Deploys your container image to Cloud Run and makes the URL available to later build steps via outputs.
- Prerequisites
- Usage
- Inputs
- Outputs
- Credentials
- Example Workflows
- Migrating from
setup-gcloud
- Contributing
- License
This action requires:
-
Google Cloud credentials that are authorized to deploy a Cloud Run service. See the Credentials below for more information.
- name: Deploy to Cloud Run
id: deploy
uses: google-github-actions/deploy-cloudrun@main
with:
service: hello-cloud-run
image: gcr.io/cloudrun/hello
credentials: ${{ secrets.GCP_SA_KEY }}
- name: Use Output
run: curl "${{ steps.deploy.outputs.url }}"
Name | Requirement | Default | Description |
---|---|---|---|
service |
Required if not using a service YAML via metadata input. |
ID of the service or fully qualified identifier for the service. | |
image |
Required if not using a service YAML via metadata input. |
Name of the container image to deploy (Example: gcr.io/cloudrun/hello:latest ). |
|
region |
optional | us-central1 |
Region in which the resource can be found. |
credentials |
Required if not using a the setup-gcloud action with exported credentials. |
Service account key to use for authentication. This should be the JSON formatted private key which can be exported from the Cloud Console. The value can be raw or base64-encoded. | |
env_vars |
optional | List of key-value pairs to set as environment variables in the format: KEY1=VALUE1,KEY2=VALUE2 . All existing environment variables will be retained. |
|
metadata |
optional | YAML service description for the Cloud Run service (service and image inputs will override YAML). See Metadata customizations for more information. Existing configuration will be retained besides container entrypoint and arguments. |
|
project_id |
optional | ID of the Google Cloud project. If provided, this will override the project configured by setup-gcloud . |
|
source |
optional | Deploy from source by specifying the source directory. The role Cloud Build Service Account is required. |
|
suffix |
optional | Specify the suffix of the revision name. Revision names always start with named 'helloworld', would lead to a revision named 'helloworld-v1'. | |
tag |
optional | Traffic tag to assign to the newly created revision. | |
no_traffic |
optional | false |
Set to true to avoid sending traffic to the revision being deployed. |
revision_traffic |
optional | Comma separated list of traffic assignments in the form REVISION-NAME=PERCENTAGE. | |
tag_traffic |
optional | Comma separated list of traffic assignments in the form TAG=PERCENTAGE. | |
flags |
optional | Space separated list of other Cloud Run flags, examples can be found: https://cloud.google.com/sdk/gcloud/reference/run/deploy#FLAGS. | |
gcloud_version |
optional | latest |
Pin the version of Cloud SDK gcloud CLI. |
You can store your service specification in a YAML file. This will allow for further service configuration, such as memory limits, CPU allocation, max instances, and more.
- See Deploying a new service to create a new YAML service definition, for example:
apiVersion: serving.knative.dev/v1
kind: Service
metadata:
name: SERVICE
spec:
template:
spec:
containers:
- image: IMAGE
- See Deploy a new revision of an existing service to generated a YAML service specification from an existing service:
gcloud run services describe SERVICE --format yaml > service.yaml
A Cloud Run product recommendation is that CI/CD systems not set or change settings for allowing unauthenticated invocations. New deployments are automatically private services, while deploying a revision of a public (unauthenticated) service will preserve the IAM setting of public (unauthenticated). For more information, see Controlling access on an individual service.
url
: The URL of your Cloud Run service.
There are a few ways to authenticate this action. A service account will be needed with the following roles:
- Cloud Run Admin (
roles/run.admin
):- Can create, update, and delete services.
- Can get and set IAM policies.
This service account needs to a member of the Compute Engine default service account
,
([email protected])
, with role
Service Account User
. To grant a user permissions for a service account, use
one of the methods found in Configuring Ownership and access to a service account.
You can provide credentials using the setup-gcloud action:
- uses: google-github-actions/setup-gcloud@master
with:
service_account_key: ${{ secrets.GCP_SA_KEY }}
export_default_credentials: true
- name: Deploy to Cloud Run
uses: google-github-actions/deploy-cloudrun@main
with:
image: gcr.io/cloudrun/hello
service: hello-cloud-run
You can provide Google Cloud Service Account JSON directly to the action
by specifying the credentials
input. First, create a GitHub
Secret that contains the JSON content, then import it into the
action:
- name: Deploy to Cloud Run
uses: google-github-actions/deploy-cloudrun@main
with:
credentials: ${{ secrets.GCP_SA_KEY }}
image: gcr.io/cloudrun/hello
service: hello-cloud-run
If you are hosting your own runners, and those runners are on Google Cloud, you can leverage the Application Default Credentials of the instance. This will authenticate requests as the service account attached to the instance. This only works using a custom runner hosted on GCP.
- name: Deploy to Cloud Run
uses: google-github-actions/deploy-cloudrun@main
with:
image: gcr.io/cloudrun/hello
service: hello-cloud-run
-
Create a new Google Cloud Project (or select an existing project).
-
Create a Google Cloud service account or select an existing one.
-
Add the the following [Cloud IAM roles][roles] to your service account:
-
Cloud Run Admin
- allows for the creation of new Cloud Run services -
Service Account User
- required to deploy to Cloud Run as service account -
Storage Admin
- allow push to Google Container Registry (this grants project level access, but recommend reducing this scope to bucket level permissions.)
-
-
Download a JSON service account key for the service account.
-
Add the following secrets to your repository's secrets:
-
GCP_PROJECT
: Google Cloud project ID -
GCP_SA_KEY
: the downloaded service account key
-
To run this workflow, push to the branch named example-deploy
:
git push YOUR-FORK main:example-deploy
To run this workflow, push to the branch named example-build-deploy
:
git push YOUR-FORK main:example-build-deploy
Reminder: If this is your first deployment of a service, it will reject all unauthenticated requests. Learn more at allowing unauthenticated requests
Example using setup-gcloud
:
- name: Setup Cloud SDK
uses: google-github-actions/[email protected]
with:
project_id: ${{ env.PROJECT_ID }}
service_account_key: ${{ secrets.GCP_SA_KEY }}
- name: Deploy to Cloud Run
run: |-
gcloud run deploy $SERVICE \
--region $REGION \
--image gcr.io/$PROJECT_ID/$SERVICE \
--platform managed \
--set-env-vars NAME="Hello World"
Migrated to deploy-cloudrun
:
- name: Deploy to Cloud Run
uses: google-github-actions/[email protected]
with:
service: ${{ env.SERVICE }}
image: gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE }}
region: ${{ env.REGION }}
credentials: ${{ secrets.GCP_SA_KEY }}
env_vars: NAME="Hello World"
Note: The action is for the "managed" platform and will not set access privileges such as allowing unauthenticated requests.
See CONTRIBUTING.
See LICENSE.