOGLE_PROJECT_ID}"

.env_setup_template: &env_setup
  # Copy environment variables from GitLab CI/CD variables to env.yaml
  # Note: Remove the debug line (cat -A) in production to avoid exposing secrets
  - cp "${ENV_FILE}" env.yaml
  - echo "Environment file created successfully"
  # - cat -A env.yaml  # DEBUG ONLY: Remove this line in production!

# =============================================================================
# BUILD JOBS
# =============================================================================

# Staging Build Job
# Triggers when code is pushed to the staging branch
build-staging:
  stage: build
  variables:
    GOOGLE_PROJECT_ID: ${STAGING_GOOGLE_PROJECT_ID}
    GCP_SERVICE_KEY: ${STAGING_GCP_SERVICE_KEY}
    ENV_FILE: ${STAGING_ENV_FILE}
  before_script:
    - *gcp_auth
    - *env_setup
  script:
    # Build and push Docker image to Google Container Registry
    - gcloud builds submit --tag "${STAGING_IMAGE}" .
    # Optional: Add additional build steps here (tests, security scans, etc.)
    - echo "Staging build completed successfully"
  only:
    - ${STAGING_BRANCH}
  artifacts:
    reports:
      junit: test-results.xml  # Optional: Include test results
  tags:
    - docker      # Use runners with Docker support

# Production Build Job
# Triggers when code is pushed to the production branch
build-production:
  stage: build
  variables:
    GOOGLE_PROJECT_ID: ${PROD_GOOGLE_PROJECT_ID}
    GCP_SERVICE_KEY: ${PROD_GCP_SERVICE_KEY}
    ENV_FILE: ${PROD_ENV_FILE}
  before_script:
    - *gcp_auth
    - *env_setup
  script:
    # Build and push Docker image to Google Container Registry
    - gcloud builds submit --tag "${PROD_IMAGE}" .
    # Optional: Add production-specific build steps
    - echo "Production build completed successfully"
  only:
    - ${PROD_BRANCH}
  when: manual      # Require manual approval for production builds
  tags:
    - docker

# =============================================================================
# DEPLOY JOBS
# =============================================================================

# Staging Deploy Job
# Automatically deploys after successful staging build
deploy-staging:
  stage: deploy
  variables:
    GOOGLE_PROJECT_ID: ${STAGING_GOOGLE_PROJECT_ID}
    GCP_SERVICE_KEY: ${STAGING_GCP_SERVICE_KEY}
    ENV_FILE: ${STAGING_ENV_FILE}
  before_script:
    - *gcp_auth
    - *env_setup
  script:
    # Deploy to Cloud Run with staging configuration
    - |
      gcloud run deploy "${STAGING_SERVICE_NAME}" \
        --image "${STAGING_IMAGE}" \
        --platform "managed" \
        --region "${STAGING_GOOGLE_REGION}" \
        --port "${CONTAINER_PORT}" \
        --memory "${MEMORY_LIMIT}" \
        --timeout "${TIMEOUT}" \
        --max-instances "${MAX_INSTANCES}" \
        --env-vars-file env.yaml \
        --allow-unauthenticated \
        --quiet
    # Optional: Add health check or smoke tests
    - echo "Staging deployment completed successfully"
  only:
    - ${STAGING_BRANCH}
  environment:
    name: staging
    url: https://${STAGING_SERVICE_NAME}-${STAGING_GOOGLE_REGION}.a.run.app

# Production Deploy Job
# Requires manual approval and deploys to production
deploy-production:
  stage: deploy
  variables:
    GOOGLE_PROJECT_ID: ${PROD_GOOGLE_PROJECT_ID}
    GCP_SERVICE_KEY: ${PROD_GCP_SERVICE_KEY}
    ENV_FILE: ${PROD_ENV_FILE}
  before_script:
    - *gcp_auth
    - *env_setup
  script:
    # Deploy to Cloud Run with production configuration
    - |
      gcloud run deploy "${PROD_SERVICE_NAME}" \
        --image "${PROD_IMAGE}" \
        --platform "managed" \
        --region "${PROD_GOOGLE_REGION}" \
        --port "${CONTAINER_PORT}" \
        --memory "${MEMORY_LIMIT}" \
        --timeout "${TIMEOUT}" \
        --max-instances "${MAX_INSTANCES}" \
        --env-vars-file env.yaml \
        --allow-unauthenticated \
        --quiet
    # Optional: Add database connections for production
    # --add-cloudsql-instances="${PROD_GOOGLE_PROJECT_ID}:${PROD_GOOGLE_REGION}:${DATABASE_INSTANCE}" \
    - echo "Production deployment completed successfully"
  only:
    - ${PROD_BRANCH}
  when: manual      # Require manual approval for production deployment
  environment:
    name: production
    url: https://${PROD_SERVICE_NAME}-${PROD_GOOGLE_REGION}.a.run.app

# =============================================================================
# OPTIONAL: ADDITIONAL JOBS
# =============================================================================

# Optional: Test Job (add before build stage)
test:
  stage: test
  script:
    - echo "Running tests..."
    # - npm test
    # - pytest
    # - go test
  only:
    - ${STAGING_BRANCH}
    - ${PROD_BRANCH}

# Optional: Security Scan Job
security-scan:
  stage: test
  script:
    - echo "Running security scans..."
    # - trivy image "${STAGING_IMAGE}"
    # - snyk test
  allow_failure: true  # Don't fail pipeline on security warnings