I've implemented this pattern a bunch of times now - here's the version I've settled on for my datasette-auth0 plugin repository.
\nFor publishing to Cloud Run, it needs two GitHub Actions secrets to be configured: GCP_SA_EMAIL and GCP_SA_KEY.
See below for publishing to Vercel.
\nIn .github/workflows/test.yml:
name: Test\n\non: [push]\n\njobs:\n test:\n runs-on: ubuntu-latest\n strategy:\n matrix:\n python-version: [\"3.7\", \"3.8\", \"3.9\", \"3.10\"]\n steps:\n - uses: actions/checkout@v2\n - name: Set up Python ${{ matrix.python-version }}\n uses: actions/setup-python@v2\n with:\n python-version: ${{ matrix.python-version }}\n - uses: actions/cache@v2\n name: Configure pip caching\n with:\n path: ~/.cache/pip\n key: ${{ runner.os }}-pip-${{ hashFiles('**/setup.py') }}\n restore-keys: |\n ${{ runner.os }}-pip-\n - name: Install dependencies\n run: |\n pip install -e '.[test]'\n - name: Run tests\n run: |\n pytest\n deploy_demo:\n runs-on: ubuntu-latest\n needs: [test]\n if: github.ref == 'refs/heads/main'\n steps:\n - uses: actions/checkout@v2\n - name: Set up Python 3.10\n uses: actions/setup-python@v2\n with:\n python-version: \"3.10\"\n cache: pip\n cache-dependency-path: \"**/setup.py\"\n - name: Install datasette\n run: pip install datasette\n - name: Set up Cloud Run\n uses: google-github-actions/setup-gcloud@v0\n with:\n version: '275.0.0'\n service_account_email: ${{ secrets.GCP_SA_EMAIL }}\n service_account_key: ${{ secrets.GCP_SA_KEY }}\n - name: Deploy demo to Cloud Run\n env:\n CLIENT_SECRET: ${{ secrets.AUTH0_CLIENT_SECRET }}\n run: |-\n gcloud config set run/region us-central1\n gcloud config set project datasette-222320\n wget https://latest.datasette.io/fixtures.db\n datasette publish cloudrun fixtures.db \\\n --install https://github.com/simonw/datasette-auth0/archive/$GITHUB_SHA.zip \\\n --plugin-secret datasette-auth0 domain \"datasette.us.auth0.com\" \\\n --plugin-secret datasette-auth0 client_id \"n9eaHS0ckIsujoyZNZ1wVgcPevjAcAXn\" \\\n --plugin-secret datasette-auth0 client_secret \"$CLIENT_SECRET\" \\\n --about \"datasette-auth0\" \\\n --about_url \"https://datasette.io/plugins/datasette-auth0\" \\\n --service datasette-auth0-demoThe first job called test runs the Python tests in the repo. The second deploy_demo block is where things get interesting.
deploy_demo:\n runs-on: ubuntu-latest\n needs: [test]\n if: github.ref == 'refs/heads/main'The needs: [test] bit ensures this only runs if the tests pass first.
if: github.ref == 'refs/heads/main' causes the deploy to only run on pushes to the main branch.
The most interesting bit of the deploy command is this bit:
\ndatasette publish cloudrun fixtures.db \\\n--install https://github.com/simonw/datasette-auth0/archive/$GITHUB_SHA.zip \\\n...\n$GITHUB_SHA is the commit hash that triggered the wokrflow. The --install line there constructs a URL to the zip archive of that version from the GitHub repository - so that exact version will be treated as a plugin and installed as part of deploying the Datasette demo instance.
This example deploys to Vercel instead. The key difference is this:
\n - name: Install datasette\n run: pip install datasette datasette-publish-vercel\n - name: Deploy demo to Vercel\n env:\n VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n run: |-\n wget https://latest.datasette.io/fixtures.db\n datasette publish vercel fixtures.db \\\n --project datasette-hashed-urls \\\n --install https://github.com/simonw/datasette-hashed-urls/archive/$GITHUB_SHA.zip \\\n --token $VERCEL_TOKEN \\\n --scope datasetteThe --token $VERCEL_TOKEN passes a token created in the Vercel dashboard. I needed --scope datasette here because I was deploying to a Vercel team of that name - if deploying to your personal account you can leave this off.