# Create and download the service account key
gcloud iam service-accounts keys create ~/cloud-run-deployer-key.json \
    --iam-account=$DEPLOY_SERVICE_ACCOUNT \
    --project="$PROJECT_ID"
```

This will generate a JSON key file (cloud-run-deployer-key.json). Save this file as you will need it to authenticate GitHub Actions with Google Cloud.

***

## **Step 2: Store GCP Credentials in GitHub Secrets**

[Section titled “Step 2: Store GCP Credentials in GitHub Secrets”](#step-2-store-gcp-credentials-in-github-secrets)

1. Go to your GitHub repository.
2. Navigate to **Settings** > **Secrets and variables** > **Actions**.
3. Click **New repository secret** and add the following secrets:

* **GCP\_DEPLOY\_SA\_KEY**: The content of your cloud-run-deployer-key.json file. Copy the entire contents of the JSON file.
* **DEPLOY\_SERVICE\_ACCOUNT**: The service account that will **deploy the Cloud Run application**.
* **GCP\_PROJECT**: Your Google Cloud project ID (you already set this as `$PROJECT_ID` in the terminal).
* **CLOUDRUN\_NAME**: The name of your Cloud Run service.
* **IMAGE\_URL**: The URL for your container image. It typically follows the format: REGION-docker.pkg.dev/\[PROJECT\_ID]/\[REPOSITORY]/\[IMAGE\_NAME]:latest.
* **REGION**: The Google Cloud region where your Cloud Run service is deployed (e.g., us-central1).
* **DATABASE\_ADDRESS**: The Cloud SQL instance connection name (format: project:region:instance).
* **APPLICATION\_SETTINGS**: Key reference for secrets manager (format: application\_settings:latest).
* **SERVICE\_ACCOUNT**: The service account that will **run the Cloud Run application**.

***

## **Step 3: Create the deploy.yml File**

[Section titled “Step 3: Create the deploy.yml File”](#step-3-create-the-deployyml-file)

Now that the test workflow is in place and runs successfully, we’ll create a deployment workflow that triggers when the tests pass.

In this deployment workflow, we will use the `DEPLOY_SERVICE_ACCOUNT` environment variable in both shell commands and GitHub Actions.

1. In your GitHub repository, create the following directory structure:

   ```bash
   .github/
     workflows/
   ```

2. Inside the workflows folder, create a file named deploy.yml and add the following content:

   ```yaml
   name: Deploy to Cloud Run


   on:
     workflow_run:
       workflows: ["Run Django Tests"]
       types: [completed]
       branches: [main]


   jobs:
     on-success:
       if: ${{ github.event.workflow_run.conclusion == 'success' }}
       runs-on: ubuntu-latest


       steps:
         - name: Checkout code
           uses: actions/checkout@v3


         - name: Authenticate with Google Cloud
           uses: google-github-actions/auth@v1
           with:
             credentials_json: ${{ secrets.GCP_DEPLOY_SA_KEY }}


         - name: Configure Google Cloud
           run: |
             gcloud config set project ${{ secrets.GCP_PROJECT }}
             gcloud config set run/region ${{ secrets.REGION }}
             gcloud config set account ${{ secrets.DEPLOY_SERVICE_ACCOUNT }}


         - name: Authenticate Docker to push images to Artifact Registry
           run: |
             gcloud auth configure-docker ${{ secrets.REGION }}-docker.pkg.dev --quiet


         - name: Build Docker image
           run: |
             docker build -t ${{ secrets.IMAGE_URL }} . -f Dockerfile.web --platform linux/amd64


         - name: Push Docker image to Artifact Registry
           run: |
             docker push ${{ secrets.IMAGE_URL }}


         - name: Deploy to Cloud Run
           run: |
             gcloud run deploy ${{ secrets.CLOUDRUN_NAME }} \
               --region ${{ secrets.REGION }} \
               --update-env-vars DJANGO_SETTINGS_MODULE=agenda.settings_production \
               --image ${{ secrets.IMAGE_URL }} \
               --set-cloudsql-instances ${{ secrets.DATABASE_ADDRESS }} \
               --set-secrets APPLICATION_SETTINGS=${{ secrets.APPLICATION_SETTINGS }} \
               --service-account ${{ secrets.SERVICE_ACCOUNT }} \
               --allow-unauthenticated
   ```

***

## **Step 4: Test the Deployment Workflow**

[Section titled “Step 4: Test the Deployment Workflow”](#step-4-test-the-deployment-workflow)

Once everything is set up, test the workflow by making a change in the `main` branch or opening a pull request.

1. Push the changes or create a pull request targeting the `main` branch.
2. The `test` workflow will run automatically.
3. If the tests pass successfully, the `deploy.yml` workflow will trigger, deploying the new changes to Cloud Run.