From 68c46cde8119dc1645f5cd4fee75ead8fecc8f1d Mon Sep 17 00:00:00 2001
From: Talha Abdur Rahman <cooltalha27@gmail.com>
Date: Wed, 15 Jul 2026 22:53:29 +0530
Subject: [PATCH] CI/CD Workflow file Added (#909)

* CI/CD Workflow file Added

* Updated Tag & SA Key

* update input Tag

* fix: pass workflow inputs to shell via env to prevent command injection

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Rajat Ahuja <rahuja445@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/push-gcp-registry-prod.yml  | 56 +++++++++++++++++++
 .../workflows/push-gcp-registry-staging.yml   | 56 +++++++++++++++++++
 2 files changed, 112 insertions(+)
 create mode 100644 .github/workflows/push-gcp-registry-prod.yml
 create mode 100644 .github/workflows/push-gcp-registry-staging.yml

diff --git a/.github/workflows/push-gcp-registry-prod.yml b/.github/workflows/push-gcp-registry-prod.yml
new file mode 100644
index 00000000..d5d9fc42
--- /dev/null
+++ b/.github/workflows/push-gcp-registry-prod.yml
@@ -0,0 +1,56 @@
+name: Build and Push to GCP Artifact Registry (production)
+
+permissions:
+  contents: read
+
+on:
+  push:
+    tags:
+      - v*
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to deploy (without v prefix)"
+        required: true
+        type: string
+        default: "manual"
+
+env:
+  GCP_PROJECT_ID: ${{ secrets.PROD_GCP_PROJECT_ID }}
+  GCP_AR_LOCATION: ${{ secrets.PROD_GCP_AR_LOCATION }}
+  GCP_AR_REPO: ${{ secrets.PROD_GCP_AR_REPO }}
+  IMAGE_NAME: ${{ secrets.PROD_IMAGE_NAME }}
+  GCP_SA_KEY: ${{ secrets.PROD_GCP_SA_KEY }}
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Authenticate to GCP
+        uses: google-github-actions/auth@v2
+        with:
+          credentials_json: ${{ env.GCP_SA_KEY }}
+
+      - name: Set up Cloud SDK
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Configure Docker for Artifact Registry
+        run: gcloud auth configure-docker ${{ env.GCP_AR_LOCATION }}-docker.pkg.dev --quiet
+
+      - name: Build and push image
+        env:
+          VERSION: ${{ github.event.inputs.version }}
+        run: |
+          # Determine the image label based on trigger type
+          if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
+            IMAGE_LABEL="deployment-${VERSION}"
+          else
+            IMAGE_LABEL="deployment-${GITHUB_REF_NAME}"
+          fi
+          BASE="${{ env.GCP_AR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GCP_AR_REPO }}/${{ env.IMAGE_NAME }}"
+          TAG="$BASE:$IMAGE_LABEL"
+          docker build -t "$TAG" .
+          docker push "$TAG"
diff --git a/.github/workflows/push-gcp-registry-staging.yml b/.github/workflows/push-gcp-registry-staging.yml
new file mode 100644
index 00000000..f41a38de
--- /dev/null
+++ b/.github/workflows/push-gcp-registry-staging.yml
@@ -0,0 +1,56 @@
+name: Build and Push to GCP Artifact Registry (Staging)
+
+permissions:
+  contents: read
+
+on:
+  push:
+    tags:
+      - v*
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to deploy (without v prefix)"
+        required: true
+        type: string
+        default: "manual"
+
+env:
+  GCP_PROJECT_ID: ${{ secrets.STAGING_GCP_PROJECT_ID }}
+  GCP_AR_LOCATION: ${{ secrets.STAGING_GCP_AR_LOCATION }}
+  GCP_AR_REPO: ${{ secrets.STAGING_GCP_AR_REPO }}
+  IMAGE_NAME: ${{ secrets.STAGING_IMAGE_NAME }}
+  GCP_SA_KEY: ${{ secrets.STAGING_GCP_SA_KEY }}
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Authenticate to GCP
+        uses: google-github-actions/auth@v2
+        with:
+          credentials_json: ${{ env.GCP_SA_KEY }}
+
+      - name: Set up Cloud SDK
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Configure Docker for Artifact Registry
+        run: gcloud auth configure-docker ${{ env.GCP_AR_LOCATION }}-docker.pkg.dev --quiet
+
+      - name: Build and push image
+        env:
+          VERSION: ${{ github.event.inputs.version }}
+        run: |
+          # Determine the image label based on trigger type
+          if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
+            IMAGE_LABEL="deployment-${VERSION}"
+          else
+            IMAGE_LABEL="deployment-${GITHUB_REF_NAME}"
+          fi
+          BASE="${{ env.GCP_AR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GCP_AR_REPO }}/${{ env.IMAGE_NAME }}"
+          TAG="$BASE:$IMAGE_LABEL"
+          docker build -t "$TAG" .
+          docker push "$TAG"