github.com/derat/nup@v0.0.0-20230418113745-15592ba7c620/build/README.md (about) 1 # build 2 3 This directory contains [Cloud Build configuration files] for deploying the App 4 Engine app and running tests using Google's [Cloud Build] service. 5 6 [Cloud Build configuration files]: https://cloud.google.com/build/docs/build-config-file-schema 7 [Cloud Build]: https://cloud.google.com/build 8 9 ## Deploying 10 11 [deploy_app.yaml](./deploy_app.yaml) and 12 [deploy_indexes.yaml](./deploy_indexes.yaml) deploy the App Engine app and 13 update Datastore indexes, respectively. 14 15 Through a painful process of trial and error, I've found that the following 16 steps seem to allow Cloud Build triggers in one GCP project (e.g. `my-build` 17 with a `123@cloudbuild.gserviceaccount.com` service account) to deploy the App 18 Engine app in a second GCP project (e.g. `my-app`): 19 20 On the `my-app@appspot.gserviceaccount.com` service account page, add 21 `123@cloudbuild.gserviceaccount.com` as a principal with the `Service Account 22 User` role. 23 24 On the `my-app` IAM page, grant the `123@cloudbuild.gserviceaccount.com` 25 principal the following roles: 26 27 * App Engine Admin 28 * Cloud Build Editor 29 * Cloud Datastore Index Admin 30 * Container Registry Service Account 31 32 On the `foo.appspot.com` and `staging.foo.appspot.com` Cloud Storage bucket 33 permission pages, grant `123@cloudbuild.gserviceaccount.com` the `Storage Object 34 Admin` role. 35 36 I couldn't get [service account impersonation] to work at all. 37 38 [service account impersonation]: https://cloud.google.com/iam/docs/impersonating-service-accounts 39 40 ## Testing 41 42 [test.yaml](./test.yaml) runs `go test ./...`. 43 44 [Dockerfile](./Dockerfile) is used to build a [Docker] container image with Go, 45 Chrome, the Google Cloud SDK, and related dependencies preinstalled for running 46 tests. When executed in this directory, the following command uses Cloud Build 47 to build a container and submit it to the [Container Registry]. 48 49 ``` 50 gcloud --project ${PROJECT_ID} builds submit \ 51 --tag gcr.io/${PROJECT_ID}/nup-test --timeout=20m 52 ``` 53 54 [Docker]: https://www.docker.com/ 55 [Container Registry]: https://cloud.google.com/container-registry