sync-cloud-run-env.yml

name: Sync Cloud Run Env

on:
  push:
    branches: [ main ]

env:
  GCP_PROJECT_ID: interactivebrokersquant
  GCP_WORKLOAD_IDENTITY_PROVIDER: projects/303168642265/locations/global/workloadIdentityPools/github-actions/providers/github-main
  GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT: ibkr-platform-deploy@interactivebrokersquant.iam.gserviceaccount.com

jobs:
  sync-cloud-run-env:
    name: Sync Cloud Run Env
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    env:
      ENABLE_GITHUB_ENV_SYNC: ${{ vars.ENABLE_GITHUB_ENV_SYNC }}
      CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }}
      CLOUD_RUN_SERVICE: ${{ vars.CLOUD_RUN_SERVICE }}
      TELEGRAM_TOKEN_SECRET_NAME: ${{ vars.TELEGRAM_TOKEN_SECRET_NAME }}
      STRATEGY_PROFILE: ${{ vars.STRATEGY_PROFILE }}
      ACCOUNT_GROUP: ${{ vars.ACCOUNT_GROUP }}
      IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME: ${{ vars.IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME }}
      IBKR_FEATURE_SNAPSHOT_PATH: ${{ vars.IBKR_FEATURE_SNAPSHOT_PATH }}
      IBKR_FEATURE_SNAPSHOT_MANIFEST_PATH: ${{ vars.IBKR_FEATURE_SNAPSHOT_MANIFEST_PATH }}
      IBKR_STRATEGY_CONFIG_PATH: ${{ vars.IBKR_STRATEGY_CONFIG_PATH }}
      IBKR_RECONCILIATION_OUTPUT_PATH: ${{ vars.IBKR_RECONCILIATION_OUTPUT_PATH }}
      IBKR_DRY_RUN_ONLY: ${{ vars.IBKR_DRY_RUN_ONLY }}
      EXECUTION_REPORT_GCS_URI: ${{ vars.EXECUTION_REPORT_GCS_URI }}
      IB_GATEWAY_ZONE: ${{ vars.IB_GATEWAY_ZONE }}
      IB_GATEWAY_IP_MODE: ${{ vars.IB_GATEWAY_IP_MODE }}
      GLOBAL_TELEGRAM_CHAT_ID: ${{ vars.GLOBAL_TELEGRAM_CHAT_ID }}
      NOTIFY_LANG: ${{ vars.NOTIFY_LANG }}
      TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
    steps:
      - name: Check whether env sync is enabled
        id: config
        run: |
          set -euo pipefail

          if [ "${ENABLE_GITHUB_ENV_SYNC:-}" != "true" ]; then
            echo "enabled=false" >> "$GITHUB_OUTPUT"
            echo "Skipping Cloud Run env sync because ENABLE_GITHUB_ENV_SYNC is not set to true." >&2
            exit 0
          fi

          echo "enabled=true" >> "$GITHUB_OUTPUT"

      - name: Checkout repository
        if: steps.config.outputs.enabled == 'true'
        uses: actions/checkout@v6

      - name: Set up Python for strategy requirement resolution
        if: steps.config.outputs.enabled == 'true'
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install strategy status dependencies
        if: steps.config.outputs.enabled == 'true'
        run: |
          set -euo pipefail
          python -m pip install --upgrade pip
          python -m pip install -r requirements.txt

      - name: Resolve selected strategy runtime requirements
        id: strategy_requirements
        if: steps.config.outputs.enabled == 'true'
        run: |
          set -euo pipefail
          python - <<'PY'
          import json
          import os
          import subprocess
          import sys
          from us_equity_strategies import resolve_canonical_profile

          profile = os.environ.get("STRATEGY_PROFILE", "").strip().lower()
          if not profile:
              raise SystemExit("STRATEGY_PROFILE is required")
          canonical_profile = resolve_canonical_profile(profile)

          raw_status = subprocess.check_output(
              [sys.executable, "scripts/print_strategy_profile_status.py", "--json"],
              text=True,
          )
          rows = json.loads(raw_status)
          selected = next((row for row in rows if row["canonical_profile"] == canonical_profile), None)
          if selected is None:
              supported = ", ".join(sorted(row["canonical_profile"] for row in rows))
              raise SystemExit(f"Unsupported STRATEGY_PROFILE={profile!r}; supported: {supported}")
          if not selected.get("eligible") or not selected.get("enabled"):
              raise SystemExit(f"STRATEGY_PROFILE={profile!r} is not eligible/enabled: {selected}")

          output_path = os.environ["GITHUB_OUTPUT"]
          with open(output_path, "a", encoding="utf-8") as output:
              output.write(
                  f"requires_snapshot_artifacts={str(bool(selected.get('requires_snapshot_artifacts'))).lower()}\n"
              )
              output.write(
                  f"requires_snapshot_manifest_path={str(bool(selected.get('requires_snapshot_manifest_path'))).lower()}\n"
              )
              output.write(
                  f"requires_strategy_config_path={str(bool(selected.get('requires_strategy_config_path'))).lower()}\n"
              )
              output.write(
                  f"config_source_policy={str(selected.get('config_source_policy') or 'none')}\n"
              )
              output.write(
                  f"reconciliation_output_policy={str(selected.get('reconciliation_output_policy') or 'none')}\n"
              )
          PY

      - name: Validate env sync inputs
        if: steps.config.outputs.enabled == 'true'
        env:
          REQUIRES_SNAPSHOT_ARTIFACTS: ${{ steps.strategy_requirements.outputs.requires_snapshot_artifacts }}
          REQUIRES_SNAPSHOT_MANIFEST_PATH: ${{ steps.strategy_requirements.outputs.requires_snapshot_manifest_path }}
          REQUIRES_STRATEGY_CONFIG_PATH: ${{ steps.strategy_requirements.outputs.requires_strategy_config_path }}
          CONFIG_SOURCE_POLICY: ${{ steps.strategy_requirements.outputs.config_source_policy }}
          RECONCILIATION_OUTPUT_POLICY: ${{ steps.strategy_requirements.outputs.reconciliation_output_policy }}
        run: |
          set -euo pipefail

          required_vars=(
            CLOUD_RUN_REGION
            CLOUD_RUN_SERVICE
            STRATEGY_PROFILE
            ACCOUNT_GROUP
            IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME
            GLOBAL_TELEGRAM_CHAT_ID
            NOTIFY_LANG
          )

          if [ "${REQUIRES_SNAPSHOT_ARTIFACTS:-}" = "true" ]; then
            required_vars+=(IBKR_FEATURE_SNAPSHOT_PATH)
          fi

          if [ "${REQUIRES_SNAPSHOT_MANIFEST_PATH:-}" = "true" ]; then
            required_vars+=(IBKR_FEATURE_SNAPSHOT_MANIFEST_PATH)
          fi

          if [ "${REQUIRES_STRATEGY_CONFIG_PATH:-}" = "true" ] && [ "${CONFIG_SOURCE_POLICY:-}" = "env_only" ]; then
            required_vars+=(IBKR_STRATEGY_CONFIG_PATH)
          fi

          if [ "${RECONCILIATION_OUTPUT_POLICY:-}" = "required" ]; then
            required_vars+=(IBKR_RECONCILIATION_OUTPUT_PATH)
          fi

          missing_vars=()
          for var_name in "${required_vars[@]}"; do
            if [ -z "${!var_name:-}" ]; then
              missing_vars+=("${var_name}")
            fi
          done

          if [ -z "${TELEGRAM_TOKEN_SECRET_NAME:-}" ] && [ -z "${TELEGRAM_TOKEN:-}" ]; then
            missing_vars+=("TELEGRAM_TOKEN_SECRET_NAME or TELEGRAM_TOKEN")
          fi

          if [ "${#missing_vars[@]}" -gt 0 ]; then
            echo "Cloud Run env sync is enabled, but these values are missing:" >&2
            printf '  - %s\n' "${missing_vars[@]}" >&2
            exit 1
          fi

      - name: Authenticate to Google Cloud
        id: auth
        if: steps.config.outputs.enabled == 'true'
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ env.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }}

      - name: Set up gcloud
        if: steps.config.outputs.enabled == 'true'
        uses: google-github-actions/setup-gcloud@v3
        with:
          project_id: ${{ env.GCP_PROJECT_ID }}
          version: ">= 416.0.0"

      - name: Wait for Cloud Run deployment of current commit
        if: steps.config.outputs.enabled == 'true'
        run: |
          set -euo pipefail

          target_sha="${GITHUB_SHA}"
          deadline=$((SECONDS + 1800))

          while true; do
            deployed_sha="$(gcloud run services describe "${CLOUD_RUN_SERVICE}" --region "${CLOUD_RUN_REGION}" --format='value(spec.template.metadata.labels.commit-sha)' 2>/dev/null || true)"
            if [ -n "${deployed_sha}" ] && [ "${deployed_sha}" = "${target_sha}" ]; then
              echo "Cloud Run service ${CLOUD_RUN_SERVICE} is on commit ${deployed_sha}."
              break
            fi

            if [ "${SECONDS}" -ge "${deadline}" ]; then
              echo "Timed out waiting for Cloud Run service ${CLOUD_RUN_SERVICE} to deploy commit ${target_sha}. Last seen commit: ${deployed_sha:-<none>}" >&2
              exit 1
            fi

            echo "Waiting for Cloud Run service ${CLOUD_RUN_SERVICE} to deploy commit ${target_sha}. Last seen commit: ${deployed_sha:-<none>}" >&2
            sleep 10
          done

      - name: Sync Cloud Run environment
        if: steps.config.outputs.enabled == 'true'
        run: |
          set -euo pipefail

          env_pairs=(
            "GLOBAL_TELEGRAM_CHAT_ID=${GLOBAL_TELEGRAM_CHAT_ID}"
            "NOTIFY_LANG=${NOTIFY_LANG}"
            "STRATEGY_PROFILE=${STRATEGY_PROFILE}"
            "ACCOUNT_GROUP=${ACCOUNT_GROUP}"
            "IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME=${IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME}"
          )
          secret_pairs=()

          remove_env_vars=(
            "IB_GATEWAY_HOST"
            "IB_GATEWAY_PORT"
            "TELEGRAM_CHAT_ID"
            "IB_CLIENT_ID"
            "IB_GATEWAY_INSTANCE_NAME"
            "IB_GATEWAY_MODE"
          )
          remove_secret_vars=()

          if [ -n "${TELEGRAM_TOKEN_SECRET_NAME:-}" ]; then
            secret_pairs+=("TELEGRAM_TOKEN=${TELEGRAM_TOKEN_SECRET_NAME}:latest")
          else
            env_pairs+=("TELEGRAM_TOKEN=${TELEGRAM_TOKEN}")
            remove_secret_vars+=("TELEGRAM_TOKEN")
          fi

          if [ -n "${IB_GATEWAY_ZONE:-}" ]; then
            env_pairs+=("IB_GATEWAY_ZONE=${IB_GATEWAY_ZONE}")
          else
            remove_env_vars+=("IB_GATEWAY_ZONE")
          fi

          if [ -n "${IB_GATEWAY_IP_MODE:-}" ]; then
            env_pairs+=("IB_GATEWAY_IP_MODE=${IB_GATEWAY_IP_MODE}")
          else
            remove_env_vars+=("IB_GATEWAY_IP_MODE")
          fi

          if [ -n "${IBKR_FEATURE_SNAPSHOT_PATH:-}" ]; then
            env_pairs+=("IBKR_FEATURE_SNAPSHOT_PATH=${IBKR_FEATURE_SNAPSHOT_PATH}")
          else
            remove_env_vars+=("IBKR_FEATURE_SNAPSHOT_PATH")
          fi

          if [ -n "${IBKR_FEATURE_SNAPSHOT_MANIFEST_PATH:-}" ]; then
            env_pairs+=("IBKR_FEATURE_SNAPSHOT_MANIFEST_PATH=${IBKR_FEATURE_SNAPSHOT_MANIFEST_PATH}")
          else
            remove_env_vars+=("IBKR_FEATURE_SNAPSHOT_MANIFEST_PATH")
          fi

          if [ -n "${IBKR_STRATEGY_CONFIG_PATH:-}" ]; then
            env_pairs+=("IBKR_STRATEGY_CONFIG_PATH=${IBKR_STRATEGY_CONFIG_PATH}")
          else
            remove_env_vars+=("IBKR_STRATEGY_CONFIG_PATH")
          fi

          if [ -n "${IBKR_RECONCILIATION_OUTPUT_PATH:-}" ]; then
            env_pairs+=("IBKR_RECONCILIATION_OUTPUT_PATH=${IBKR_RECONCILIATION_OUTPUT_PATH}")
          else
            remove_env_vars+=("IBKR_RECONCILIATION_OUTPUT_PATH")
          fi

          if [ -n "${IBKR_DRY_RUN_ONLY:-}" ]; then
            env_pairs+=("IBKR_DRY_RUN_ONLY=${IBKR_DRY_RUN_ONLY}")
          else
            remove_env_vars+=("IBKR_DRY_RUN_ONLY")
          fi

          if [ -n "${EXECUTION_REPORT_GCS_URI:-}" ]; then
            env_pairs+=("EXECUTION_REPORT_GCS_URI=${EXECUTION_REPORT_GCS_URI}")
          else
            remove_env_vars+=("EXECUTION_REPORT_GCS_URI")
          fi

          gcloud_args=(
            run services update "${CLOUD_RUN_SERVICE}"
            --region "${CLOUD_RUN_REGION}"
            --remove-env-vars "$(IFS=,; echo "${remove_env_vars[*]}")"
            --update-env-vars "$(IFS=,; echo "${env_pairs[*]}")"
          )

          if [ "${#remove_secret_vars[@]}" -gt 0 ]; then
            gcloud_args+=(--remove-secrets "$(IFS=,; echo "${remove_secret_vars[*]}")")
          fi

          if [ "${#secret_pairs[@]}" -gt 0 ]; then
            gcloud_args+=(--update-secrets "$(IFS=,; echo "${secret_pairs[*]}")")
          fi

          gcloud "${gcloud_args[@]}"