feat: add docker-build and cloudrun-deploy composite actions

[gamechanger1s]

Summary

Extends the reusable build and deploy actions in actions/build/action.yml and actions/deploy/action.yml to support GCP Artifact Registry + Cloud Run deployments alongside the existing static-build path. A third path — GHCR pull+retag — is also added to support services whose image is pre-built externally. The deploy action now also supports Cloud Run jobs with optional Cloud Scheduler creation.

Changes

actions/build/action.yml

• New Docker build+push path (activated by image-name): authenticates via WIF, optionally fetches build-time env vars from Secret Manager into .env.production, builds with Buildx, and pushes SHA + latest tags to Artifact Registry
• New GHCR pull+retag path (activated by ghcr-image): pulls a pre-built image from GHCR, re-tags it for Artifact Registry (SHA + latest), and pushes it — no Dockerfile or build-time secrets required; takes priority over the Docker build path
• All existing static-build steps are guarded with discriminator conditions — zero breaking changes

actions/deploy/action.yml

• New Cloud Run service path (activated by cloudrun-service): fetches runtime env vars from Secret Manager, formats them as KEY=VAL,..., and deploys via google-github-actions/deploy-cloudrun with overwrite strategy
• New Cloud Run job path (activated by cloudrun-job): deploys a Cloud Run job using the same shared WIF auth and Secret Manager fetch as the service path; optionally creates a Cloud Scheduler trigger (idempotent — skipped if already exists) when scheduler-name and schedule-time are set
• Supports extra Cloud Run flags via cloudrun-flags input (e.g. VPC connector, ingress settings, job command/args)
• All existing static-deploy steps are unaffected; service path callers are unaffected

README.md

• Added Docker + Cloud Run service usage example
• Added GHCR pull+retag usage example
• Added Docker + Cloud Run job with Cloud Scheduler usage example
• Updated contents table and runner-contract note to document all new paths

SHA-pinned actions (all verified against GitHub)

Action	SHA	Version
get-secretmanager-secrets	2b5f97c5a4b9c105e64646762ad4fc3f5128e6f5	v2.2.5
setup-buildx-action	8d2750c68a42422c14e847fe6c8ac0403b4cbd6f	v3.12.0
build-push-action	10e90e3645eae34f1e60eeb005ba3a3d33f178e8	v6.19.2
deploy-cloudrun	251330ba9a8a34bfbc1622895f42e1d53fd14522	v2.7.6

Test plan

• Static deploy path — existing callers unaffected (no cloudrun-service or cloudrun-job passed)
• Cloud Run service path — cloudrun-service set, job/scheduler steps skipped
• Cloud Run job path — cloudrun-job set, service step skipped, scheduler created if scheduler-name set
• Cloud Run job path without scheduler — scheduler-name omitted, scheduler step skipped cleanly
• GHCR pull+retag path — ghcr-image set, no Dockerfile required

🤖 Generated with Claude Code

[tarpanpathak]

Hey @gamechanger1s — I pushed three commits to this branch addressing review feedback. Could you run a verification matrix against your GCP project and report back?

What changed

• efc08dc — Renamed the two duplicate Configure Docker for Artifact Registry steps in actions/build to (build path) and (retag path), so the Actions UI doesn't show two same-named steps.
• 7f63caf — Four fixes to actions/deploy:
  1. New Validate Cloud Run inputs step fails fast with a clear error when image-name / gcp-region / gcp-project-id / gcp-repository are missing, or when scheduler-name is set without schedule-time.
  2. Format env vars for Cloud Run always sets GOOGLE_CLOUD_PROJECT in Cloud Run mode (was previously only set when a secret was configured, contradicting the README contract).
  3. env_vars is now newline-delimited multiline instead of comma-separated, so secret values containing commas don't break the deploy.
  4. Cloud Scheduler step now reconciles (update http when it exists, create http when it doesn't) instead of being create-only. Renamed Create Cloud Scheduler → Reconcile Cloud Scheduler.
• f7cf85c — README updated to match the reconcile behavior.

Please verify on a real GCP target

Tick each as it passes — these gate moving the v2 tag.

• Static build + deploy (existing static-site repo, e.g. fajardo-trucking/frontend-web) still works unchanged.
• Docker build + push (set image-name on build, run a fresh image push).
• GHCR pull + retag (set ghcr-image on build).
• Cloud Run service deploy with gcp-secret-name set — confirm the service receives GOOGLE_CLOUD_PROJECT plus the secret vars.
• Cloud Run service deploy without gcp-secret-name — confirm the service still receives GOOGLE_CLOUD_PROJECT and existing env vars aren't unexpectedly wiped by the overwrite strategy.
• Cloud Run job deploy with scheduler — first run creates the scheduler.
• Cloud Run job deploy with scheduler — second run with a changed schedule-time updates the existing scheduler (verify in console).
• Cloud Run deploy with no image-name — confirm the new validation step fails fast with the listed missing inputs.

Intentionally not changed (separate follow-ups if you want to file them):

• Cloud Scheduler URI still uses the v1 namespaces API path. Worth migrating to v2 but needs a live test.
• No action outputs exposed (image, revision, scheduler).
• No image-vulnerability scan step between push and deploy.

Ping me once the matrix is green and we can move the v2 tag.