Self-Hosted Preview Environments with GitHub Actions + Docker

# syntax=docker/dockerfile:1.6
#
# Multi-stage Dockerfile for a Next.js app using the standalone output mode.
#
# Requires `output: 'standalone'` in next.config.js. With that set, Next.js
# emits a self-contained server under .next/standalone that bundles only the
# runtime dependencies actually used, so the final image stays small.

# ---------- deps ----------
FROM node:20-alpine AS deps
WORKDIR /app

# Install system packages that some Node native modules need during install.
RUN apk add --no-cache libc6-compat

COPY package.json package-lock.json* ./
RUN npm ci

# ---------- builder ----------
FROM node:20-alpine AS builder
WORKDIR /app

ENV NEXT_TELEMETRY_DISABLED=1

COPY --from=deps /app/node_modules ./node_modules
COPY . .

RUN npm run build

# ---------- runner ----------
FROM node:20-alpine AS runner
WORKDIR /app

ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1
ENV PORT=3000
ENV HOSTNAME=0.0.0.0

# Non-root runtime user for a smaller blast radius.
RUN addgroup --system --gid 1001 nodejs \
 && adduser  --system --uid 1001 nextjs

# Public assets and the standalone server bundle.
COPY --from=builder /app/public ./public
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static

USER nextjs

EXPOSE 3000

# The standalone output generates a server.js at the image root.
CMD ["node", "server.js"]

# Version control
.git
.gitignore
.gitattributes

# Dependencies (re-installed inside the image)
node_modules
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*

# Next.js build artifacts (rebuilt inside the image)
.next
out
dist
build

# Environment files (never bake secrets into images)
.env
.env.*
!.env.example

# Tests and fixtures (not needed at runtime)
tests
__tests__
e2e
playwright-report
test-results
coverage

# Docs and meta (not needed at runtime)
README.md
CHANGELOG.md
LICENSE
docs

# Editor / OS noise
.vscode
.idea
.DS_Store
*.swp
*.swo

# CI config (the runner doesn't need these)
.github
.gitlab-ci.yml

# Local tooling
.eslintcache
.turbo

#!/usr/bin/env bash
#
# deploy-aws.sh — Deploy (or update) a preview environment on AWS ECS.
#
# Required env vars:
#   PR_NUMBER      Pull request number (e.g. 1234)
#   IMAGE_TAG      Fully qualified image reference, e.g.
#                  123456789012.dkr.ecr.us-east-1.amazonaws.com/app:pr-1234
#   CLUSTER_NAME   ECS cluster name (default: previews)
#   AWS_REGION     AWS region (default: us-east-1)
#   TASK_ROLE_ARN  IAM role ARN the task assumes
#   EXEC_ROLE_ARN  IAM role ARN ECS uses to pull the image / write logs
#   SUBNETS        Comma-separated private subnet IDs for the ENI
#   SECURITY_GROUPS Comma-separated security group IDs for the ENI
#   CONTAINER_PORT Port the container listens on (default: 3000)
#   PREVIEW_DOMAIN Base preview domain (default: preview.example.com)
#
# Outputs (stdout):
#   preview_url=<https url the ALB routes to this service>
#
# The script registers a new task definition, creates or updates the service,
# and blocks until ECS reports the service as stable.

set -euo pipefail

: "${PR_NUMBER:?PR_NUMBER is required}"
: "${IMAGE_TAG:?IMAGE_TAG is required}"
: "${TASK_ROLE_ARN:?TASK_ROLE_ARN is required}"
: "${EXEC_ROLE_ARN:?EXEC_ROLE_ARN is required}"
: "${SUBNETS:?SUBNETS (comma-separated subnet ids) is required}"
: "${SECURITY_GROUPS:?SECURITY_GROUPS (comma-separated sg ids) is required}"

CLUSTER_NAME="${CLUSTER_NAME:-previews}"
AWS_REGION="${AWS_REGION:-us-east-1}"
CONTAINER_PORT="${CONTAINER_PORT:-3000}"
PREVIEW_DOMAIN="${PREVIEW_DOMAIN:-preview.example.com}"

FAMILY="preview-pr-${PR_NUMBER}"
SERVICE_NAME="preview-pr-${PR_NUMBER}"
LOG_GROUP="/ecs/${FAMILY}"

echo ">> Ensuring CloudWatch log group ${LOG_GROUP} exists"
aws logs create-log-group \
  --log-group-name "${LOG_GROUP}" \
  --region "${AWS_REGION}" 2>/dev/null || true

echo ">> Registering task definition ${FAMILY}"
TASK_DEF_JSON=$(cat <<JSON
{
  "family": "${FAMILY}",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "512",
  "memory": "1024",
  "executionRoleArn": "${EXEC_ROLE_ARN}",
  "taskRoleArn": "${TASK_ROLE_ARN}",
  "containerDefinitions": [
    {
      "name": "app",
      "image": "${IMAGE_TAG}",
      "essential": true,
      "portMappings": [
        { "containerPort": ${CONTAINER_PORT}, "protocol": "tcp" }
      ],
      "environment": [
        { "name": "NODE_ENV", "value": "production" },
        { "name": "PR_NUMBER", "value": "${PR_NUMBER}" }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "${LOG_GROUP}",
          "awslogs-region": "${AWS_REGION}",
          "awslogs-stream-prefix": "ecs"
        }
      }
    }
  ]
}
JSON
)

TASK_DEF_ARN=$(aws ecs register-task-definition \
  --region "${AWS_REGION}" \
  --cli-input-json "${TASK_DEF_JSON}" \
  --query 'taskDefinition.taskDefinitionArn' \
  --output text)

echo ">> Registered ${TASK_DEF_ARN}"

# Build the awsvpc network configuration from the comma-separated inputs.
NETWORK_CONFIG=$(cat <<JSON
{
  "awsvpcConfiguration": {
    "subnets": [$(echo "\"${SUBNETS}\"" | sed 's/,/","/g')],
    "securityGroups": [$(echo "\"${SECURITY_GROUPS}\"" | sed 's/,/","/g')],
    "assignPublicIp": "DISABLED"
  }
}
JSON
)

# Create the service if it doesn't exist; otherwise update it.
EXISTING=$(aws ecs describe-services \
  --region "${AWS_REGION}" \
  --cluster "${CLUSTER_NAME}" \
  --services "${SERVICE_NAME}" \
  --query 'services[?status==`ACTIVE`] | length(@)' \
  --output text)

if [ "${EXISTING}" = "0" ]; then
  echo ">> Creating ECS service ${SERVICE_NAME} in cluster ${CLUSTER_NAME}"
  aws ecs create-service \
    --region "${AWS_REGION}" \
    --cluster "${CLUSTER_NAME}" \
    --service-name "${SERVICE_NAME}" \
    --task-definition "${TASK_DEF_ARN}" \
    --desired-count 1 \
    --launch-type FARGATE \
    --network-configuration "${NETWORK_CONFIG}" \
    --tags "key=preview,value=pr-${PR_NUMBER}" >/dev/null
else
  echo ">> Updating existing ECS service ${SERVICE_NAME}"
  aws ecs update-service \
    --region "${AWS_REGION}" \
    --cluster "${CLUSTER_NAME}" \
    --service "${SERVICE_NAME}" \
    --task-definition "${TASK_DEF_ARN}" \
    --desired-count 1 \
    --force-new-deployment >/dev/null
fi

echo ">> Waiting for service ${SERVICE_NAME} to reach a stable state"
aws ecs wait services-stable \
  --region "${AWS_REGION}" \
  --cluster "${CLUSTER_NAME}" \
  --services "${SERVICE_NAME}"

# The ALB in front of the cluster routes by Host header. A listener rule
# keyed to pr-${PR_NUMBER}.${PREVIEW_DOMAIN} should forward to the service's
# target group (provisioned once per preview by separate infra).
PREVIEW_URL="https://pr-${PR_NUMBER}.${PREVIEW_DOMAIN}"

echo ">> Preview ready: ${PREVIEW_URL}"
echo "preview_url=${PREVIEW_URL}"

#!/usr/bin/env bash
#
# deploy-gcp.sh — Deploy a preview environment to Google Cloud Run.
#
# Required env vars:
#   PR_NUMBER   Pull request number (e.g. 1234)
#   IMAGE       Fully qualified image, e.g.
#               us-central1-docker.pkg.dev/my-project/app/app:pr-1234
#   REGION      Cloud Run region (default: us-central1)
#   PROJECT_ID  GCP project id (optional; falls back to gcloud's default)
#
# Outputs (stdout):
#   preview_url=<https url assigned by Cloud Run>
#
# Idempotent: `gcloud run deploy` creates the service on first run and updates
# it on subsequent runs, so the same script works for `opened` and
# `synchronize` PR events.

set -euo pipefail

: "${PR_NUMBER:?PR_NUMBER is required}"
: "${IMAGE:?IMAGE is required}"

REGION="${REGION:-us-central1}"
SERVICE="preview-pr-${PR_NUMBER}"

PROJECT_FLAG=()
if [ -n "${PROJECT_ID:-}" ]; then
  PROJECT_FLAG=(--project "${PROJECT_ID}")
fi

echo ">> Deploying ${SERVICE} to Cloud Run (${REGION})"
gcloud run deploy "${SERVICE}" \
  "${PROJECT_FLAG[@]}" \
  --image "${IMAGE}" \
  --region "${REGION}" \
  --platform managed \
  --allow-unauthenticated \
  --memory 512Mi \
  --cpu 1 \
  --port 3000 \
  --max-instances 2 \
  --set-env-vars "NODE_ENV=production,PR_NUMBER=${PR_NUMBER}" \
  --labels "preview=true,pr=${PR_NUMBER}" \
  --quiet

PREVIEW_URL=$(gcloud run services describe "${SERVICE}" \
  "${PROJECT_FLAG[@]}" \
  --region "${REGION}" \
  --format 'value(status.url)')

if [ -z "${PREVIEW_URL}" ]; then
  echo "ERROR: Cloud Run did not return a service URL for ${SERVICE}" >&2
  exit 1
fi

echo ">> Preview ready: ${PREVIEW_URL}"
echo "preview_url=${PREVIEW_URL}"

#!/usr/bin/env bash
#
# deploy-fly.sh — Deploy a preview environment to Fly.io.
#
# Required env vars:
#   PR_NUMBER    Pull request number (e.g. 1234)
#   IMAGE        Fully qualified image reference, e.g.
#                ghcr.io/my-org/app:pr-1234
#   FLY_ORG      Fly.io org slug (default: personal)
#   FLY_REGION   Primary region (default: iad)
#
# Requires the FLY_API_TOKEN env var (or a prior `flyctl auth login`).
#
# Outputs (stdout):
#   preview_url=https://preview-pr-<PR_NUMBER>.fly.dev

set -euo pipefail

: "${PR_NUMBER:?PR_NUMBER is required}"
: "${IMAGE:?IMAGE is required}"

FLY_ORG="${FLY_ORG:-personal}"
FLY_REGION="${FLY_REGION:-iad}"
APP_NAME="preview-pr-${PR_NUMBER}"

echo ">> Ensuring Fly app ${APP_NAME} exists (org=${FLY_ORG})"
if ! flyctl apps list --json | grep -q "\"Name\": *\"${APP_NAME}\""; then
  flyctl apps create "${APP_NAME}" --org "${FLY_ORG}"
else
  echo ">> App ${APP_NAME} already exists, reusing it"
fi

echo ">> Deploying image ${IMAGE} to ${APP_NAME}"
# --ha=false keeps one machine per region (plenty for a preview).
# --now skips the interactive confirmation on first deploy.
flyctl deploy \
  --app "${APP_NAME}" \
  --image "${IMAGE}" \
  --primary-region "${FLY_REGION}" \
  --ha=false \
  --now \
  --strategy immediate \
  --wait-timeout 300

PREVIEW_URL="https://${APP_NAME}.fly.dev"

echo ">> Preview ready: ${PREVIEW_URL}"
echo "preview_url=${PREVIEW_URL}"

name: preview-test-playwright

# Reusable workflow: run Playwright E2E tests against a preview URL.
#
# Call it from another workflow with:
#
#   jobs:
#     test:
#       uses: ./.github/workflows/preview-test-playwright.yml
#       with:
#         preview_url: ${{ needs.deploy.outputs.url }}

on:
  workflow_call:
    inputs:
      preview_url:
        description: Fully qualified URL of the preview environment
        required: true
        type: string
      health_path:
        description: Path to poll for readiness
        required: false
        type: string
        default: /
      health_timeout_seconds:
        description: Max seconds to wait for the preview to respond
        required: false
        type: number
        default: 180

jobs:
  playwright:
    name: Playwright (${{ inputs.preview_url }})
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Install Playwright browsers
        run: npx playwright install --with-deps chromium

      - name: Wait for preview to be reachable
        env:
          URL: ${{ inputs.preview_url }}${{ inputs.health_path }}
          TIMEOUT: ${{ inputs.health_timeout_seconds }}
        run: |
          echo "Polling ${URL} for up to ${TIMEOUT}s"
          deadline=$((SECONDS + TIMEOUT))
          until curl -fsS --max-time 5 -o /dev/null "${URL}"; do
            if [ "${SECONDS}" -ge "${deadline}" ]; then
              echo "Preview never became reachable within ${TIMEOUT}s" >&2
              exit 1
            fi
            echo "  not ready yet, retrying in 5s..."
            sleep 5
          done
          echo "Preview responded OK"

      - name: Run Playwright tests
        env:
          BASE_URL: ${{ inputs.preview_url }}
        run: npx playwright test

      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: playwright-report
          retention-days: 7
          if-no-files-found: ignore

name: preview-test-autonoma

# Reusable workflow: run an Autonoma test folder against a preview URL.
# Requires:
#   - repo/org variable AUTONOMA_FOLDER_ID
#   - repo/org secret  AUTONOMA_API_KEY

on:
  workflow_call:
    inputs:
      preview_url:
        description: Fully qualified URL of the preview environment
        required: true
        type: string

jobs:
  autonoma:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Autonoma folder
        run: |
          curl -fsS -X POST \
            "https://api.prod.autonoma.app/v1/run/folder/${{ vars.AUTONOMA_FOLDER_ID }}" \
            -H "Authorization: Bearer ${{ secrets.AUTONOMA_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{"base_url": "${{ inputs.preview_url }}"}'

#!/usr/bin/env bash
#
# teardown.sh — Destroy the preview environment for a given pull request on
# any of the five supported providers.
#
# Required env vars:
#   PR_NUMBER   Pull request number (e.g. 1234)
#   PROVIDER    One of: aws | gcp | fly | digitalocean | hetzner | all
#               Defaults to "all" which attempts each provider in sequence.
#
# Optional env vars:
#   CLUSTER_NAME   (aws) ECS cluster name (default: previews)
#   AWS_REGION     (aws) default: us-east-1
#   REGION         (gcp) Cloud Run region (default: us-central1)
#   PROJECT_ID     (gcp) optional project override
#
# Idempotency pattern
# -------------------
# Every provider call ends in `|| true`. This is deliberate: the script is
# called from the `closed` PR event, and a PR may be closed without ever
# having deployed (draft, CI failed, first push closed), so the resources we
# target may not exist. Treating "already deleted" as success keeps the job
# green and keeps teardown cheap to call repeatedly.

set -uo pipefail

: "${PR_NUMBER:?PR_NUMBER is required}"
PROVIDER="${PROVIDER:-all}"

APP_NAME="preview-pr-${PR_NUMBER}"

teardown_aws() {
  local cluster="${CLUSTER_NAME:-previews}"
  local region="${AWS_REGION:-us-east-1}"
  echo ">> [aws] Scaling ${APP_NAME} to 0 on cluster ${cluster}"
  aws ecs update-service \
    --region "${region}" \
    --cluster "${cluster}" \
    --service "${APP_NAME}" \
    --desired-count 0 >/dev/null 2>&1 || true

  echo ">> [aws] Deleting service ${APP_NAME}"
  aws ecs delete-service \
    --region "${region}" \
    --cluster "${cluster}" \
    --service "${APP_NAME}" \
    --force >/dev/null 2>&1 || true

  echo ">> [aws] Deregistering task definitions for family ${APP_NAME}"
  local arns
  arns=$(aws ecs list-task-definitions \
    --region "${region}" \
    --family-prefix "${APP_NAME}" \
    --query 'taskDefinitionArns' \
    --output text 2>/dev/null || true)
  for arn in ${arns}; do
    aws ecs deregister-task-definition \
      --region "${region}" \
      --task-definition "${arn}" >/dev/null 2>&1 || true
  done
}

teardown_gcp() {
  local region="${REGION:-us-central1}"
  local project_flag=()
  if [ -n "${PROJECT_ID:-}" ]; then
    project_flag=(--project "${PROJECT_ID}")
  fi
  echo ">> [gcp] Deleting Cloud Run service ${APP_NAME}"
  gcloud run services delete "${APP_NAME}" \
    "${project_flag[@]}" \
    --region "${region}" \
    --quiet 2>/dev/null || true
}

teardown_fly() {
  echo ">> [fly] Destroying Fly app ${APP_NAME}"
  flyctl apps destroy "${APP_NAME}" -y 2>/dev/null || true
}

teardown_digitalocean() {
  echo ">> [digitalocean] Looking up app id for ${APP_NAME}"
  local app_id
  app_id=$(doctl apps list --format ID,Spec.Name --no-header 2>/dev/null \
    | awk -v name="${APP_NAME}" '$2 == name {print $1}' \
    | head -n1 || true)
  if [ -n "${app_id}" ]; then
    echo ">> [digitalocean] Deleting app ${app_id}"
    doctl apps delete "${app_id}" --force 2>/dev/null || true
  else
    echo ">> [digitalocean] No app found for ${APP_NAME}, skipping"
  fi
}

teardown_hetzner() {
  echo ">> [hetzner] Deleting servers tagged pr=${PR_NUMBER}"
  # hcloud lists label selectors as `server list -l key=value`.
  local server_ids
  server_ids=$(hcloud server list \
    -l "preview=true,pr=${PR_NUMBER}" \
    -o columns=id -o noheader 2>/dev/null || true)
  for id in ${server_ids}; do
    hcloud server delete "${id}" 2>/dev/null || true
  done
}

case "${PROVIDER}" in
  aws)           teardown_aws ;;
  gcp)           teardown_gcp ;;
  fly)           teardown_fly ;;
  digitalocean)  teardown_digitalocean ;;
  hetzner)       teardown_hetzner ;;
  all)
    teardown_aws
    teardown_gcp
    teardown_fly
    teardown_digitalocean
    teardown_hetzner
    ;;
  *)
    echo "ERROR: unknown PROVIDER '${PROVIDER}'" >&2
    echo "Valid values: aws | gcp | fly | digitalocean | hetzner | all" >&2
    exit 2
    ;;
esac

echo ">> Teardown for PR ${PR_NUMBER} (${PROVIDER}) complete"

name: preview

# End-to-end preview pipeline for every pull request:
#   1. build  — build the app image and push to GHCR
#   2. deploy — roll the image to Cloud Run and post the URL as a PR comment
#   3. test   — run Autonoma against the preview URL
#   teardown — on PR close, destroy the preview environment
#
# This is the canonical workflow referenced by the blog post. Swap the
# `deploy` step for scripts/deploy-aws.sh or scripts/deploy-fly.sh to target
# a different cloud — the build, comment, and test shape stay identical.

on:
  pull_request:
    types: [opened, synchronize, reopened, closed]

concurrency:
  # One in-flight run per PR. Newer pushes cancel older deployments so we
  # don't ship a stale commit over a newer one.
  group: preview-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write       # push to GHCR
  pull-requests: write  # post the preview URL comment
  id-token: write       # OIDC for cloud providers

env:
  IMAGE_REPO: ghcr.io/${{ github.repository }}

jobs:
  # ---------------------------------------------------------------------------
  # build
  # ---------------------------------------------------------------------------
  build:
    if: github.event.action != 'closed'
    runs-on: ubuntu-latest
    outputs:
      image: ${{ steps.meta.outputs.image }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute image tag
        id: meta
        run: |
          IMAGE="${IMAGE_REPO}:pr-${{ github.event.pull_request.number }}"
          echo "image=${IMAGE}" >> "${GITHUB_OUTPUT}"

      - name: Build and push image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.image }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ---------------------------------------------------------------------------
  # deploy
  # ---------------------------------------------------------------------------
  deploy:
    if: github.event.action != 'closed'
    needs: build
    runs-on: ubuntu-latest
    outputs:
      url: ${{ steps.run.outputs.url }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v2

      - name: Deploy to Cloud Run
        id: run
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          IMAGE: ${{ needs.build.outputs.image }}
          PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
          REGION: us-central1
        run: |
          chmod +x scripts/deploy-gcp.sh
          OUTPUT=$(./scripts/deploy-gcp.sh | tee /dev/stderr)
          URL=$(echo "${OUTPUT}" | grep '^preview_url=' | tail -n1 | cut -d= -f2-)
          if [ -z "${URL}" ]; then
            echo "deploy-gcp.sh did not emit a preview_url line" >&2
            exit 1
          fi
          echo "url=${URL}" >> "${GITHUB_OUTPUT}"

      - name: Comment preview URL on PR
        uses: peter-evans/create-or-update-comment@v4
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body: |
            Preview deployed: ${{ steps.run.outputs.url }}

            Commit: `${{ github.event.pull_request.head.sha }}`
            Image:  `${{ needs.build.outputs.image }}`

  # ---------------------------------------------------------------------------
  # test
  # ---------------------------------------------------------------------------
  test:
    if: github.event.action != 'closed'
    needs: deploy
    uses: ./.github/workflows/preview-test-autonoma.yml
    with:
      preview_url: ${{ needs.deploy.outputs.url }}
    secrets: inherit

  # ---------------------------------------------------------------------------
  # teardown
  # ---------------------------------------------------------------------------
  teardown:
    if: github.event.action == 'closed'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v2

      - name: Destroy preview environment
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PROVIDER: gcp
          PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
          REGION: us-central1
        run: |
          chmod +x scripts/teardown.sh
          ./scripts/teardown.sh