Upgrade API deploy script

backend/api/deploy-api.sh

@@ -11,11 +11,14 @@
 
 set -e
 
+source ../../.env
+
 ENV=${1:-prod}
 
 # Config
 REGION="us-west1"
 ZONE="us-west1-b"
+
 PROJECT="compass-130ba"
 SERVICE_NAME="api"
 
@@ -25,7 +28,10 @@ IMAGE_TAG="${TIMESTAMP}-${GIT_REVISION}"
 IMAGE_URL="${REGION}-docker.pkg.dev/${PROJECT}/builds/${SERVICE_NAME}:${IMAGE_TAG}"
 
 echo "🚀 Deploying ${SERVICE_NAME} to ${ENV} ($(date "+%Y-%m-%d %I:%M:%S %p"))"
+yarn add tsconfig-paths
 yarn build
+
+gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin us-west1-docker.pkg.dev
 docker build . --tag ${IMAGE_URL} --platform linux/amd64
 echo "docker push ${IMAGE_URL}"
 docker push ${IMAGE_URL}
@@ -34,4 +40,16 @@ export TF_VAR_image_url=$IMAGE_URL
 export TF_VAR_env=$ENV
 tofu apply -auto-approve
 
+INSTANCE_NAME=$(gcloud compute instances list \
+  --filter="zone:(us-west1-c)" \
+  --sort-by="~creationTimestamp" \
+  --format="value(name)" \
+  --limit=1)
+SERVICE_ACCOUNT_EMAIL=$(gcloud compute instances describe ${INSTANCE_NAME} \
+  --zone us-west1-c \
+  --format="value(serviceAccounts.email)")
+gcloud projects add-iam-policy-binding ${PROJECT} \
+  --member="serviceAccount:$SERVICE_ACCOUNT_EMAIL" \
+  --role="roles/artifactregistry.reader"
+
 echo "✅ Deployment complete! Image: ${IMAGE_URL}"