deploy.sh

#!/bin/bash
set -e

PROJECT_ID="gameclaw-492005"
SERVICE_NAME="influencex"
REGION="us-central1"
IMAGE="gcr.io/${PROJECT_ID}/${SERVICE_NAME}"
CLOUD_SQL_INSTANCE="${PROJECT_ID}:${REGION}:influencex-db"

echo "🎯 Deploying InfluenceX to Google Cloud Run..."
echo "Project: ${PROJECT_ID}"
echo "Service: ${SERVICE_NAME}"

# Changelog reminder. Warn (don't block) if docs/CHANGELOG.md hasn't been
# touched recently — skip the warning if the most recent commit modifies it.
CHANGELOG_PATH="$(dirname "$0")/docs/CHANGELOG.md"
if [[ -f "$CHANGELOG_PATH" ]]; then
  LAST_TOUCH_AGE=$(( ( $(date +%s) - $(stat -f %m "$CHANGELOG_PATH" 2>/dev/null || stat -c %Y "$CHANGELOG_PATH" 2>/dev/null || echo 0) ) / 3600 ))
  RECENT_COMMITS_TOUCHED=$(git log --since='2 hours ago' --pretty=format: --name-only 2>/dev/null | grep -c "docs/CHANGELOG.md" || true)
  if (( LAST_TOUCH_AGE > 4 )) && (( RECENT_COMMITS_TOUCHED == 0 )); then
    echo ""
    echo "⚠️  Reminder: docs/CHANGELOG.md hasn't been updated in ${LAST_TOUCH_AGE}h."
    echo "    Add an entry for this release so users see what's new at /changelog."
    echo "    Press Enter to continue (or Ctrl-C to abort and update first)."
    read -r
  fi
fi

echo "Region: ${REGION}"
echo ""

# Set project
gcloud config set project ${PROJECT_ID}

# Build and push container image
echo "📦 Building container image..."
gcloud builds submit --tag ${IMAGE} --timeout=600

# Sensitive values are sourced from GCP Secret Manager (see setup-secrets.sh).
# Each entry has the form "ENV_VAR_NAME=secret-resource-name:latest". Cloud
# Run mounts the named secret's latest version as the env var at container
# start. The runtime SA needs roles/secretmanager.secretAccessor on each —
# setup-secrets.sh handles the binding.
#
# Keep this list in sync with SECRET_NAMES in setup-secrets.sh. New secret?
# Add it to both. Non-sensitive config belongs in --update-env-vars below.
SECRETS_CSV="\
MAILBOX_ENCRYPTION_KEY=MAILBOX_ENCRYPTION_KEY:latest,\
ADMIN_PASSWORD=ADMIN_PASSWORD:latest,\
GMAIL_OAUTH_CLIENT_SECRET=GMAIL_OAUTH_CLIENT_SECRET:latest,\
RESEND_API_KEY=RESEND_API_KEY:latest,\
RESEND_WEBHOOK_SECRET=RESEND_WEBHOOK_SECRET:latest,\
SMTP_PASS=SMTP_PASS:latest,\
ANTHROPIC_API_KEY=ANTHROPIC_API_KEY:latest,\
OPENAI_API_KEY=OPENAI_API_KEY:latest,\
GOOGLE_AI_API_KEY=GOOGLE_AI_API_KEY:latest,\
VOLCENGINE_ARK_API_KEY=VOLCENGINE_ARK_API_KEY:latest,\
ELEVENLABS_API_KEY=ELEVENLABS_API_KEY:latest,\
HUNTER_API_KEY=HUNTER_API_KEY:latest,\
APIFY_TOKEN=APIFY_TOKEN:latest,\
MODASH_API_KEY=MODASH_API_KEY:latest,\
SERPAPI_API_KEY=SERPAPI_API_KEY:latest,\
YOUTUBE_API_KEY=YOUTUBE_API_KEY:latest,\
GOOGLE_OAUTH_CLIENT_SECRET=GOOGLE_OAUTH_CLIENT_SECRET:latest,\
TWITTER_CLIENT_SECRET=TWITTER_CLIENT_SECRET:latest,\
LINKEDIN_CLIENT_SECRET=LINKEDIN_CLIENT_SECRET:latest,\
META_APP_SECRET=META_APP_SECRET:latest,\
YOUTUBE_CLIENT_SECRET=YOUTUBE_CLIENT_SECRET:latest,\
TIKTOK_CLIENT_SECRET=TIKTOK_CLIENT_SECRET:latest,\
THREADS_APP_SECRET=THREADS_APP_SECRET:latest,\
PINTEREST_APP_SECRET=PINTEREST_APP_SECRET:latest,\
REDDIT_CLIENT_SECRET=REDDIT_CLIENT_SECRET:latest,\
TWITCH_CLIENT_SECRET=TWITCH_CLIENT_SECRET:latest,\
STRIPE_SECRET_KEY=STRIPE_SECRET_KEY:latest,\
STRIPE_WEBHOOK_SECRET=STRIPE_WEBHOOK_SECRET:latest,\
DATABASE_URL=DATABASE_URL:latest\
"

# Conditionally append optional secrets if they actually exist in Secret
# Manager. Lets ops simply run `setup-secrets.sh` (which honors the .env)
# and have the next deploy auto-mount whatever they configured — no manual
# uncomment / re-deploy dance.
maybe_append_secret() {
  local name="$1"
  if gcloud secrets describe "$name" --quiet >/dev/null 2>&1; then
    SECRETS_CSV="${SECRETS_CSV},${name}=${name}:latest"
    echo "  ✓ mounting optional secret: ${name}"
  fi
}
maybe_append_secret "SENTRY_DSN"

# Non-sensitive env vars. OAuth client IDs, CORS, LLM routing, mail sender
# identity, public sheet IDs — none of these are secrets (they're visible to
# the browser on login / in email headers) so they stay as plain env vars
# rather than Secret Manager refs.
#
# CORS_ORIGINS contains commas; --update-env-vars' default delimiter IS
# comma, which would split the value mid-URL. Prefix with `^##^` to switch
# the inter-var separator to `##` so embedded commas survive.
ENV_VARS="^##^\
BASE_PATH=##\
NODE_ENV=production##\
CLOUD_SQL_CONNECTION=${CLOUD_SQL_INSTANCE}##\
OAUTH_CALLBACK_BASE=https://influencexes.com##\
CORS_ORIGINS=https://influencexes.com,https://www.influencexes.com,https://gogameclaw.com##\
RESEND_FROM_EMAIL=contact@market.hakko.ai##\
RESEND_REPLY_TO=market@hakko.ai##\
LLM_DEFAULT_PROVIDER=anthropic##\
STRATEGY_LLM_PROVIDER=google##\
RESEARCH_LLM_PROVIDER=google##\
SEO_LLM_PROVIDER=google##\
COMPETITOR_LLM_PROVIDER=google##\
REVIEW_LLM_PROVIDER=google##\
TWITTER_CLIENT_ID=Yy04RnJKVDlpRF81RDNNa0poNno6MTpjaQ##\
TWITCH_CLIENT_ID=ftj4lauvvjr4dkywfyeri0200pp0xq"

# Deploy to Cloud Run
echo "🚀 Deploying to Cloud Run..."
gcloud run deploy ${SERVICE_NAME} \
  --image ${IMAGE} \
  --platform managed \
  --region ${REGION} \
  --allow-unauthenticated \
  --port 8080 \
  --memory 512Mi \
  --cpu 1 \
  --min-instances 0 \
  --max-instances 3 \
  --add-cloudsql-instances ${CLOUD_SQL_INSTANCE} \
  --update-env-vars "${ENV_VARS}" \
  --update-secrets "${SECRETS_CSV}"

echo ""
echo "✅ Deployment complete!"
echo "Service URL:"
gcloud run services describe ${SERVICE_NAME} --region ${REGION} --format 'value(status.url)'
echo ""
echo "📌 Note: Configure your load balancer to route gogameclaw.com/InfluenceX/* to this Cloud Run service"