Deployment

Overview

Target	Trigger	Pipeline
Cloud Run (staging)	Push to main	.github/workflows/deploy.yml
Cloud Run (production)	Manual dispatch with release tag	.github/workflows/deploy.yml
Cloudflare Pages	Push to main	.github/workflows/cloudflare-pages.yml
Kotlin SDK (Maven)	GitHub release	.github/workflows/sdk-publish.yml
TypeScript SDK (npm)	GitHub release	.github/workflows/sdk-npm-publish.yml

Cloud Run Deployment Flow

1. Build: Bazel builds OCI images for all 7 services
2. Push: Images pushed to Artifact Registry (us-east1-docker.pkg.dev/pinpoint-gateway/gateway/{service}:{tag})
3. Deploy: gcloud run deploy to Cloud Run with appropriate env vars and secrets

Image Tagging

Environment	Tag	Example
Staging	dev	gateway-processing:dev
Production	Release tag	gateway-processing:v0.0.3

CRITICAL: Production must use a pinned immutable release tag. Never use latest or dev for production.

Cloud Run Services

Staging and production use the same service names; the environment is distinguished by GCP project (peakgateway-staging vs pinpoint-gateway), not by a -staging name suffix.

Service	Name (both projects)
auth	gateway-auth
processing	gateway-processing
management	gateway-management
online-txn	gateway-online-txn
card-present	gateway-card-present
merchant-onboarding	gateway-merchant-onboarding
status	gateway-status

Region: us-east1. Staging project: peakgateway-staging; production project: pinpoint-gateway. Container images for both environments live in pinpoint-gateway's Artifact Registry (staging pulls cross-project).

Scaling Configuration

Terraform defines Cloud Run scaling in infra/tf/gcp/variables.tf and applies it from infra/tf/gcp/modules/cloud-run/main.tf:

Setting	Staging	Production
Min instances	1 for management, online-txn, and processing; otherwise 0	1 for warm services; otherwise 0
Max instances	5	Per-service overrides: auth/management/online-txn 30, card-present/processing 20, merchant-onboarding/status 10
CPU	1	1
Memory	2Gi	2Gi

Checking Deployment Status

# List Cloud Run revisions (staging; use --project=pinpoint-gateway for prod)
gcloud run revisions list --service=gateway-processing --region=us-east1 --project=peakgateway-staging

# View logs
gcloud logging read 'resource.labels.service_name="gateway-processing"' --project=peakgateway-staging --limit=20 --format='value(jsonPayload.message)'

# Check a public health route. Processing is internal-only and has no public LB route.
curl https://staging-api.peakgateway.co/status/health

Website Deployment

Websites deploy to Cloudflare Pages automatically on push to main:

Website	Production URL	Staging URL
Portal	portal.peakgateway.co	staging-portal.peakgateway.co
Checkout	checkout.peakgateway.co	staging-checkout.peakgateway.co
Merchant Portal	merchant.peakgateway.co	staging-merchant.peakgateway.co
Marketing	peakgateway.co	staging.peakgateway.co
Docs	docs.peakgateway.co	N/A
Support Docs	support-docs.peakgateway.co	N/A

Infrastructure Changes

Terraform manages all GCP infrastructure:

cd infra/tf/gcp
terraform plan    # Review changes
terraform apply   # Apply (requires approval)

State is stored in Terraform Cloud (org: peaksystems, workspace: gateway).

Maintenance

Cleaning old Cloud Run revisions

# Dry run (default)
./infra/scripts/cleanup-cloud-run-revisions.sh \
  --project pinpoint-gateway \
  --region us-east1 \
  --all-services \
  --keep 3

# Apply
./infra/scripts/cleanup-cloud-run-revisions.sh \
  --project pinpoint-gateway \
  --region us-east1 \
  --all-services \
  --keep 3 \
  --apply

This runs automatically hourly via .github/workflows/infra-maintenance.yml.

CI/CD Pipelines

Workflow	Trigger	Purpose
ci.yml	PR, push to main	Build + test all services/libs
deploy.yml	Push to main, release, manual	Build, push, deploy to Cloud Run
cloudflare-pages.yml	Push to main	Build + deploy all websites
pre-commit.yml	PR	Linting, formatting checks
iac-security.yml	infra/** changes	Checkov + Terraform validation
infra-maintenance.yml	Hourly	Clean old revisions + artifacts
sdk-publish.yml	GitHub release	Publish Kotlin SDK to Maven
sdk-npm-publish.yml	GitHub release	Publish TypeScript SDK to npm