feat(api): warehouse read API — games slice + gated deploy

.dockerignore

@@ -0,0 +1,19 @@
+# Keep secrets, local envs, caches, and dev-only trees out of built images.
+.git
+.github
+.venv
+credentials/
+.env
+.env.*
+!.env.example
+**/__pycache__/
+*.pyc
+.pytest_cache/
+.ruff_cache/
+.coverage
+logs/
+temp/
+tests/
+docs/
+*.egg-info/
+node_modules/

.github/workflows/deploy-warehouse-api.yml

@@ -0,0 +1,39 @@
+name: Deploy Warehouse API
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'services/warehouse_api/**'
+      - 'src/warehouse/**'
+      - 'config/cloudbuild.warehouse-api.yaml'
+      - 'config/bigquery.yaml'
+      - 'pyproject.toml'
+      - 'uv.lock'
+  workflow_dispatch:
+
+env:
+  GCP_PROJECT_ID: bgg-data-warehouse
+  GCP_REGION: us-central1
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Google Cloud Auth
+        uses: google-github-actions/auth@v2
+        with:
+          credentials_json: ${{ secrets.GCP_SA_KEY_BGG_DW }}
+
+      - name: Set up Cloud SDK
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Build and deploy (Cloud Build)
+        run: |
+          gcloud builds submit --config config/cloudbuild.warehouse-api.yaml \
+            --project=${GCP_PROJECT_ID}

config/bigquery.yaml

@@ -4,6 +4,8 @@ location: US
 datasets:
   core: core
   raw: raw
+  predictions: predictions
+  analytics: analytics
 
 refresh_policy:
   batch_size: 1000

config/cloudbuild.warehouse-api.yaml

@@ -0,0 +1,38 @@
+# Cloud Build config for the warehouse read API (bgg-warehouse-api Cloud Run *service*).
+# Invoked by .github/workflows/deploy-warehouse-api.yml via `gcloud builds submit`.
+# `gcloud run deploy` is create-or-update, so no describe/if branching is needed.
+# Gating (run.invoker) is NOT set here — it's an authoritative Terraform binding
+# (terraform/warehouse_api.tf), applied by the terraform.yml workflow.
+steps:
+  # Build the API image.
+  - name: 'gcr.io/cloud-builders/docker'
+    args:
+      - 'build'
+      - '-f'
+      - 'services/warehouse_api/Dockerfile'
+      - '-t'
+      - 'gcr.io/$PROJECT_ID/bgg-warehouse-api:latest'
+      - '.'
+
+  # Push it.
+  - name: 'gcr.io/cloud-builders/docker'
+    args: ['push', 'gcr.io/$PROJECT_ID/bgg-warehouse-api:latest']
+
+  # Deploy the Cloud Run service — gated (--no-allow-unauthenticated).
+  - name: 'gcr.io/cloud-builders/gcloud'
+    args:
+      - 'run'
+      - 'deploy'
+      - 'bgg-warehouse-api'
+      - '--image=gcr.io/$PROJECT_ID/bgg-warehouse-api:latest'
+      - '--region=us-central1'
+      - '--platform=managed'
+      - '--no-allow-unauthenticated'
+      - '--service-account=bgg-data-warehouse@$PROJECT_ID.iam.gserviceaccount.com'
+      - '--memory=1Gi'
+      - '--cpu=1'
+      - '--max-instances=5'
+      - '--port=8080'
+
+images:
+  - 'gcr.io/$PROJECT_ID/bgg-warehouse-api:latest'