@google-cloud/cloud-run-mcp 1.10.0 → 1.12.0

package/lib/cloud-api/build.js

@@ -14,6 +14,8 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+import path from 'node:path';
+import fs from 'node:fs';
 import {
   getCloudBuildClient,
   getLoggingClient,
@@ -21,8 +23,16 @@ import {
   getBuildsClient,
 } from '../clients.js';
 import { callWithRetry } from './helpers.js';
-import { logAndProgress } from '../util/helpers.js';
+import {
+  logAndProgress,
+  calculateSourceFingerprint,
+  sanitizeCloudRunServiceName,
+} from '../util/helpers.js';
 import { checkCloudRunServiceExists } from './run.js';
+import { ensureArtifactRegistryRepoExists } from './registry.js';
+import { ensureStorageBucketExists, uploadToStorageBucket } from './storage.js';
+import { zipFiles } from '../util/archive.js';
+import { DEPLOYMENT_CONFIG } from '../deployment/constants.js';
 
 const DELAY_WAIT_FOR_BUILD_LOGS = 10000; // 10 seconds delay to allow logs to propagate
 const BUILD_LOGS_LINES_TO_FETCH = 100; // Number of log lines to fetch for build logs snippet
@@ -54,9 +64,11 @@ export async function triggerCloudBuild(
   targetImageUrl,
   hasDockerfile,
   accessToken,
-  progressCallback
+  progressCallback,
+  ingress
 ) {
-  const serviceName = targetImageUrl.split('/').pop().split(/[:@]/)[0];
+  const rawServiceName = targetImageUrl.split('/').pop().split(/[:@]/)[0];
+  const serviceName = sanitizeCloudRunServiceName(rawServiceName);
   const parent = `projects/${projectId}/locations/${location}`;
   const serviceFullName = `${parent}/services/${serviceName}`;
   const buildsClient = await getBuildsClient(projectId, accessToken);
@@ -78,6 +90,10 @@ export async function triggerCloudBuild(
     },
   };
 
+  if (ingress) {
+    servicePatch.ingress = ingress;
+  }
+
   try {
     if (serviceExists) {
       await logAndProgress(
@@ -123,36 +139,76 @@ export async function triggerCloudBuild(
     throw new Error(`Dry-run deployment failed: ${err.message}`);
   }
 
-  const request = {
-    parent: `projects/${projectId}/locations/${location}`,
-    storageSource: {
-      bucket: sourceBucketName,
-      object: sourceBlobName,
-    },
-    imageUri: targetImageUrl,
-    client: 'cloud-run-mcp',
-  };
+  let buildId;
+  let completedBuild;
+
   if (hasDockerfile) {
-    request.dockerBuild = {};
+    // Docker builds need manual control via v1 createBuild to enable BuildKit support.
+    // This resolves issues with advanced Dockerfile instructions like heredocs (RUN <<EOF).
+    const build = {
+      images: [targetImageUrl],
+      source: {
+        storageSource: {
+          bucket: sourceBucketName,
+          object: sourceBlobName,
+        },
+      },
+      steps: [
+        {
+          name: 'gcr.io/cloud-builders/docker',
+          args: ['build', '-t', targetImageUrl, '.'],
+          env: ['DOCKER_BUILDKIT=1'],
+        },
+      ],
+      options: {
+        logging: 'CLOUD_LOGGING_ONLY',
+      },
+    };
+
+    await logAndProgress(
+      `Initiating Cloud Build (BuildKit enabled) for gs://${sourceBucketName}/${sourceBlobName} in ${location}...`,
+      progressCallback
+    );
+
+    const [operation] = await callWithRetry(
+      () =>
+        cloudBuildClient.createBuild({
+          parent: `projects/${projectId}/locations/${location}`,
+          build,
+        }),
+      'cloudBuild.createBuild'
+    );
+    buildId = operation.metadata.build.id;
   } else {
-    request.buildpackBuild = {};
-  }
+    // For simple buildpacks, use the high-level submitBuild API if possible or if preferred for simplicity.
+    const request = {
+      parent: `projects/${projectId}/locations/${location}`,
+      storageSource: {
+        bucket: sourceBucketName,
+        object: sourceBlobName,
+      },
+      imageUri: targetImageUrl,
+      client: 'cloud-run-mcp',
+      buildpackBuild: {},
+    };
 
-  await logAndProgress(
-    `Initiating Cloud Build for gs://${sourceBucketName}/${sourceBlobName} in ${location}...`,
-    progressCallback
-  );
+    await logAndProgress(
+      `Initiating Cloud Build (Buildpacks) for gs://${sourceBucketName}/${sourceBlobName} in ${location}...`,
+      progressCallback
+    );
+
+    const [submitBuildResponse] = await callWithRetry(
+      () => buildsClient.submitBuild(request),
+      'builds.submitBuild'
+    );
+    const encodedBuildId = submitBuildResponse.buildOperation.name
+      .split('/')
+      .pop();
+    buildId = Buffer.from(encodedBuildId, 'base64').toString('ascii');
+  }
 
-  const [submitBuildResponse] = await callWithRetry(
-    () => buildsClient.submitBuild(request),
-    'builds.submitBuild'
-  );
   await logAndProgress(`Cloud Build job started...`, progressCallback);
-  const encodedBuildId = submitBuildResponse.buildOperation.name
-    .split('/')
-    .pop();
-  const buildId = Buffer.from(encodedBuildId, 'base64').toString('ascii');
-  let completedBuild;
+
   while (true) {
     const [getBuildOperation] = await callWithRetry(
       () =>
@@ -247,3 +303,111 @@ export async function triggerCloudBuild(
     throw new Error(`Build ${buildId} failed.${buildLogsSnippet}`);
   }
 }
+
+/**
+ * Build source for services defined in resourcesConfig.source_builds
+ * @param {*} resourcesConfig - resourcesConfig received from `run-compose resource` call
+ * @param {*} accessToken - access token for authentication
+ * @param {*} projectId - GCP project id
+ * @param {*} region - GCP region
+ * @param {*} folderPath - Path to the folder containing the source code
+ * @param {*} progressCallback - Callback function to report progress
+ * @returns - Completed resourcesConfig object
+ */
+export async function composeBuild(
+  resourcesConfig,
+  accessToken,
+  projectId,
+  region,
+  folderPath,
+  progressCallback
+) {
+  if (
+    !resourcesConfig.source_builds ||
+    Object.keys(resourcesConfig.source_builds).length === 0
+  ) {
+    return resourcesConfig;
+  }
+
+  // Ensure AR Repo exists once
+  await ensureArtifactRegistryRepoExists(
+    projectId,
+    accessToken,
+    region,
+    DEPLOYMENT_CONFIG.REPO_NAME,
+    'DOCKER',
+    progressCallback
+  );
+
+  const bucketName = `${projectId}_cloudbuild`;
+
+  // Ensure Storage Bucket exists once
+  const bucket = await ensureStorageBucketExists(
+    projectId,
+    bucketName,
+    region,
+    accessToken,
+    undefined,
+    false,
+    progressCallback
+  );
+
+  const buildPromises = Object.entries(resourcesConfig.source_builds).map(
+    async ([serviceName, buildInfo]) => {
+      const contextDir = path.join(folderPath, buildInfo.context);
+      await logAndProgress(
+        `Building source for service ${serviceName} in ${contextDir}...`,
+        progressCallback
+      );
+
+      // Check for Dockerfile in context
+      const hasDockerfile = fs.existsSync(path.join(contextDir, 'Dockerfile'));
+
+      // Generate Fingerprint
+      const fingerprint = await calculateSourceFingerprint(contextDir);
+      const composeProject = resourcesConfig.project;
+
+      // Generate image URL
+      // Use format: {repo}/{project_name}_{container}:{tag} matching builder.py
+      const imageUrl = `${region}-docker.pkg.dev/${projectId}/${DEPLOYMENT_CONFIG.REPO_NAME}/${composeProject}_${serviceName}:${DEPLOYMENT_CONFIG.IMAGE_TAG}`;
+
+      // Create tar.gz archive in memory
+      const archiveBuffer = await zipFiles(
+        [contextDir],
+        true,
+        progressCallback
+      );
+      // Use format: {epoch}.{fingerprint}.tgz in source/ folder
+      const archiveName = `source/${Date.now()}.${fingerprint}.tgz`;
+
+      const file = await uploadToStorageBucket(
+        bucket,
+        archiveBuffer,
+        archiveName,
+        progressCallback
+      );
+
+      // Trigger build
+      const buildResult = await triggerCloudBuild(
+        projectId,
+        region,
+        bucket.name,
+        archiveName,
+        DEPLOYMENT_CONFIG.REPO_NAME,
+        imageUrl,
+        hasDockerfile,
+        accessToken,
+        progressCallback,
+        undefined
+      );
+
+      const builtImageUrl = buildResult.results.images[0].name;
+      // Update resourcesConfig with image_id
+      resourcesConfig.source_builds[serviceName].image_id = builtImageUrl;
+    }
+  );
+
+  await Promise.all(buildPromises);
+
+  return resourcesConfig;
+}

package/lib/cloud-api/run.js

@@ -23,6 +23,9 @@ import {
 import { callWithRetry, ensureApisEnabled } from './helpers.js';
 import { logAndProgress } from '../util/helpers.js';
 
+const INVOKER_ROLE = 'roles/run.invoker';
+const PUBLIC_MEMBER = 'allUsers';
+
 async function listCloudRunLocations(projectId, accessToken) {
   const listLocationsRequest = {
     name: `projects/${projectId}`,
@@ -255,3 +258,62 @@ export async function checkCloudRunServiceExists(
     throw error;
   }
 }
+
+/**
+ * Sets public access (allUsers) for a Cloud Run service by assigning the 'roles/run.invoker' role.
+ *
+ * @async
+ * @param {string} projectId - The Google Cloud project ID.
+ * @param {string} location - The Google Cloud region.
+ * @param {string} serviceId - The ID of the Cloud Run service.
+ * @param {string} accessToken - Access token for authentication.
+ * @param {function(object): void} [progressCallback] - Optional callback for progress updates.
+ * @returns {Promise<void>} A promise that resolves when the IAM policy is successfully set.
+ * @throws {Error} If there's an error setting the IAM policy.
+ */
+export async function setServicePublicAccess(
+  projectId,
+  location,
+  serviceId,
+  accessToken,
+  progressCallback
+) {
+  const runClient = await getRunClient(projectId, accessToken);
+  const resource = runClient.servicePath(projectId, location, serviceId);
+
+  try {
+    await logAndProgress(
+      `Setting public access for service ${serviceId}...`,
+      progressCallback
+    );
+    // For Cloud Run v2, we should use getIamPolicy then merge or just set.
+    // Given this is usually for fresh deployments or simple public services,
+    // we set it directly.
+    await callWithRetry(async () => {
+      const [policy] = await runClient.getIamPolicy({ resource });
+
+      // Find existing invoker binding or create a new one
+      let invokerBinding = policy.bindings.find((b) => b.role === INVOKER_ROLE);
+      if (!invokerBinding) {
+        invokerBinding = { role: INVOKER_ROLE, members: [] };
+        policy.bindings.push(invokerBinding);
+      }
+
+      // Add public member if not present
+      if (!invokerBinding.members.includes(PUBLIC_MEMBER)) {
+        invokerBinding.members.push(PUBLIC_MEMBER);
+      }
+
+      // Set the updated policy
+      await runClient.setIamPolicy({ resource, policy });
+    }, 'run.setIamPolicy');
+
+    await logAndProgress(
+      `Public access set successfully for service ${serviceId}.`,
+      progressCallback
+    );
+  } catch (error) {
+    console.error(`Error setting public access for ${serviceId}:`, error);
+    throw error;
+  }
+}

package/lib/cloud-api/secrets.js

@@ -0,0 +1,196 @@
+/*
+Copyright 2025 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { getSecretManagerClient } from '../clients.js';
+import { logAndProgress } from '../util/helpers.js';
+
+const SECRET_ACCESSOR_ROLE = 'roles/secretmanager.secretAccessor';
+
+/**
+ * Retrieves secret metadata.
+ * @param {string} projectId - GCP project ID.
+ * @param {string} secretName - Name of the secret.
+ * @param {string} accessToken - OAuth2 access token.
+ * @returns {Promise<Object|null>} Secret data or null if not found.
+ */
+export async function getSecret(projectId, secretName, accessToken) {
+  const secretManager = await getSecretManagerClient(projectId, accessToken);
+  try {
+    const [res] = await secretManager.getSecret({
+      name: `projects/${projectId}/secrets/${secretName}`,
+    });
+    return res;
+  } catch (err) {
+    if (err.code === 5) {
+      // NOT_FOUND in gRPC
+      return null;
+    }
+    throw err;
+  }
+}
+
+/**
+ * Creates a new secret in Secret Manager.
+ * @param {string} projectId - GCP project ID.
+ * @param {string} secretName - Name of the secret to create.
+ * @param {string} accessToken - OAuth2 access token.
+ * @param {Object.<string, string>} [labels] - Optional labels to apply to the secret.
+ * @param {Function} progressCallback - Progress reporting callback.
+ * @returns {Promise<Object>} The created secret.
+ */
+export async function createSecret(
+  projectId,
+  secretName,
+  accessToken,
+  labels,
+  progressCallback
+) {
+  const secretManager = await getSecretManagerClient(projectId, accessToken);
+  await logAndProgress(`Creating secret '${secretName}'...`, progressCallback);
+  const secret = {
+    replication: {
+      automatic: {},
+    },
+  };
+  if (labels) {
+    secret.labels = labels;
+  }
+  const [res] = await secretManager.createSecret({
+    parent: `projects/${projectId}`,
+    secretId: secretName,
+    secret: secret,
+  });
+  return res;
+}
+
+/**
+ * Adds a new version to an existing secret.
+ * @param {string} projectId - GCP project ID.
+ * @param {string} secretName - Name of the secret.
+ * @param {Buffer|string} content - Secret content.
+ * @param {string} accessToken - OAuth2 access token.
+ * @param {Function} progressCallback - Progress reporting callback.
+ * @returns {Promise<Object>} Information about the created version.
+ */
+export async function addSecretVersion(
+  projectId,
+  secretName,
+  content,
+  accessToken,
+  progressCallback
+) {
+  const secretManager = await getSecretManagerClient(projectId, accessToken);
+  await logAndProgress(
+    `Adding new version to secret '${secretName}'...`,
+    progressCallback
+  );
+
+  const payload = typeof content === 'string' ? Buffer.from(content) : content;
+
+  const [res] = await secretManager.addSecretVersion({
+    parent: `projects/${projectId}/secrets/${secretName}`,
+    payload: {
+      data: payload,
+    },
+  });
+  return res;
+}
+
+/**
+ * Gets the IAM policy for a secret.
+ * @param {string} projectId - GCP project ID.
+ * @param {string} secretName - Name of the secret.
+ * @param {string} accessToken - OAuth2 access token.
+ * @returns {Promise<Object>} The IAM policy.
+ */
+export async function getSecretIamPolicy(projectId, secretName, accessToken) {
+  const secretManager = await getSecretManagerClient(projectId, accessToken);
+  const [res] = await secretManager.getIamPolicy({
+    resource: `projects/${projectId}/secrets/${secretName}`,
+  });
+  return res;
+}
+
+/**
+ * Sets the IAM policy for a secret.
+ * @param {string} projectId - GCP project ID.
+ * @param {string} secretName - Name of the secret.
+ * @param {Object} policy - The IAM policy to set.
+ * @param {string} accessToken - OAuth2 access token.
+ * @param {Function} progressCallback - Progress reporting callback.
+ * @returns {Promise<Object>} Result of the policy update.
+ */
+export async function setSecretIamPolicy(
+  projectId,
+  secretName,
+  policy,
+  accessToken,
+  progressCallback
+) {
+  const secretManager = await getSecretManagerClient(projectId, accessToken);
+  await logAndProgress(
+    `Updating IAM policy for secret '${secretName}'...`,
+    progressCallback
+  );
+  const [res] = await secretManager.setIamPolicy({
+    resource: `projects/${projectId}/secrets/${secretName}`,
+    policy: policy,
+  });
+  return res;
+}
+
+/**
+ * Adds a role binding to a secret's IAM policy.
+ * @param {string} projectId - GCP project ID.
+ * @param {string} secretName - Name of the secret.
+ * @param {string} member - Member to add (e.g. 'serviceAccount:...').
+ * @param {string} accessToken - OAuth2 access token.
+ * @param {Function} progressCallback - Progress reporting callback.
+ * @returns {Promise<Object>} Final IAM policy.
+ */
+export async function addSecretAccessorBinding(
+  projectId,
+  secretName,
+  member,
+  accessToken,
+  progressCallback
+) {
+  const policy = await getSecretIamPolicy(projectId, secretName, accessToken);
+  const role = SECRET_ACCESSOR_ROLE;
+
+  policy.bindings = policy.bindings || [];
+  const binding = policy.bindings.find((b) => b.role === role);
+
+  if (binding) {
+    if (binding.members.includes(member)) {
+      return policy;
+    }
+    binding.members.push(member);
+  } else {
+    policy.bindings.push({
+      role: role,
+      members: [member],
+    });
+  }
+
+  return setSecretIamPolicy(
+    projectId,
+    secretName,
+    policy,
+    accessToken,
+    progressCallback
+  );
+}