I've written about the Serverless Framework before, and how it plays very nicely with AWS. With Google Cloud, I've found things are a bit trickier, and there's less documentation, probably because it's relatively new. But fear not! Here's a complete step by step to set up a GitHub workflow to deploy to Google Cloud using the Serverless Framework. The process shouldn't be too different if you are using another CI provider.
If you haven't, set up a starter project:
serverless create --template google-nodejs
First, you'll need Google Cloud system credentials. The Serverless framework has a complete guide on how to set up a service account with the right roles.
By now you should have downloaded a JSON file with your credentials, and added its path in your serverless.yml
. But this path can be different if you deploy from your machine, or a fellow developer deploys from theirs, or if it's deployed via CI, right? So we want this to be an environment variable. Your complete serverless.yml
file should look something like this:
service: my-project
provider:
name: google
stage: dev
runtime: nodejs8
region: europe-west1
project: my-project
credentials: ${env:CREDENTIALS_PATH}
plugins:
- serverless-google-cloudfunctions
package:
exclude:
- node_modules/**
- .gitignore
- .git/**
functions:
first:
handler: http
events:
- http: path
Now, from your machine you can easily deploy passing the correct path:
CREDENTIALS_PATH=~/path/to/your/keyfile.json serverless deploy
Now we are ready to create our deploy workflow! We'll be using the official Serverless action. In the example workflow, they show how to pass secrets as environment variables, but as we've seen with Google Cloud we need to pass a whole JSON file. And we know it's not a good idea to commit sensitive information, so we'll need to commit an encrypted version of it, and add a script to decrypt it on deploy time. That might sound complicated but don't worry, we'll do it! 💪The GitHub Actions documentation includes a guide on how to do that, but we'll go step by step here too.
First, encrypt the file (with Mac I installed GPG Tools)
$ gpg --symmetric --cipher-algo AES256 keyfile.json
You'll need to enter a passphrase. Make sure to keep it somewhere safe as we'll need it to decrypt the file. Commit the encrypted keyfile.json.gpg
file to your repository.
Create a shell script to decrypt the password. We need to use the $GITHUB_WORKSPACE
path instead of $HOME
(as the documentation example) because the Serverless action runs in a docker container and is not able to access any directory, just the workspace.
#!/bin/sh
# Decrypt the file
mkdir $GITHUB_WORKSPACE/secrets
# --batch to prevent interactive command --yes to assume "yes" for questions
gpg --quiet --batch --yes --decrypt --passphrase="$SECRET_PASSPHRASE" \
--output $GITHUB_WORKSPACE/secrets/keyfile.json keyfile.json.gpg
Save this file in .github/scripts/decrypt_secret.sh
, make sure it is executable by running chmod +x decrypt_secret.sh
, and commit it.
In your GitHub repository settings, add a new SECRET_PASSPHRASE
secret with the passphrase you used when encrypting the file.
Now we are ready to decrypt the keyfile in our workflow, and pass its path to the Serverless action as an environment variable (inside the container the $GITHUB_WORKSPACE
path is accessible via /github/workspace/
). Here's the complete workflow file:
name: Deploy
on:
push:
branches:
- master
jobs:
deploy:
name: deploy
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: npm install
run: npm install
- name: Decrypt secret
run: ./.github/scripts/decrypt_secret.sh
env:
SECRET_PASSPHRASE: ${{ secrets.SECRET_PASSPHRASE }}
- name: serverless deploy
uses: serverless/github-action@master
with:
args: deploy
env:
SERVERLESS_ACCESS_KEY: ${{ secrets.SERVERLESS_ACCESS_KEY }}
CREDENTIALS_PATH: /github/workspace/secrets/keyfile.json
Finally, your project is set up for continuous deployment! You can find the whole code in this repository.
Of course, you should also have workflows to run tests or lint your code. At Codegram we love GitHub Actions, and we have a repo with useful workflows. Make sure to take a look!
Cover photo by Daniel Mayovskiy
Top comments (0)