deploy-full-stack.yml

name: Deploy Full Stack

on:
  workflow_dispatch:
    inputs:
      force_frontend:
        description: "Deploy frontend even if the browser API base URL cannot be derived from Hosting origin secrets or Cloud Run output yet"
        default: "false"
        required: false
        type: string

concurrency:
  group: deploy-full-stack-main
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  deploy-tex:
    name: Deploy TeX service (Cloud Run)
    runs-on: ubuntu-latest
    outputs:
      tex_service_url: ${{ steps.tex.outputs.url }}
    env:
      GCP_REGION: asia-northeast3
      TEX_SERVICE_NAME: docsy-tex
      TEX_WORKER_SERVICE_NAME: docsy-tex-worker
      ARTIFACT_REPOSITORY: docsy
      TEX_COMPILE_TIMEOUT_MS: "15000"
      TEX_MAX_SOURCE_BYTES: "300000"
      TEX_MAX_REQUEST_BYTES: "300000"
      TEX_MAX_CONCURRENCY: "1"
      TEX_ALLOW_ALL_PACKAGES: "true"
      TEX_ALLOW_RAW_DOCUMENT: "true"
      TEX_ALLOW_RESTRICTED_COMMANDS: "false"
      TEX_ALLOWED_PACKAGES: "amsmath,amssymb,amsthm,array,booktabs,caption,enumitem,etoolbox,fancyhdr,float,fontspec,geometry,graphicx,hyperref,inputenc,latexsym,listings,longtable,makecell,mathtools,multirow,setspace,soul,tabularx,tcolorbox,titlesec,ulem,xcolor,xeCJK"
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Authenticate to GCP
        uses: google-github-actions/auth@v3
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@v3

      - name: Show active GCP deploy principal
        run: |
          set -euo pipefail
          ACTIVE_ACCOUNT="$(gcloud auth list --filter=status:ACTIVE --format='value(account)' | head -n 1)"
          echo "Active gcloud account: ${ACTIVE_ACCOUNT}"

      - name: Ensure TeX runtime resources
        id: tex-resources
        env:
          PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
          TEX_PREVIEW_BUCKET: ${{ secrets.GCP_TEX_PREVIEW_BUCKET }}
          TEX_TASK_QUEUE: ${{ secrets.GCP_TEX_TASK_QUEUE }}
          TEX_TASK_LOCATION: ${{ secrets.GCP_TEX_TASK_LOCATION }}
        run: bash scripts/gcp/ensure-tex-runtime-resources.sh

      - name: Deploy TeX service via Cloud Build
        id: tex
        run: |
          set -euo pipefail

          require_secret() {
            local name="$1"
            local value="$2"
            if [ -z "${value}" ]; then
              echo "${name} is required."
              exit 1
            fi
          }

          ensure_secret_access() {
            local secret_name="$1"
            local output
            if ! output="$(gcloud secrets versions access latest --secret="${secret_name}" --project "${PROJECT_ID}" 2>&1 >/dev/null)"; then
              echo "Unable to access required Secret Manager secret ${secret_name}."
              if printf '%s' "${output}" | grep -qi 'NOT_FOUND'; then
                echo "Secret ${secret_name} was not found in project ${PROJECT_ID}."
              elif printf '%s' "${output}" | grep -qi 'PERMISSION_DENIED'; then
                ACTIVE_ACCOUNT="$(gcloud auth list --filter=status:ACTIVE --format='value(account)' | head -n 1)"
                echo "Grant roles/secretmanager.secretAccessor on ${secret_name} to ${ACTIVE_ACCOUNT}."
              fi
              echo "${output}"
              exit 1
            fi
          }

          require_secret "GCP_PROJECT_ID" "${{ secrets.GCP_PROJECT_ID }}"

          PROJECT_ID="${{ secrets.GCP_PROJECT_ID }}"
          PROJECT_NUMBER="$(gcloud projects describe "${PROJECT_ID}" --format='value(projectNumber)')"
          RUN_SERVICE_ACCOUNT="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"
          TEX_SERVICE_AUTH_TOKEN_SECRET="${{ secrets.GCP_TEX_SERVICE_AUTH_TOKEN_SECRET_NAME }}"
          if [ -z "${TEX_SERVICE_AUTH_TOKEN_SECRET}" ]; then
            TEX_SERVICE_AUTH_TOKEN_SECRET="tex-service-auth-token"
          fi

          TEX_MAX_REQUEST_BYTES="${{ secrets.GCP_TEX_MAX_REQUEST_BYTES }}"
          if [ -z "${TEX_MAX_REQUEST_BYTES}" ]; then
            TEX_MAX_REQUEST_BYTES="300000"
          fi

          TEX_ALLOW_ALL_PACKAGES="${{ secrets.GCP_TEX_ALLOW_ALL_PACKAGES }}"
          if [ -z "${TEX_ALLOW_ALL_PACKAGES}" ]; then
            TEX_ALLOW_ALL_PACKAGES="true"
          fi

          TEX_ALLOW_RAW_DOCUMENT="${{ secrets.GCP_TEX_ALLOW_RAW_DOCUMENT }}"
          if [ -z "${TEX_ALLOW_RAW_DOCUMENT}" ]; then
            TEX_ALLOW_RAW_DOCUMENT="true"
          fi

          TEX_ALLOW_RESTRICTED_COMMANDS="${{ secrets.GCP_TEX_ALLOW_RESTRICTED_COMMANDS }}"
          if [ -z "${TEX_ALLOW_RESTRICTED_COMMANDS}" ]; then
            TEX_ALLOW_RESTRICTED_COMMANDS="false"
          fi

          TEX_ALLOWED_PACKAGES="${{ secrets.GCP_TEX_ALLOWED_PACKAGES }}"
          if [ -z "${TEX_ALLOWED_PACKAGES}" ]; then
            TEX_ALLOWED_PACKAGES="amsmath,amssymb,amsthm,array,booktabs,caption,enumitem,etoolbox,fancyhdr,float,fontspec,geometry,graphicx,hyperref,inputenc,latexsym,listings,longtable,makecell,mathtools,multirow,setspace,soul,tabularx,tcolorbox,titlesec,ulem,xcolor,xeCJK"
          fi

          export TEX_MAX_REQUEST_BYTES
          export TEX_ALLOW_ALL_PACKAGES
          export TEX_ALLOW_RAW_DOCUMENT
          export TEX_ALLOW_RESTRICTED_COMMANDS
          export TEX_ALLOWED_PACKAGES

          node scripts/validate-public-deploy-config.mjs

          ensure_secret_access "${TEX_SERVICE_AUTH_TOKEN_SECRET}"

          echo "Deployment summary:"
          echo "  project: ${PROJECT_ID}"
          echo "  region: ${GCP_REGION}"
          echo "  service: ${TEX_SERVICE_NAME}"
          echo "  worker_service: ${TEX_WORKER_SERVICE_NAME}"
          echo "  preview_bucket: ${{ steps.tex-resources.outputs.preview_bucket }}"
          echo "  task_queue: ${{ steps.tex-resources.outputs.task_queue }}"
          echo "  task_location: ${{ steps.tex-resources.outputs.task_location }}"
          echo "  tex_allow_all_packages: ${TEX_ALLOW_ALL_PACKAGES}"
          echo "  tex_allow_raw_document: ${TEX_ALLOW_RAW_DOCUMENT}"
          echo "  tex_allow_restricted_commands: ${TEX_ALLOW_RESTRICTED_COMMANDS}"
          echo "  tex_allowed_packages: ${TEX_ALLOWED_PACKAGES}"
          echo "  app_token_secret: ${TEX_SERVICE_AUTH_TOKEN_SECRET}"

          IMAGE_URI="${GCP_REGION}-docker.pkg.dev/${PROJECT_ID}/${ARTIFACT_REPOSITORY}/${TEX_SERVICE_NAME}:latest"
          SUBSTITUTIONS=$(printf '^|^_IMAGE_URI=%s|_REGION=%s|_SERVICE_NAME=%s|_WORKER_SERVICE_NAME=%s|_TEX_COMPILE_TIMEOUT_MS=%s|_TEX_MAX_SOURCE_BYTES=%s|_TEX_MAX_REQUEST_BYTES=%s|_TEX_MAX_CONCURRENCY=%s|_TEX_ALLOW_ALL_PACKAGES=%s|_TEX_ALLOW_RAW_DOCUMENT=%s|_TEX_ALLOW_RESTRICTED_COMMANDS=%s|_TEX_ALLOWED_PACKAGES=%s|_TEX_PREVIEW_BUCKET=%s|_TEX_PREVIEW_URL_TTL_SECONDS=%s|_TEX_TASK_QUEUE=%s|_TEX_TASK_LOCATION=%s|_TEX_SERVICE_AUTH_TOKEN_SECRET=%s|_RUN_SERVICE_ACCOUNT=%s' \
            "$IMAGE_URI" \
            "$GCP_REGION" \
            "$TEX_SERVICE_NAME" \
            "$TEX_WORKER_SERVICE_NAME" \
            "$TEX_COMPILE_TIMEOUT_MS" \
            "$TEX_MAX_SOURCE_BYTES" \
            "${TEX_MAX_REQUEST_BYTES}" \
            "$TEX_MAX_CONCURRENCY" \
            "${TEX_ALLOW_ALL_PACKAGES}" \
            "${TEX_ALLOW_RAW_DOCUMENT}" \
            "${TEX_ALLOW_RESTRICTED_COMMANDS}" \
            "${TEX_ALLOWED_PACKAGES}" \
            "${{ steps.tex-resources.outputs.preview_bucket }}" \
            "900" \
            "${{ steps.tex-resources.outputs.task_queue }}" \
            "${{ steps.tex-resources.outputs.task_location }}" \
            "$TEX_SERVICE_AUTH_TOKEN_SECRET" \
            "$RUN_SERVICE_ACCOUNT")

          gcloud builds submit \
            --config cloudbuild.tex.yaml \
            --substitutions="${SUBSTITUTIONS}" \
            .

          if ! gcloud run services add-iam-policy-binding "${TEX_SERVICE_NAME}" \
            --region "${GCP_REGION}" \
            --member "serviceAccount:${RUN_SERVICE_ACCOUNT}" \
            --role "roles/run.invoker" >/dev/null; then
            ACTIVE_ACCOUNT="$(gcloud auth list --filter=status:ACTIVE --format='value(account)' | head -n 1)"
            echo "Unable to grant roles/run.invoker on ${TEX_SERVICE_NAME} to ${RUN_SERVICE_ACCOUNT}."
            echo "Grant that role with a project admin, or allow ${ACTIVE_ACCOUNT} to update Cloud Run IAM."
            exit 1
          fi

          TEX_URL="$(gcloud run services describe ${TEX_SERVICE_NAME} --region ${GCP_REGION} --format='value(status.url)')"

          if [ -z "${TEX_URL}" ]; then
            echo "Cloud Run TeX service URL could not be resolved."
            exit 1
          fi

          echo "TeX service deployed at: ${TEX_URL}"
          WORKER_URL="$(gcloud run services describe ${TEX_WORKER_SERVICE_NAME} --region ${GCP_REGION} --format='value(status.url)')"
          if [ -z "${WORKER_URL}" ]; then
            echo "Cloud Run TeX worker URL could not be resolved."
            exit 1
          fi
          echo "TeX worker deployed at: ${WORKER_URL}"
          echo "url=${TEX_URL}" >> "${GITHUB_OUTPUT}"
          echo "worker_url=${WORKER_URL}" >> "${GITHUB_OUTPUT}"

      - name: Verify TeX health
        run: |
          set -euo pipefail
          TOKEN_SECRET_NAME="${{ secrets.GCP_TEX_SERVICE_AUTH_TOKEN_SECRET_NAME }}"
          if [ -z "${TOKEN_SECRET_NAME}" ]; then
            TOKEN_SECRET_NAME="tex-service-auth-token"
          fi
          ID_TOKEN="$(gcloud auth print-identity-token)"
          APP_TOKEN="$(gcloud secrets versions access latest --secret="${TOKEN_SECRET_NAME}")"
          echo "Verifying health at: ${{ steps.tex.outputs.url }}/health"
          for i in {1..10}; do
            if curl -fsS \
              -H "Authorization: Bearer ${ID_TOKEN}" \
              -H "X-Docsy-Tex-Token: ${APP_TOKEN}" \
              "${{ steps.tex.outputs.url }}/health" >/dev/null; then
              echo "TeX health check passed!"
              exit 0
            fi
            echo "TeX health check failed (attempt $i), retrying in 5 seconds..."
            sleep 5
          done

          echo "TeX health check failed after 10 attempts."
          exit 1

      - name: Verify TeX worker health
        run: |
          set -euo pipefail
          TOKEN_SECRET_NAME="${{ secrets.GCP_TEX_SERVICE_AUTH_TOKEN_SECRET_NAME }}"
          if [ -z "${TOKEN_SECRET_NAME}" ]; then
            TOKEN_SECRET_NAME="tex-service-auth-token"
          fi
          APP_TOKEN="$(gcloud secrets versions access latest --secret="${TOKEN_SECRET_NAME}")"
          echo "Verifying health at: ${{ steps.tex.outputs.worker_url }}/health"
          for i in {1..10}; do
            if curl -fsS \
              -H "X-Docsy-Tex-Token: ${APP_TOKEN}" \
              "${{ steps.tex.outputs.worker_url }}/health" >/dev/null; then
              echo "TeX worker health check passed!"
              exit 0
            fi
            echo "TeX worker health check failed (attempt $i), retrying in 5 seconds..."
            sleep 5
          done

          echo "TeX worker health check failed after 10 attempts."
          exit 1

  deploy-ai:
    name: Deploy AI service (Cloud Run)
    runs-on: ubuntu-latest
    needs: deploy-tex
    outputs:
      ai_service_url: ${{ steps.ai.outputs.url }}
    env:
      GCP_REGION: asia-northeast3
      VERTEX_LOCATION: asia-northeast3
      AI_SERVICE_NAME: docsy
      ARTIFACT_REPOSITORY: docsy
      GEMINI_MODEL: gemini-2.5-flash
      GEMINI_FALLBACK_MODEL: gemini-2.5-flash-lite
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Authenticate to GCP
        uses: google-github-actions/auth@v3
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@v3

      - name: Show active GCP deploy principal
        run: |
          set -euo pipefail
          ACTIVE_ACCOUNT="$(gcloud auth list --filter=status:ACTIVE --format='value(account)' | head -n 1)"
          echo "Active gcloud account: ${ACTIVE_ACCOUNT}"

      - name: Ensure AI runtime resources
        id: ai-resources
        env:
          PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
        run: bash scripts/gcp/ensure-ai-runtime-resources.sh

      - name: Deploy AI service via Cloud Build
        id: ai
        run: |
          set -euo pipefail

          DEFAULT_FRONTEND_ORIGIN="https://docsy.cyou"
          DEFAULT_GOOGLE_OAUTH_REDIRECT_URI="${DEFAULT_FRONTEND_ORIGIN}/api/auth/google/callback"
          EXPECTED_PUBLIC_FRONTEND_ORIGIN="${DEFAULT_FRONTEND_ORIGIN}"

          require_secret() {
            local name="$1"
            local value="$2"
            if [ -z "${value}" ]; then
              echo "${name} is required."
              exit 1
            fi
          }

          ensure_secret_access() {
            local secret_name="$1"
            local output
            if ! output="$(gcloud secrets versions access latest --secret="${secret_name}" --project "${PROJECT_ID}" 2>&1 >/dev/null)"; then
              echo "Unable to access required Secret Manager secret ${secret_name}."
              if printf '%s' "${output}" | grep -qi 'NOT_FOUND'; then
                echo "Secret ${secret_name} was not found in project ${PROJECT_ID}."
              elif printf '%s' "${output}" | grep -qi 'PERMISSION_DENIED'; then
                ACTIVE_ACCOUNT="$(gcloud auth list --filter=status:ACTIVE --format='value(account)' | head -n 1)"
                echo "Grant roles/secretmanager.secretAccessor on ${secret_name} to ${ACTIVE_ACCOUNT}."
              fi
              echo "${output}"
              exit 1
            fi
          }

          get_optional_secret_status() {
            local secret_name="$1"
            local output
            if output="$(gcloud secrets versions access latest --secret="${secret_name}" --project "${PROJECT_ID}" 2>&1 >/dev/null)"; then
              echo "present"
              return 0
            fi

            if printf '%s' "${output}" | grep -qi 'NOT_FOUND'; then
              echo "missing"
              return 0
            fi

            echo "Unable to access optional Secret Manager secret ${secret_name}."
            echo "${output}"
            exit 1
          }

          require_secret "GCP_PROJECT_ID" "${{ secrets.GCP_PROJECT_ID }}"
          require_secret "GCP_GOOGLE_CLIENT_ID" "${{ secrets.GCP_GOOGLE_CLIENT_ID }}"

          PROJECT_ID="${{ secrets.GCP_PROJECT_ID }}"
          PROJECT_NUMBER="$(gcloud projects describe "${PROJECT_ID}" --format='value(projectNumber)')"
          RUN_SERVICE_ACCOUNT="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"
          export DOCSY_AI_SERVICE_NAME="${AI_SERVICE_NAME}"
          export DOCSY_PUBLIC_FRONTEND_ORIGIN="${EXPECTED_PUBLIC_FRONTEND_ORIGIN}"
          export DOCSY_REGION="${GCP_REGION}"
          export DOCSY_VERTEX_LOCATION="${VERTEX_LOCATION}"
          export GCP_AI_ALLOWED_ORIGIN="${{ secrets.GCP_AI_ALLOWED_ORIGIN }}"
          export GCP_GOOGLE_OAUTH_PUBLISHING_STATUS="${{ secrets.GCP_GOOGLE_OAUTH_PUBLISHING_STATUS }}"
          export GCP_GOOGLE_OAUTH_REDIRECT_URI="${{ secrets.GCP_GOOGLE_OAUTH_REDIRECT_URI }}"
          export GCP_GOOGLE_WORKSPACE_SCOPES="${{ secrets.GCP_GOOGLE_WORKSPACE_SCOPES }}"
          export GCP_GOOGLE_WORKSPACE_SCOPE_PROFILE="${{ secrets.GCP_GOOGLE_WORKSPACE_SCOPE_PROFILE }}"
          export GCP_WORKSPACE_FRONTEND_ORIGIN="${{ secrets.GCP_WORKSPACE_FRONTEND_ORIGIN }}"
          export GCP_AI_MAX_REQUEST_BYTES="${{ secrets.GCP_AI_MAX_REQUEST_BYTES }}"
          eval "$(node scripts/resolve-public-deploy-env.mjs --target ai)"

          TEX_ALLOW_ALL_PACKAGES="${{ secrets.GCP_TEX_ALLOW_ALL_PACKAGES }}"
          if [ -z "${TEX_ALLOW_ALL_PACKAGES}" ]; then
            TEX_ALLOW_ALL_PACKAGES="true"
          fi

          TEX_ALLOW_RAW_DOCUMENT="${{ secrets.GCP_TEX_ALLOW_RAW_DOCUMENT }}"
          if [ -z "${TEX_ALLOW_RAW_DOCUMENT}" ]; then
            TEX_ALLOW_RAW_DOCUMENT="true"
          fi

          TEX_ALLOW_RESTRICTED_COMMANDS="${{ secrets.GCP_TEX_ALLOW_RESTRICTED_COMMANDS }}"
          if [ -z "${TEX_ALLOW_RESTRICTED_COMMANDS}" ]; then
            TEX_ALLOW_RESTRICTED_COMMANDS="false"
          fi

          TEX_ALLOWED_PACKAGES="${{ secrets.GCP_TEX_ALLOWED_PACKAGES }}"
          if [ -z "${TEX_ALLOWED_PACKAGES}" ]; then
            TEX_ALLOWED_PACKAGES="amsmath,amssymb,amsthm,array,booktabs,caption,enumitem,etoolbox,fancyhdr,float,fontspec,geometry,graphicx,hyperref,inputenc,latexsym,listings,longtable,makecell,mathtools,multirow,setspace,soul,tabularx,tcolorbox,titlesec,ulem,xcolor,xeCJK"
          fi

          GOOGLE_CLIENT_SECRET_SECRET="${{ secrets.GCP_GOOGLE_CLIENT_SECRET_SECRET_NAME }}"
          if [ -z "${GOOGLE_CLIENT_SECRET_SECRET}" ]; then
            GOOGLE_CLIENT_SECRET_SECRET="google-client-secret"
          fi

          AI_DIAGNOSTICS_TOKEN_SECRET="${{ secrets.GCP_AI_DIAGNOSTICS_TOKEN_SECRET_NAME }}"
          if [ -z "${AI_DIAGNOSTICS_TOKEN_SECRET}" ]; then
            AI_DIAGNOSTICS_TOKEN_SECRET="ai-diagnostics-token"
          fi

          TEX_SERVICE_AUTH_TOKEN_SECRET="${{ secrets.GCP_TEX_SERVICE_AUTH_TOKEN_SECRET_NAME }}"
          if [ -z "${TEX_SERVICE_AUTH_TOKEN_SECRET}" ]; then
            TEX_SERVICE_AUTH_TOKEN_SECRET="tex-service-auth-token"
          fi

          ensure_secret_access "${GOOGLE_CLIENT_SECRET_SECRET}"
          ensure_secret_access "${TEX_SERVICE_AUTH_TOKEN_SECRET}"

          DIAGNOSTICS_SECRET_STATUS="$(get_optional_secret_status "${AI_DIAGNOSTICS_TOKEN_SECRET}")"

          TEX_SERVICE_BASE_URL="${{ needs.deploy-tex.outputs.tex_service_url }}"
          if [ -z "${TEX_SERVICE_BASE_URL}" ]; then
            echo "TeX service URL could not be resolved."
            exit 1
          fi

          echo "Deployment summary:"
          echo "  project: ${PROJECT_ID}"
          echo "  region: ${GCP_REGION}"
          echo "  ai_url_source: TeX output ${TEX_SERVICE_BASE_URL}"
          echo "  expected_public_frontend_origin: ${EXPECTED_PUBLIC_FRONTEND_ORIGIN}"
          echo "  frontend_origin: ${WORKSPACE_FRONTEND_ORIGIN}"
          echo "  oauth_redirect_uri: ${GOOGLE_OAUTH_REDIRECT_URI}"
          echo "  workspace_repository_backend: ${WORKSPACE_REPOSITORY_BACKEND}"
          echo "  tex_allow_all_packages: ${TEX_ALLOW_ALL_PACKAGES}"
          echo "  tex_allow_raw_document: ${TEX_ALLOW_RAW_DOCUMENT}"
          echo "  tex_allow_restricted_commands: ${TEX_ALLOW_RESTRICTED_COMMANDS}"
          echo "  diagnostics_secret_name: ${AI_DIAGNOSTICS_TOKEN_SECRET}"
          echo "  diagnostics_secret_status: ${DIAGNOSTICS_SECRET_STATUS}"

          export AI_ALLOWED_ORIGIN="${ALLOWED_ORIGIN}"
          export GOOGLE_CLIENT_ID="${{ secrets.GCP_GOOGLE_CLIENT_ID }}"
          export GOOGLE_OAUTH_PUBLISHING_STATUS
          export GOOGLE_OAUTH_REDIRECT_URI
          export GOOGLE_WORKSPACE_SCOPES
          export GOOGLE_WORKSPACE_SCOPE_PROFILE
          export PUBLIC_DEPLOY_EXPECTED_FRONTEND_ORIGIN="${EXPECTED_PUBLIC_FRONTEND_ORIGIN}"
          export WORKSPACE_FRONTEND_ORIGIN
          export WORKSPACE_REPOSITORY_BACKEND
          export AI_MAX_REQUEST_BYTES
          export TEX_ALLOW_ALL_PACKAGES
          export TEX_ALLOW_RAW_DOCUMENT
          export TEX_ALLOW_RESTRICTED_COMMANDS
          export TEX_ALLOWED_PACKAGES

          node scripts/validate-public-deploy-config.mjs

          IMAGE_URI="${GCP_REGION}-docker.pkg.dev/${PROJECT_ID}/${ARTIFACT_REPOSITORY}/${AI_SERVICE_NAME}:latest"
          SUBSTITUTIONS=$(printf '^|^_IMAGE_URI=%s|_REGION=%s|_VERTEX_LOCATION=%s|_SERVICE_NAME=%s|_GEMINI_MODEL=%s|_GEMINI_FALLBACK_MODEL=%s|_AI_ALLOWED_ORIGIN=%s|_AI_MAX_REQUEST_BYTES=%s|_GOOGLE_CLIENT_ID=%s|_GOOGLE_OAUTH_REDIRECT_URI=%s|_GOOGLE_OAUTH_PUBLISHING_STATUS=%s|_GOOGLE_WORKSPACE_SCOPE_PROFILE=%s|_WORKSPACE_FRONTEND_ORIGIN=%s|_PUBLIC_DEPLOY_EXPECTED_FRONTEND_ORIGIN=%s|_WORKSPACE_REPOSITORY_BACKEND=%s|_GOOGLE_WORKSPACE_SCOPES=%s|_AI_DIAGNOSTICS_TOKEN_SECRET=%s|_GOOGLE_CLIENT_SECRET_SECRET=%s|_TEX_SERVICE_AUTH_TOKEN_SECRET=%s|_TEX_ALLOW_ALL_PACKAGES=%s|_TEX_ALLOW_RAW_DOCUMENT=%s|_TEX_ALLOW_RESTRICTED_COMMANDS=%s|_TEX_ALLOWED_PACKAGES=%s|_TEX_SERVICE_BASE_URL=%s|_RUN_SERVICE_ACCOUNT=%s' \
            "$IMAGE_URI" \
            "$GCP_REGION" \
            "$VERTEX_LOCATION" \
            "$AI_SERVICE_NAME" \
            "$GEMINI_MODEL" \
            "$GEMINI_FALLBACK_MODEL" \
            "$ALLOWED_ORIGIN" \
            "${AI_MAX_REQUEST_BYTES}" \
            "${{ secrets.GCP_GOOGLE_CLIENT_ID }}" \
            "${GOOGLE_OAUTH_REDIRECT_URI}" \
            "${GOOGLE_OAUTH_PUBLISHING_STATUS}" \
            "${GOOGLE_WORKSPACE_SCOPE_PROFILE}" \
            "${WORKSPACE_FRONTEND_ORIGIN}" \
            "${EXPECTED_PUBLIC_FRONTEND_ORIGIN}" \
            "${WORKSPACE_REPOSITORY_BACKEND}" \
            "${GOOGLE_WORKSPACE_SCOPES}" \
            "${AI_DIAGNOSTICS_TOKEN_SECRET}" \
            "${GOOGLE_CLIENT_SECRET_SECRET}" \
            "${TEX_SERVICE_AUTH_TOKEN_SECRET}" \
            "${TEX_ALLOW_ALL_PACKAGES}" \
            "${TEX_ALLOW_RAW_DOCUMENT}" \
            "${TEX_ALLOW_RESTRICTED_COMMANDS}" \
            "${TEX_ALLOWED_PACKAGES}" \
            "${TEX_SERVICE_BASE_URL}" \
            "$RUN_SERVICE_ACCOUNT")

          gcloud builds submit \
            --config cloudbuild.ai.yaml \
            --substitutions="${SUBSTITUTIONS}" \
            .

          AI_URL="$(gcloud run services describe ${AI_SERVICE_NAME} --region ${GCP_REGION} --format='value(status.url)')"

          if [ -z "${AI_URL}" ]; then
            echo "Cloud Run service URL could not be resolved."
            exit 1
          fi

          echo "AI service deployed at: ${AI_URL}"
          echo "url=${AI_URL}" >> "${GITHUB_OUTPUT}"

      - name: Verify AI health
        run: |
          set -euo pipefail
          echo "Verifying health at: ${{ steps.ai.outputs.url }}/api/ai/health"
          for i in {1..10}; do
            if curl -fsS "${{ steps.ai.outputs.url }}/api/ai/health" >/dev/null; then
              echo "AI health check passed!"
              break
            fi
            echo "AI health check failed (attempt $i), retrying in 5 seconds..."
            sleep 5
            if [ "$i" -eq 10 ]; then
              exit 1
            fi
          done

      - name: Verify AI runtime smoke on direct Cloud Run URL
        id: ai_runtime_smoke
        continue-on-error: true
        run: |
          set -euo pipefail
          for i in {1..10}; do
            if node scripts/check-ai-runtime-smoke.mjs --origin "${{ steps.ai.outputs.url }}" --label "Cloud Run direct"; then
              echo "Direct Cloud Run AI runtime smoke check passed!"
              exit 0
            fi
            echo "Direct Cloud Run AI runtime smoke check failed (attempt $i), retrying in 5 seconds..."
            sleep 5
          done

          echo "Direct Cloud Run AI runtime smoke check failed after 10 attempts."
          exit 1

      - name: Dump recent AI Cloud Run error logs on smoke failure
        if: ${{ always() && steps.ai_runtime_smoke.outcome == 'failure' }}
        continue-on-error: true
        run: |
          set -euo pipefail
          echo "Dumping recent Cloud Run error logs for ${AI_SERVICE_NAME} in ${GCP_REGION}"
          gcloud run services logs read "${AI_SERVICE_NAME}" \
            --region "${GCP_REGION}" \
            --project "${{ secrets.GCP_PROJECT_ID }}" \
            --freshness=30m \
            --limit=100

      - name: Fail if AI runtime smoke failed
        if: ${{ always() && steps.ai_runtime_smoke.outcome == 'failure' }}
        run: |
          echo "AI runtime smoke failed. See the Cloud Run log dump above for the underlying Gemini error."
          exit 1

      - name: Verify AI to TeX proxy health
        run: |
          set -euo pipefail
          echo "Verifying health at: ${{ steps.ai.outputs.url }}/api/tex/health"
          for i in {1..10}; do
            if curl -fsS "${{ steps.ai.outputs.url }}/api/tex/health" >/dev/null; then
              echo "AI TeX proxy health check passed!"
              exit 0
            fi
            echo "AI TeX proxy health check failed (attempt $i), retrying in 5 seconds..."
            sleep 5
          done

          echo "AI TeX proxy health check failed after 10 attempts."
          exit 1

      - name: Verify internal AI diagnostics health
        run: |
          set -euo pipefail
          get_optional_secret_status() {
            local secret_name="$1"
            local output
            if output="$(gcloud secrets versions access latest --secret="${secret_name}" --project "${{ secrets.GCP_PROJECT_ID }}" 2>&1 >/dev/null)"; then
              echo "present"
              return 0
            fi

            if printf '%s' "${output}" | grep -qi 'NOT_FOUND'; then
              echo "missing"
              return 0
            fi

            echo "Unable to access optional Secret Manager secret ${secret_name}."
            if printf '%s' "${output}" | grep -qi 'PERMISSION_DENIED'; then
              ACTIVE_ACCOUNT="$(gcloud auth list --filter=status:ACTIVE --format='value(account)' | head -n 1)"
              echo "Grant roles/secretmanager.secretAccessor on ${secret_name} to ${ACTIVE_ACCOUNT}."
            fi
            echo "${output}"
            exit 1
          }

          TOKEN_SECRET_NAME="${{ secrets.GCP_AI_DIAGNOSTICS_TOKEN_SECRET_NAME }}"
          if [ -z "${TOKEN_SECRET_NAME}" ]; then
            TOKEN_SECRET_NAME="ai-diagnostics-token"
          fi

          SECRET_STATUS="$(get_optional_secret_status "${TOKEN_SECRET_NAME}")"
          if [ "${SECRET_STATUS}" = "missing" ]; then
            echo "Diagnostics secret ${TOKEN_SECRET_NAME} not found. Skipping internal diagnostics health check."
            exit 0
          fi

          DIAGNOSTICS_TOKEN="$(gcloud secrets versions access latest --secret="${TOKEN_SECRET_NAME}")"
          echo "Verifying internal AI diagnostics health at: ${{ steps.ai.outputs.url }}/api/internal/ai/health"
          for i in {1..10}; do
            if curl -fsS \
              -H "X-Docsy-Diagnostics-Token: ${DIAGNOSTICS_TOKEN}" \
              "${{ steps.ai.outputs.url }}/api/internal/ai/health" >/dev/null; then
              echo "Internal AI diagnostics health check passed!"
              exit 0
            fi
            echo "Internal AI diagnostics health check failed (attempt $i), retrying in 5 seconds..."
            sleep 5
          done

          echo "Internal AI diagnostics health check failed after 10 attempts."
          exit 1

  deploy-web:
    name: Deploy web profile frontend to Firebase Hosting
    needs: deploy-ai
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Authenticate to Firebase Hosting
        uses: google-github-actions/auth@v3
        with:
          credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_URBAN_DDS }}

      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@v3

      - name: Setup Node
        uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm

      - name: Build web profile frontend
        run: |
          set -euo pipefail

          DEFAULT_FRONTEND_ORIGIN="https://docsy.cyou"
          DEFAULT_GOOGLE_OAUTH_REDIRECT_URI="${DEFAULT_FRONTEND_ORIGIN}/api/auth/google/callback"
          EXPECTED_PUBLIC_FRONTEND_ORIGIN="${DEFAULT_FRONTEND_ORIGIN}"

          require_secret() {
            local name="$1"
            local value="$2"
            if [ -z "${value}" ]; then
              echo "${name} is required."
              exit 1
            fi
          }

          export DOCSY_PUBLIC_FRONTEND_ORIGIN="${EXPECTED_PUBLIC_FRONTEND_ORIGIN}"
          export DOCSY_AI_SERVICE_URL="${{ needs.deploy-ai.outputs.ai_service_url }}"
          export GCP_AI_ALLOWED_ORIGIN="${{ secrets.GCP_AI_ALLOWED_ORIGIN }}"
          export GCP_GOOGLE_OAUTH_PUBLISHING_STATUS="${{ secrets.GCP_GOOGLE_OAUTH_PUBLISHING_STATUS }}"
          export GCP_GOOGLE_OAUTH_REDIRECT_URI="${{ secrets.GCP_GOOGLE_OAUTH_REDIRECT_URI }}"
          export GCP_GOOGLE_WORKSPACE_SCOPES="${{ secrets.GCP_GOOGLE_WORKSPACE_SCOPES }}"
          export GCP_GOOGLE_WORKSPACE_SCOPE_PROFILE="${{ secrets.GCP_GOOGLE_WORKSPACE_SCOPE_PROFILE }}"
          export GCP_WORKSPACE_FRONTEND_ORIGIN="${{ secrets.GCP_WORKSPACE_FRONTEND_ORIGIN }}"
          export GCP_WEB_VITE_AI_API_BASE_URL="${{ secrets.GCP_WEB_VITE_AI_API_BASE_URL }}"
          eval "$(node scripts/resolve-public-deploy-env.mjs --target web --ai-url "${{ needs.deploy-ai.outputs.ai_service_url }}")"

          if [ -z "${AI_API_BASE_URL}" ] && [ "${{ github.event.inputs.force_frontend }}" != "true" ]; then
            echo "Browser API base URL was not resolved. Set GCP_WEB_VITE_AI_API_BASE_URL or configure GCP_WORKSPACE_FRONTEND_ORIGIN/GCP_AI_ALLOWED_ORIGIN for same-origin Hosting deploys, or use workflow_dispatch with force_frontend=true to override."
            exit 1
          fi

          if [ -z "${AI_API_BASE_URL}" ]; then
            echo "VITE_AI_API_BASE_URL is empty. Refusing to build a frontend without an explicit browser API base URL."
            exit 1
          fi

          case "${AI_API_BASE_URL}" in
            http://*|https://*)
              ;;
            *)
              echo "VITE_AI_API_BASE_URL must be an absolute http(s) URL. Current value: ${AI_API_BASE_URL}"
              exit 1
              ;;
          esac

          export AI_ALLOWED_ORIGIN="${FRONTEND_ORIGIN}"
          export GOOGLE_CLIENT_ID="${{ secrets.GCP_GOOGLE_CLIENT_ID }}"
          export GOOGLE_OAUTH_PUBLISHING_STATUS
          export GOOGLE_OAUTH_REDIRECT_URI
          export GOOGLE_WORKSPACE_SCOPES="${{ secrets.GCP_GOOGLE_WORKSPACE_SCOPES }}"
          export GOOGLE_WORKSPACE_SCOPE_PROFILE
          export PUBLIC_DEPLOY_EXPECTED_FRONTEND_ORIGIN="${EXPECTED_PUBLIC_FRONTEND_ORIGIN}"
          export WORKSPACE_FRONTEND_ORIGIN="${FRONTEND_ORIGIN}"

          require_secret "GCP_GOOGLE_CLIENT_ID" "${{ secrets.GCP_GOOGLE_CLIENT_ID }}"

          FIREBASE_PROJECT_ID="${{ secrets.GCP_FIREBASE_PROJECT_ID }}"
          if [ -z "${FIREBASE_PROJECT_ID}" ]; then
            FIREBASE_PROJECT_ID="${{ secrets.GCP_PROJECT_ID }}"
          fi
          FRONTEND_BUILD_ID="${GITHUB_SHA:-local-dev}"

          echo "Deployment summary:"
          echo "  firebase_project: ${FIREBASE_PROJECT_ID}"
          echo "  browser_api_base_url: ${AI_API_BASE_URL}"
          echo "  expected_public_frontend_origin: ${EXPECTED_PUBLIC_FRONTEND_ORIGIN}"
          echo "  frontend_origin: ${FRONTEND_ORIGIN}"
          echo "  routing_mode: ${ROUTING_MODE}"
          echo "  oauth_redirect_uri: ${GOOGLE_OAUTH_REDIRECT_URI}"
          echo "  frontend_build_id: ${FRONTEND_BUILD_ID}"

          export VITE_AI_API_BASE_URL="${AI_API_BASE_URL}"
          node scripts/validate-public-deploy-config.mjs

          echo "Building frontend with VITE_AI_API_BASE_URL=${AI_API_BASE_URL}"
          printf "VITE_APP_PROFILE=web\nVITE_AI_API_BASE_URL=%s\nVITE_APP_BUILD_ID=%s\n" "${AI_API_BASE_URL}" "${FRONTEND_BUILD_ID}" > .env.web.local

          npm ci
          npm run build:web

      - name: Verify frontend file
        run: |
          set -euo pipefail
          if [ ! -f "dist/index.html" ]; then
            echo "dist/index.html not found after build."
            exit 1
          fi
          echo "Frontend build artifact verified."

      - name: Install Firebase CLI
        run: npm install --global firebase-tools@15.10.0

      - name: Verify Firebase Hosting project access
        run: |
          set -euo pipefail
          FIREBASE_PROJECT_ID="${{ secrets.GCP_FIREBASE_PROJECT_ID }}"
          if [ -z "${FIREBASE_PROJECT_ID}" ]; then
            FIREBASE_PROJECT_ID="${{ secrets.GCP_PROJECT_ID }}"
          fi

          ACCESS_TOKEN="$(gcloud auth print-access-token)"
          RESPONSE="$(curl -sS -w '\n%{http_code}' \
            -H "Authorization: Bearer ${ACCESS_TOKEN}" \
            "https://firebasehosting.googleapis.com/v1beta1/projects/${FIREBASE_PROJECT_ID}/sites")"
          HTTP_STATUS="$(printf '%s\n' "${RESPONSE}" | tail -n 1)"
          RESPONSE_BODY="$(printf '%s\n' "${RESPONSE}" | sed '$d')"

          if [ "${HTTP_STATUS}" != "200" ]; then
            ACTIVE_ACCOUNT="$(gcloud auth list --filter=status:ACTIVE --format='value(account)' | head -n 1)"
            echo "Unable to access Firebase Hosting project ${FIREBASE_PROJECT_ID}."
            echo "Check that GCP_FIREBASE_PROJECT_ID points to a Firebase-enabled project and that FIREBASE_SERVICE_ACCOUNT_URBAN_DDS can access it."
            echo "Active deploy principal: ${ACTIVE_ACCOUNT}"
            echo "${RESPONSE_BODY}"
            exit 1
          fi

          echo "Firebase Hosting project access verified for ${FIREBASE_PROJECT_ID}."

      - name: Deploy to Firebase Hosting
        run: |
          set -euo pipefail
          FIREBASE_PROJECT_ID="${{ secrets.GCP_FIREBASE_PROJECT_ID }}"
          if [ -z "${FIREBASE_PROJECT_ID}" ]; then
            FIREBASE_PROJECT_ID="${{ secrets.GCP_PROJECT_ID }}"
          fi
          echo "Deploying frontend to Firebase project: ${FIREBASE_PROJECT_ID}"
          firebase deploy \
            --only hosting \
            --project "${FIREBASE_PROJECT_ID}" \
            --non-interactive

      - name: Verify AI runtime smoke through frontend origin
        run: |
          set -euo pipefail
          export DOCSY_PUBLIC_FRONTEND_ORIGIN="https://docsy.cyou"
          export GCP_AI_ALLOWED_ORIGIN="${{ secrets.GCP_AI_ALLOWED_ORIGIN }}"
          export GCP_WORKSPACE_FRONTEND_ORIGIN="${{ secrets.GCP_WORKSPACE_FRONTEND_ORIGIN }}"
          eval "$(node scripts/resolve-public-deploy-env.mjs --target web)"

          for i in {1..10}; do
            if node scripts/check-ai-runtime-smoke.mjs --origin "${FRONTEND_ORIGIN}" --label "Frontend same-origin rewrite"; then
              echo "Frontend same-origin AI runtime smoke check passed!"
              exit 0
            fi
            echo "Frontend same-origin AI runtime smoke check failed (attempt $i), retrying in 5 seconds..."
            sleep 5
          done

          echo "Frontend same-origin AI runtime smoke check failed after 10 attempts."
          exit 1