Cloud Build (CI)¶

Tomoda uses Google Cloud Build to turn a git tag into two container images — one for the backend, one for the frontend — and push them to Artifact Registry. Cloud Build does not deploy. Deployment is a separate ArgoCD-driven step covered in Deployment.

There are two pipeline configs at the repository root:

Each runs independently, triggered by the same git tag.

Pipeline diagram¶

git tag vX.Y.Z
scripts/release.sh

↙ ↘

Cloud Build · parallel triggers

cloudbuild-backend.yaml

↓

tomoda-backend
:SHA · :TAG · :latest

cloudbuild-frontend.yaml

↓

tomoda-frontend
:SHA · :TAG · :latest

↓

Artifact Registry
asia-east1

↓

Argo CD
watches devops/ repo

Cloud Build stops at Artifact Registry — image promotion into GKE happens in the devops repo, not here.

What lives where¶

This page is the app-side view — the build args the application binaries depend on. The Cloud Build trigger config, GCP project setup, Artifact Registry policy, and BuildKit caching strategy live in the DevOps repo. See DevOps → Cloud Build for the infrastructure side.

Backend build args¶

The backend pipeline (cloudbuild-backend.yaml) passes two args to the Dockerfile so the binary can self-report:

Build arg	Source
`COMMIT_SHA`	Cloud Build `${SHORT_SHA}`
`VERSION`	Cloud Build `${TAG_NAME}` (the `vX.Y.Z` git tag)

These surface in GET /health and version logs.

Frontend build args (load-bearing)¶

The frontend pipeline (cloudbuild-frontend.yaml) bakes EXPO_PUBLIC_* env vars into the JS bundle at build time — they cannot be changed without a rebuild. Cloud Build passes them as --build-arg:

Build arg	What it sets
`EXPO_PUBLIC_API_URL`	Production API base URL (e.g. `https://api.tomoda.life/api/v1`)
`EXPO_PUBLIC_WS_URL`	Production WebSocket URL
`EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID`	Google OAuth web client ID
`EXPO_PUBLIC_GOOGLE_IOS_CLIENT_ID`	Google OAuth iOS client ID
`EXPO_PUBLIC_GOOGLE_ANDROID_CLIENT_ID`	Google OAuth Android client ID
`COMMIT_SHA` / `VERSION`	Surfaced as `EXPO_PUBLIC_COMMIT_SHA` / `EXPO_PUBLIC_APP_VERSION`

Values come from Cloud Build substitution variables set on the trigger (${_FRONTEND_API_URL} etc.). Anything prefixed EXPO_PUBLIC_ is shipped to clients — see Secrets.

Release flow¶

The convenience script scripts/release.sh bumps backend/VERSION + frontend/VERSION, commits, tags vMAJOR.MINOR.PATCH, and pushes. The tag push fires both Cloud Build triggers. See Deployment for what happens next.

What Cloud Build does NOT do¶

It does not update Kubernetes manifests, run kubectl apply, or touch the cluster. Image promotion to GKE is handled by Argo CD Image Updater watching the devops/ repo — see Deployment.