From e174890fd8602f82699c00e2fc13c437ebdb1ac5 Mon Sep 17 00:00:00 2001
From: Brian Glass <brian@glassbrian.com>
Date: Mon, 17 Aug 2026 17:18:16 -0400
Subject: [PATCH] Move the main-branch Cloud Build trigger's steps into a
 tracked cloudbuild.yaml

The build steps for the "orthocal" Cloud Run deploy trigger lived only as
inline config on the GCP trigger object itself -- no version history, no
code review, no diff when something changed. That's exactly how a
duplicate trigger (76b104f9, deleted this session) went unnoticed for
years: nothing about the pipeline was visible from the repo.

This file is not wired up yet -- the trigger still uses its own inline
build config until this merges to main, since Cloud Build reads a
filename-referenced config from the branch that triggered the build, so
switching the trigger over before the file exists on main would break
the next deploy. The trigger will be pointed at this file (via its
`filename` field, replacing the inline `build` block) as a follow-up
once this is merged.

Content matches the trigger's current live steps exactly (Build, Push,
Deploy, UpdateJob, plus the just-added ExtractStatic/FirebaseDeploy
steps for Firebase Hosting's static-asset offload) -- substitution
values (_DEPLOY_REGION, _SERVICE_NAME, etc.) stay defined on the trigger
itself, not duplicated here, since filename-based configs still pull
substitutions from the trigger at build time.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hf6j2xXQXywHVh3HAVRxB3
---
 cloudbuild.yaml | 79 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 cloudbuild.yaml

diff --git a/cloudbuild.yaml b/cloudbuild.yaml
new file mode 100644
index 0000000..eef029b
--- /dev/null
+++ b/cloudbuild.yaml
@@ -0,0 +1,79 @@
+steps:
+  - id: Build
+    name: gcr.io/cloud-builders/docker
+    args:
+      - build
+      - --no-cache
+      - -t
+      - $_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
+      - .
+      - -f
+      - Dockerfile
+  - id: Push
+    name: gcr.io/cloud-builders/docker
+    args:
+      - push
+      - $_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
+  - id: Deploy
+    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+    entrypoint: gcloud
+    args:
+      - run
+      - services
+      - update
+      - $_SERVICE_NAME
+      - --platform=managed
+      - --image=$_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
+      - --labels=managed-by=gcp-cloud-build-deploy-cloud-run,commit-sha=$COMMIT_SHA,gcb-build-id=$BUILD_ID,gcb-trigger-id=$_TRIGGER_ID,$_LABELS
+      - --region=$_DEPLOY_REGION
+      - --quiet
+  - id: UpdateJob
+    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+    entrypoint: gcloud
+    args:
+      - run
+      - jobs
+      - update
+      - $_JOB_NAME
+      - --image=$_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
+      - --region=$_DEPLOY_REGION
+      - --quiet
+  # Extracts the collectstatic output that the Dockerfile already baked into
+  # the just-built image, so Firebase Hosting can serve it directly from its
+  # own CDN (see firebase.json's rewrite, which only falls back to Cloud Run
+  # for paths that don't match a real file under public/) instead of every
+  # static-asset request proxying through Cloud Run.
+  - id: ExtractStatic
+    name: gcr.io/cloud-builders/docker
+    entrypoint: bash
+    args:
+      - -c
+      - |
+        set -e
+        docker create --name static-extract $_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
+        rm -rf public/media
+        mkdir -p public/media
+        docker cp static-extract:/orthocal/static/. public/media/
+        docker rm static-extract
+        # servestatic pre-compresses sidecar files (.br/.gz/.zstd) for its own
+        # on-disk serving scheme; Firebase Hosting compresses on the fly at
+        # its own CDN edge and never looks for these, so they'd just be dead
+        # weight in the deploy.
+        find public/media \( -name '*.br' -o -name '*.gz' -o -name '*.zstd' \) -delete
+  # Auth is implicit via the Cloud Build service account's
+  # roles/firebasehosting.admin IAM binding (Application Default
+  # Credentials, auto-detected from Cloud Build's metadata server) -- no
+  # token or key needed here.
+  - id: FirebaseDeploy
+    name: node:20
+    entrypoint: bash
+    args:
+      - -c
+      - |
+        set -e
+        npm install -g firebase-tools@15
+        firebase deploy --only hosting --project $PROJECT_ID --non-interactive
+images:
+  - $_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
+options:
+  substitutionOption: ALLOW_LOOSE