One-Command CI/CD Deployment for ADK with GitHub Actions

Manual deployment procedures are error-prone and lead to inconsistent environments. A automated GitHub Actions workflow streamlines software delivery by running unit tests, executing evaluation quality gates, compiling Docker images, and deploying to Google Cloud Run—all triggered automatically upon a git push to main.

Complete GitHub Actions Workflow

Create .github/workflows/deploy.yml in your repository root with the following configuration:

name: Deploy ADK Agent Harness to Cloud Run

on:
  push:
    branches:
      - main

env:
  PROJECT_ID: "my-gcp-project-id"
  REGION: "us-central1"
  SERVICE_NAME: "adk-agent-harness"
  GAR_REPOSITORY: "agent-containers"

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Source Code
        uses: actions/checkout@v4

      - name: Set up Python & uv
        uses: astral-sh/setup-uv@v2
        with:
          python-version: "3.11"

      - name: Run Test & Eval Quality Gate
        run: |
          uv sync
          uv run python -m pytest tests/
          uv run python recipes/eval_pipeline.py

      - name: Google Cloud Authentication
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v2

      - name: Configure Docker for Artifact Registry
        run: |
          gcloud auth configure-docker ${{ env.REGION }}-docker.pkg.dev --quiet

      - name: Build and Push Docker Image
        run: |
          IMAGE_TAG="${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.GAR_REPOSITORY }}/${{ env.SERVICE_NAME }}:${{ github.sha }}"
          docker build -t $IMAGE_TAG .
          docker push $IMAGE_TAG
          echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_ENV

      - name: Deploy to Cloud Run
        run: |
          gcloud run deploy ${{ env.SERVICE_NAME }} \
            --image=${{ env.IMAGE_TAG }} \
            --region=${{ env.REGION }} \
            --platform=managed \
            --allow-unauthenticated \
            --set-env-vars="PROJECT_ID=${{ env.PROJECT_ID }}" \
            --set-secrets="DATABASE_URL=adk-db-url:latest,GEMINI_API_KEY=gemini-api-key:latest" \
            --min-instances=1 \
            --max-instances=10

Pipeline Stages Explained

1. Quality Gate & Evaluation

- name: Run Test & Eval Quality Gate
  run: |
    uv sync
    uv run python -m pytest tests/
    uv run python recipes/eval_pipeline.py

This stage executes unit tests alongside the evaluation pipeline script (recipes/eval_pipeline.py). If the trajectory pass rate drops below 100%, the process exits with a non-zero code, halting the pipeline prior to container compilation.

2. Google Cloud Authentication & Container Build

Google Cloud authentication uses a dedicated Service Account key (GCP_SA_KEY) stored securely in GitHub Secrets. The service account enforces minimum IAM permissions:

• Artifact Registry Writer: Grants permission to push Docker images.
• Cloud Run Developer / Admin: Grants permissions to update existing Cloud Run deployments.
• Secret Manager Accessor: Grants permission to bind runtime secrets.

3. Service Deployment

The deployment step deploys the container to Cloud Run with production configuration:

• Secret Injections: DATABASE_URL and GEMINI_API_KEY are mounted directly from Google Secret Manager.
• Minimum Warm Instances: --min-instances=1 keeps an active instance warm to eliminate cold-start latency for user requests.
• Maximum Instance Limit: --max-instances=10 caps horizontal scaling to maintain budget control.

Setup Prerequisites

Before enabling this continuous deployment workflow, complete the following setup steps:

1. GCP Service Account: Create a service account with Cloud Run Admin, Artifact Registry Writer, and Secret Manager Accessor roles.
2. GitHub Secret: Export the service account JSON key into a GitHub Secret named GCP_SA_KEY.
3. Secret Manager Entries: Add secrets in Google Secret Manager for adk-db-url and gemini-api-key.
4. Artifact Registry: Create an Artifact Registry Docker repository named agent-containers in target region.
5. Eval Pipeline Script: Ensure your evaluation pipeline script exists at recipes/eval_pipeline.py.

Customizing the Pipeline

• Database Session Storage: Adjust or remove secret bindings if using local session handlers during initial development.
• Region Customization: Modify the REGION environment variable to match your cloud project layout.
• Multi-Environment Delivery: Create environment-specific workflows targeting staging or prod branches.

Key Takeaway

Automating deployment through GitHub Actions eliminates manual operational mistakes while enforcing strict quality evaluation on every code push. If prompt modifications or code updates introduce quality regressions, the pipeline halts immediately before any code reaches production environments.