Deployment

Workflows

Dev: deploy-dev.yml on push to develop.
Prod: deploy-prod.yml on push to master.

Both build via Dockerfile.web / Dockerfile.api and deploy to Cloud Run:

{REPO_NAME}-web-dev / {REPO_NAME}-api-dev
{REPO_NAME}-web / {REPO_NAME}-api

Web must call the tenant API

The SPA bakes VITE_API_URL from Actions variables at image build time:

Environment	Variable	Example
Prod web	`PROD_API_BASE_URL`	`https://api.yourdomain.com`
Dev web	`DEV_API_BASE_URL`	`https://dev-api.yourdomain.com`

Domain mapping (four hosts)

Host	Cloud Run service
`app.{apex}`	`{REPO}-web`
`dev.{apex}`	`{REPO}-web-dev`
`api.{apex}`	`{REPO}-api`
`dev-api.{apex}`	`{REPO}-api-dev`

Activate / refresh DNS also patches the tenant API with WEB_APP_URL, API_URL, CUSTOM_DOMAIN, and CORS_EXTRA_ORIGINS. Apex ownership must be verified for Cloud Run domain mapping (Search Console / TXT). Temporary *.run.app URLs work before certs are ready.

GCP project

White-label tenant deploys use streaminglive-633c1. Do not use aspen-flight-ops.

Required Actions secrets

Secret	Description
`GCP_SA_KEY`	Deploy SA JSON (required; empty → auth fails or gated skip)
`GCP_PROJECT_ID`	`streaminglive-633c1`

First-push race: template create can fire Deploy before secrets exist. Current workflows skip green when GCP_SA_KEY is empty; ACP writes secrets then dispatches a real deploy.

Required Actions variables

APP_NAME, PRIMARY_COLOR, CUSTOM_DOMAIN, DEV_CUSTOM_DOMAIN, PROD_WEB_BASE_URL, DEV_WEB_BASE_URL, PROD_API_BASE_URL, DEV_API_BASE_URL.

ACP contract

ACP watches deploy-dev.yml after merge to develop, then deploy-prod.yml after promote. Keep workflow file names unchanged. Success detection ignores secrets-gate skips.