From e41b2722d6dcf592ba101590d0a54af6a9be30a2 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 25 Mar 2026 23:02:58 +0000
Subject: [PATCH] ci: Add GitHub Actions workflow for GCE deployment

This commit adds a new GitHub Actions workflow file that builds the
Go backend binary and deploys it to a Google Compute Engine (GCE)
instance. It leverages Google Cloud Workload Identity Federation for
authentication and uses `gcloud compute scp` to copy the binary into
the target user's `~/.local/bin` directory, finally restarting the
`picoclaw` service via SSH.

Co-authored-by: TanLuong <28281768+TanLuong@users.noreply.github.com>
---
 .github/workflows/deploy-gce.yml | 66 ++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 .github/workflows/deploy-gce.yml

diff --git a/.github/workflows/deploy-gce.yml b/.github/workflows/deploy-gce.yml
new file mode 100644
index 000000000..80fa2b4b9
--- /dev/null
+++ b/.github/workflows/deploy-gce.yml
@@ -0,0 +1,66 @@
+name: Build and Deploy to GCE
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: 'read'
+      id-token: 'write' # Required for Workload Identity Federation
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libolm-dev
+
+      - name: Build Go backend
+        run: make build
+
+      - name: Determine binary name
+        id: binary
+        run: |
+          # The Makefile outputs a binary named picoclaw-linux-amd64
+          echo "path=build/picoclaw-linux-amd64" >> $GITHUB_OUTPUT
+
+      - id: 'auth'
+        name: 'Authenticate to Google Cloud'
+        uses: 'google-github-actions/auth@v2'
+        with:
+          workload_identity_provider: '${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}'
+          service_account: '${{ secrets.GCP_SERVICE_ACCOUNT }}'
+
+      - name: 'Set up Cloud SDK'
+        uses: 'google-github-actions/setup-gcloud@v2'
+
+      - name: 'Deploy binary to GCE'
+        run: |
+          # Ensure ~/.local/bin exists
+          gcloud compute ssh ${{ secrets.GCE_INSTANCE }} \
+            --zone=${{ secrets.GCE_ZONE }} \
+            --project=${{ secrets.GCP_PROJECT_ID }} \
+            --command="mkdir -p ~/.local/bin"
+
+          # Copy the binary to the instance
+          gcloud compute scp ${{ steps.binary.outputs.path }} ${{ secrets.GCE_INSTANCE }}:~/.local/bin/picoclaw \
+            --zone=${{ secrets.GCE_ZONE }} \
+            --project=${{ secrets.GCP_PROJECT_ID }}
+
+          # Make it executable and restart the service
+          gcloud compute ssh ${{ secrets.GCE_INSTANCE }} \
+            --zone=${{ secrets.GCE_ZONE }} \
+            --project=${{ secrets.GCP_PROJECT_ID }} \
+            --command="chmod +x ~/.local/bin/picoclaw && sudo systemctl restart picoclaw"