feat(backend): add Cloud Run deployment #284

andeplane · 2025-12-22T09:34:29Z

Adds automated deployment to Cloud Run when pushing to main.

Hardcoded in workflow:

GCP Project: atomify-ee7b5
Region: europe-west1
Database: SQLite at /data/atomify.db
GCS Bucket: atomify-user-files
CORS: localhost:3000, andeplane.github.io

Secrets (already added):

GCP_SA_KEY
GCP_SERVICE_ACCOUNT_EMAIL

Also includes:

Makefile for convenient dev commands
DEPLOYMENT.md guide

Hardcoded values: - GCP Project: atomify-ee7b5 - Region: europe-west1 - Database: SQLite at /data/atomify.db - GCS Bucket: atomify-user-files - CORS: localhost:3000, andeplane.github.io Only 2 secrets needed: - GCP_SA_KEY - GCP_SERVICE_ACCOUNT_EMAIL

gemini-code-assist · 2025-12-22T09:34:42Z

Summary of Changes

Hello @andeplane, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request establishes an automated deployment pipeline for the backend service to Google Cloud Run. It streamlines the process of getting backend changes into production by integrating with GitHub Actions, and provides essential documentation and development tools to support this new infrastructure. The changes ensure a consistent and efficient deployment experience for the backend.

Highlights

Automated Cloud Run Deployment: Implemented automated deployment of the backend service to Google Cloud Run, triggered by pushes to the main branch.
Deployment Documentation: Added a comprehensive DEPLOYMENT.md guide detailing the Cloud Run setup, configuration, and operational procedures.
Development Utilities: Introduced a Makefile to provide convenient commands for development tasks related to the backend.
Configuration Management: Defined hardcoded values for GCP project, region, database, GCS bucket, and CORS origins within the deployment workflow, and specified required GitHub secrets (GCP_SA_KEY, GCP_SERVICE_ACCOUNT_EMAIL).

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files

Ignored by pattern: .github/workflows/** (1)
- .github/workflows/backend.yaml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a detailed deployment guide for setting up the backend on Google Cloud Run. The guide is a great addition for developers. However, my review has identified several significant issues that need to be addressed. These include critical security concerns due to overly permissive IAM roles being recommended, a high risk of data loss because of an incomplete and misleading configuration for SQLite persistence, and multiple correctness errors related to inconsistent region settings across commands. Addressing these points is crucial for a secure and reliable deployment.

backend/DEPLOYMENT.md

CORS_ORIGINS was causing pydantic-settings to fail during tests because it tried to parse the comma-separated string as JSON.

Contains non-secret configuration values. Service account keys are gitignored.

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Uses Cloud Storage FUSE to mount gs://atomify-db at /data for persistent SQLite storage on Cloud Run.

- Fix region inconsistencies (us-central1 → europe-west1) - Update service account roles (Storage Admin → Storage Object Admin) - Remove unnecessary Firebase role (token verification uses public keys) - Document GCS FUSE mount for SQLite persistence - Add volume mount flags to manual deploy command

andeplane · 2025-12-22T09:51:53Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces configuration and documentation for deploying the backend to Google Cloud Run. The changes are centered around a new .env file, modifications to .gitignore, and a comprehensive DEPLOYMENT.md guide. My review highlights a critical security and configuration management issue with committing the .env file and suggests adhering to best practices by ignoring it and using a template instead. Additionally, I've pointed out several inconsistencies and a potentially misleading instruction in the new deployment documentation to improve its accuracy and usability.

gemini-code-assist · 2025-12-22T09:53:13Z

backend/.gitignore


 # Environment
-.env
+# .env.local  # Use for local overrides if needed


Committing .env files is a security risk and a configuration management anti-pattern. These files often contain sensitive data or environment-specific values that should not be in version control. The standard practice is to ignore .env files and commit a template like .env.example instead. Both .env and any local overrides like .env.local should be added to .gitignore.

.env .env.local

backend/.env

backend/DEPLOYMENT.md

pydantic-settings parses list fields as JSON, not comma-separated.

CORS_ORIGINS needs JSON array format for pydantic-settings.

Remove leading spaces from heredoc that made YAML invalid.

andeplane · 2025-12-22T10:00:45Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces automated deployment to Cloud Run, complete with configuration files and a detailed deployment guide. The documentation is thorough and the setup is well-considered. However, there are a few important points to address. The most critical issue is a security risk introduced by tracking the .env file in version control. Additionally, there's a significant architectural concern regarding the use of SQLite with GCS FUSE, which could lead to data corruption if the service scales. I've also included some suggestions to improve the clarity and usability of the new deployment documentation.

backend/.gitignore

gemini-code-assist · 2025-12-22T10:02:15Z

backend/DEPLOYMENT.md

+
+### 4. Create Database Bucket (for SQLite persistence)
+
+SQLite is persisted via GCS FUSE mount:


Using SQLite with GCS FUSE on Cloud Run is a risky approach, especially if the service might scale to more than one instance. SQLite is not designed for concurrent write access from multiple processes, which is what would happen with multiple Cloud Run instances. This can lead to database corruption. It is crucial to either configure Cloud Run to have a maximum of 1 instance or to prominently document this limitation and its risks. For a scalable service, consider using a managed database service like Cloud SQL.

gemini-code-assist · 2025-12-22T10:02:15Z

backend/DEPLOYMENT.md

+- **Service Name**: `atomify-api`
+- **Database URL**: `sqlite+aiosqlite:////data/atomify.db` (SQLite file path)
+- **GCS Bucket Name**: `atomify-user-files`
+- **CORS Origins**: `http://localhost:3000,https://andeplane.github.io`


The CORS origins listed here (and also in the manual deployment command on line 141) are inconsistent with the backend/.env file, which also includes http://localhost:5173. To avoid potential CORS issues during development and ensure the documentation is accurate, it's best to keep these consistent.

Suggested change

- **CORS Origins**: `http://localhost:3000,https://andeplane.github.io`

- **CORS Origins**: `http://localhost:3000,http://localhost:5173,https://andeplane.github.io`

gemini-code-assist · 2025-12-22T10:02:15Z

backend/DEPLOYMENT.md

+docker run --rm \
+  -e DATABASE_URL="$DATABASE_URL" \
+  atomify-api:migrate \
+  alembic upgrade head


This command relies on the DATABASE_URL environment variable being exported in the shell. To make this more convenient and less error-prone for developers, you could use Docker's --env-file flag to load variables directly from a local .env file (which should be git-ignored).

Suggested change

docker run --rm \

-e DATABASE_URL="$DATABASE_URL" \

atomify-api:migrate \

alembic upgrade head

docker run --rm \

--env-file ./backend/.env \

atomify-api:migrate \

alembic upgrade head

gemini-code-assist · 2025-12-22T10:02:15Z

backend/DEPLOYMENT.md

+gcloud run jobs create atomify-api-migrate \
+  --image=gcr.io/atomify-ee7b5/atomify-api:latest \
+  --region=europe-west1 \
+  --set-env-vars="DATABASE_URL=$DATABASE_URL" \


This command requires the DATABASE_URL variable to be set in the shell. It would be helpful to add a note for developers on how to provide this value, for instance by sourcing it from their local .env file, to make the command easier to use.

gemini-code-assist · 2025-12-22T10:02:15Z

backend/DEPLOYMENT.md

+  --execution-environment=gen2 \
+  --allow-unauthenticated \
+  --service-account=atomify-api@atomify-ee7b5.iam.gserviceaccount.com \
+  --set-env-vars="DATABASE_URL=sqlite+aiosqlite:////data/atomify.db,FIREBASE_PROJECT_ID=atomify-ee7b5,GCS_BUCKET_NAME=atomify-user-files,CORS_ORIGINS=http://localhost:3000,https://andeplane.github.io" \


The CORS_ORIGINS value here is inconsistent with backend/.env as it's missing http://localhost:5173. To ensure the manual deployment command works as expected for all documented local development setups, this should be updated.

Suggested change

--set-env-vars="DATABASE_URL=sqlite+aiosqlite:////data/atomify.db,FIREBASE_PROJECT_ID=atomify-ee7b5,GCS_BUCKET_NAME=atomify-user-files,CORS_ORIGINS=http://localhost:3000,https://andeplane.github.io" \

--set-env-vars="DATABASE_URL=sqlite+aiosqlite:////data/atomify.db,FIREBASE_PROJECT_ID=atomify-ee7b5,GCS_BUCKET_NAME=atomify-user-files,CORS_ORIGINS=http://localhost:3000,http://localhost:5173,https://andeplane.github.io" \

gemini-code-assist bot reviewed Dec 22, 2025

View reviewed changes

backend/DEPLOYMENT.md Outdated Show resolved Hide resolved

backend/DEPLOYMENT.md Outdated Show resolved Hide resolved

backend/DEPLOYMENT.md Outdated Show resolved Hide resolved

backend/DEPLOYMENT.md Outdated Show resolved Hide resolved

backend/DEPLOYMENT.md Outdated Show resolved Hide resolved

andeplane and others added 5 commits December 22, 2025 10:36

fix(backend): move app env vars out of workflow-level scope

f7384c0

CORS_ORIGINS was causing pydantic-settings to fail during tests because it tried to parse the comma-separated string as JSON.

chore(backend): add .env config file

f017005

Contains non-secret configuration values. Service account keys are gitignored.

Update backend/DEPLOYMENT.md

233bdf5

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

feat(backend): mount GCS bucket for SQLite persistence

661a662

Uses Cloud Storage FUSE to mount gs://atomify-db at /data for persistent SQLite storage on Cloud Run.

gemini-code-assist bot reviewed Dec 22, 2025

View reviewed changes

andeplane added 3 commits December 22, 2025 10:56

fix(backend): use JSON format for CORS_ORIGINS in .env

81ba1a5

pydantic-settings parses list fields as JSON, not comma-separated.

fix(backend): use env-vars-file for CORS_ORIGINS in deploy

5573495

CORS_ORIGINS needs JSON array format for pydantic-settings.

fix(backend): fix env-vars.yaml generation in workflow

cdac78f

Remove leading spaces from heredoc that made YAML invalid.

Merge branch 'main' into feat/backend-api

f07535d

gemini-code-assist bot reviewed Dec 22, 2025

View reviewed changes


		### 4. Create Database Bucket (for SQLite persistence)

		SQLite is persisted via GCS FUSE mount:

	- CORS Origins: `http://localhost:3000,https://andeplane.github.io`
	- CORS Origins: `http://localhost:3000,http://localhost:5173,https://andeplane.github.io`

	--set-env-vars="DATABASE_URL=sqlite+aiosqlite:////data/atomify.db,FIREBASE_PROJECT_ID=atomify-ee7b5,GCS_BUCKET_NAME=atomify-user-files,CORS_ORIGINS=http://localhost:3000,https://andeplane.github.io" \
	--set-env-vars="DATABASE_URL=sqlite+aiosqlite:////data/atomify.db,FIREBASE_PROJECT_ID=atomify-ee7b5,GCS_BUCKET_NAME=atomify-user-files,CORS_ORIGINS=http://localhost:3000,http://localhost:5173,https://andeplane.github.io" \

Uh oh!

feat(backend): add Cloud Run deployment #284

Are you sure you want to change the base?

feat(backend): add Cloud Run deployment #284

Uh oh!

Conversation

andeplane commented Dec 22, 2025

Hardcoded in workflow:

Secrets (already added):

Also includes:

Uh oh!

gemini-code-assist bot commented Dec 22, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

andeplane commented Dec 22, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

andeplane commented Dec 22, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

gemini-code-assist bot Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants