cloud-runlisted

# Cloud Run Deployment Standard Canonical path from a container image to a running GCP service: **Cloud Run** is the default deploy target for web apps, APIs, and ADK agents — serverless containers, scale-to-zero, per-request billing. The image comes from the [containerize skill](../containerize/SKILL.md) (`ko` for Go, Dockerfile for Python); this skill covers registry, identity, deploy, and CD. ## 1. Deployment Ladder 1. **`gcloud run deploy` (default)**: one command, ideal for a single service iterated from the CLI. 1. **Declarative manifest**: [service.yaml](references/service.yaml) applied with `gcloud run services replace` — reviewable in PRs once settings accumulate (scaling, secrets, resources). 1. **Full IaC**: `google_cloud_run_v2_service` in the [terraform-stack skill](../terraform-stack/SKILL.md) — when the service is one resource among many (domains, IAM, schedulers). ## 2. One-Time Project Setup ```bash gcloud services enable run.googleapis.com artifactregistry.googleapis.com iamcredentials.googleapis.com gcloud artifacts repositories create <slug> --repository-format=docker --location=<region> gcloud iam service-accounts create <slug>-runtime # runtime identity, least privilege ``` - **Runtime identity**: always deploy with a dedicated service account; grant it only what the app reads (e.g. `roles/secretmanager.secretAccessor` on specific secrets) — never run on the default compute SA. - **CI identity (keyless)**: create a Workload Identity Federation po