steps:
  # Build the container image
  - name: 'gcr.io/cloud-builders/docker'
    args: [
      'build',
      '-f', 'deploy/Dockerfile',
      '-t', 'gcr.io/$PROJECT_ID/automoderate:$BRANCH_NAME-$SHORT_SHA',
      '.'
    ]

  # Push the container image to Container Registry
  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', 'gcr.io/$PROJECT_ID/automoderate:$BRANCH_NAME-$SHORT_SHA']

  # Deploy container image to Cloud Run.
  #
  # This step intentionally does NOT manage environment variables or secrets.
  # Runtime config is owned by the Cloud Run service itself (console or
  # `gcloud run services update`) so that:
  #   1. Secret-backed env vars (SECRET_KEY, DATABASE_URL, OPENAI_API_KEY,
  #      ADMIN_PASSWORD, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET) set via
  #      `--set-secrets` survive every deploy. `--set-env-vars` here would
  #      convert them into plain env vars and lose the secret binding.
  #   2. Per-environment values (FLASK_CONFIG=development for the dev service,
  #      FLASK_CONFIG=production for the prod service) are configured once on
  #      the service and persist across image-only deploys.
  # If a brand-new service is being stood up, configure its env vars and
  # secrets manually via the console before the first cloudbuild run, or
  # extend this step with `--update-env-vars` / `--set-secrets`.
  - name: 'gcr.io/cloud-builders/gcloud'
    args:
    - 'run'
    - 'deploy'
    - 'automoderate-${_ENV}'
    - '--image'
    - 'gcr.io/$PROJECT_ID/automoderate:$BRANCH_NAME-$SHORT_SHA'
    - '--region'
    - '${_REGION}'
    - '--platform'
    - 'managed'
    - '--allow-unauthenticated'
    - '--port'
    - '6217'
    - '--memory'
    - '${_MEMORY}'
    - '--cpu'
    - '${_CPU}'
    - '--max-instances'
    - '${_MAX_INSTANCES}'
    - '--add-cloudsql-instances'
    - '${_CLOUD_SQL_INSTANCE}'

substitutions:
  _ENV: 'dev'
  _REGION: 'us-central1'
  _MEMORY: '1Gi'
  _CPU: '1'
  _MAX_INSTANCES: '10'
  # _CLOUD_SQL_INSTANCE must be set in the trigger configuration
  # (format: project:region:instance-name).

options:
  logging: CLOUD_LOGGING_ONLY