cloudbuild-cleanup.yaml

# Cloud Build configuration for cleaning up preview deployments
# This file defines the process for deleting branch-specific preview environments

# NOTE: Variable Escaping in Cloud Build
# In Cloud Build YAML files, bash variables must be escaped with `$$` to prevent Cloud Build from interpreting them as substitution variables:
#
# - Use `$$SERVICE_NAME` instead of `$SERVICE_NAME`
# - Use `$${VARIABLE}` instead of `${VARIABLE}` for bash variables
# - Cloud Build substitutions remain as `${_VARIABLE_NAME}`

substitutions:
  _AR_HOSTNAME: us-central1-docker.pkg.dev
  _AR_PROJECT_ID: mento-prod
  _AR_REPOSITORY: cloud-run-source-deploy
  _DEPLOY_REGION: us-central1
  _PLATFORM: managed
  _SERVICE_NAME_PREFIX: analytics-api-preview
  # The following will be provided by the trigger/command line
  _BRANCH_NAME: ${_BRANCH_NAME}
  _BRANCH_TAG: ${_BRANCH_TAG}

options:
  logging: CLOUD_LOGGING_ONLY
  substitutionOption: ALLOW_LOOSE

steps:
  # Step 1: Generate the service name from branch name
  - name: gcr.io/cloud-builders/gcloud
    id: generate-service-name
    entrypoint: bash
    args:
      - -c
      - |
        # Convert branch name to a safe service name (must match the logic in cloudbuild-preview.yaml)
        # Prefix 'analytics-api-preview-' is 22 chars, leaving 41 chars for branch name
        SAFE_BRANCH_NAME=$(echo "${_BRANCH_NAME}" | \
          sed 's/[^a-zA-Z0-9-]/-/g' | \
          tr '[:upper:]' '[:lower:]' | \
          sed 's/^-//;s/-$//' | \
          sed 's/--*/-/g' | \
          cut -c1-41)

        # Create the full service name
        SERVICE_NAME="${_SERVICE_NAME_PREFIX}-$${SAFE_BRANCH_NAME}"

        # Save for later steps
        echo "$$SERVICE_NAME" > /workspace/service_name.txt
        echo "Service to delete: $$SERVICE_NAME"

  # Step 2: Delete the Cloud Run service
  - name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    id: delete-service
    entrypoint: bash
    args:
      - -c
      - |
        SERVICE_NAME=$(cat /workspace/service_name.txt)

        # Check if service exists
        if gcloud run services describe "$$SERVICE_NAME" \
          --platform=${_PLATFORM} \
          --region=${_DEPLOY_REGION} \
          --project=${_AR_PROJECT_ID} >/dev/null 2>&1; then
          
          echo "Deleting preview service: $$SERVICE_NAME"
          
          gcloud run services delete "$$SERVICE_NAME" \
            --platform=${_PLATFORM} \
            --region=${_DEPLOY_REGION} \
            --project=${_AR_PROJECT_ID} \
            --quiet
          
          echo "Successfully deleted preview service: $$SERVICE_NAME"
        else
          echo "Preview service not found: $$SERVICE_NAME (may have been already deleted)"
        fi

  # Step 3: Clean up old container images (optional, helps manage storage costs)
  - name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    id: cleanup-images
    entrypoint: bash
    args:
      - -c
      - |
        # CRITICAL: Only clean up preview images, never touch production images or 'latest' tag
        # All images (production and preview) are stored in the same repository: mento-analytics-api
        # Preview images are tagged with pattern: ${_BRANCH_TAG}-${_SHORT_SHA}
        # Production images use commit SHA tags and the 'latest' tag

        echo "Cleaning up old preview images for branch: ${_BRANCH_NAME} (tag prefix: ${_BRANCH_TAG})"
        echo "IMPORTANT: Only cleaning preview images, preserving production 'latest' tag"

        # List preview images for this branch (keep only the last 3)
        # Preview images are stored in the analytics-api-preview repository
        IMAGES=$$(gcloud artifacts docker images list \
          ${_AR_HOSTNAME}/${_AR_PROJECT_ID}/${_AR_REPOSITORY}/${_SERVICE_NAME_PREFIX} \
          --include-tags \
          --filter="tags:${_BRANCH_TAG}-*" \
          --format="get(digest)" \
          --sort-by="~timestamp" | tail -n +4)

        if [ ! -z "$$IMAGES" ]; then
          echo "Found old preview images to clean up for branch: ${_BRANCH_NAME}"
          for IMAGE in $$IMAGES; do
            echo "Deleting preview image: $$IMAGE"
            gcloud artifacts docker images delete \
              "${_AR_HOSTNAME}/${_AR_PROJECT_ID}/${_AR_REPOSITORY}/${_SERVICE_NAME_PREFIX}-api-preview@$$IMAGE" \
              --quiet || true
          done
          echo "Preview image cleanup completed for branch: ${_BRANCH_NAME}"
        else
          echo "No old preview images to clean up for branch: ${_BRANCH_NAME} (tag prefix: ${_BRANCH_TAG})"
        fi

        # Verify we haven't touched production images
        echo "Verifying production 'latest' tag is still intact..."
        if gcloud artifacts docker images list \
          ${_AR_HOSTNAME}/${_AR_PROJECT_ID}/${_AR_REPOSITORY}/mento-analytics-api \
          --include-tags \
          --filter="tags:latest" >/dev/null 2>&1; then
          echo "✅ Production 'latest' tag is safe and intact"
        else
          echo "❌ WARNING: Production 'latest' tag is missing!"
          exit 1
        fi

        # Verify preview 'latest' tag is still intact
        echo "Verifying preview 'latest' tag is still intact..."
        if gcloud artifacts docker images list \
          ${_AR_HOSTNAME}/${_AR_PROJECT_ID}/${_AR_REPOSITORY}/${_SERVICE_NAME_PREFIX} \
          --include-tags \
          --filter="tags:latest" >/dev/null 2>&1; then
          echo "✅ Preview 'latest' tag is safe and intact"
        else
          echo "❌ WARNING: Preview 'latest' tag is missing!"
          exit 1
        fi

# Tags for this build
tags:
  - preview-cleanup
  - ${_BRANCH_TAG}

timeout: 300s