Continuously deploy from a repository

If you have source code or functions in a Git repository and want to automate builds and set up continuous deployments from a repository, you can use either Cloud Build or Developer Connect in the Cloud Run console.

When you set this up, Cloud Run uses a Cloud Build trigger, to automatically build and deploy your code whenever new commits are pushed to a given branch of a Git repository. The source repository information is displayed in the Google Cloud console for your service after you deploy to Cloud Run.

In the Cloud Run console:

• If you select Cloud Build, you can set up continuous deployments from GitHub. For an example, see the quickstart for creating a template repository and deploying continuously from git.

• If you select Developer Connect, you can set up continuous deployments from GitHub, GitLab, and Bitbucket repositories.

Alternatively, you can use Cloud Deploy to set up a continuous-delivery pipeline to deploy Cloud Run services to multiple environments.

Before you begin

• You either have a git repository with a Dockerfile or your codebase is written in one of the languages supported by Google Cloud's buildpacks.

• Enable the Cloud Build API.

  Roles required to enable APIs

  To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

  Enable the API

• If you select the Developer Connect option, enable the Developer Connect API:

  Enable the API

Required roles

To get the permissions that you need to deploy Cloud Run services from Git using Cloud Build or Developer Connect, ask your administrator to grant you the following IAM roles on your project:

• Artifact Registry Administrator (roles/artifactregistry.admin)
• Cloud Build Editor (roles/cloudbuild.builds.editor)
• Cloud Run Developer (roles/run.developer)
• Service Account User (roles/iam.serviceAccountUser)
• Service Usage Admin (roles/serviceusage.serviceUsageAdmin)

The service account running the build must have the following roles:

• Cloud Build Service Account (roles/cloudbuild.builds.builder)
• Cloud Run Admin (roles/run.admin)
• Service Account User (roles/iam.serviceAccountUser)
• If you select the Developer Connect option:
  • Developer Connect Read Token Accessor (roles/developerconnect.readTokenAccessor)
  • If you are connecting to GitLab or Bitbucket repositories: Secret Manager Secret Accessor (roles/secretmanager.secretAccessor)

For a list of IAM roles and permissions that are associated with Cloud Run, see Cloud Run IAM roles and Cloud Run IAM permissions. If your Cloud Run service interfaces with Google Cloud APIs, such as Cloud Client Libraries, see the service identity configuration guide. For more information about granting roles, see deployment permissions and manage access.

Set up continuous deployment from the Cloud Run console

The setup procedure varies slightly depending on whether you are setting up continuous deployment on a new service or on an existing service. Click the appropriate tab to learn more.

Set up with Cloud Build

In the Set up with Cloud Build pane:

1. Select a repository from the list. Note that it takes a few moments to load the list of repositories. Follow the prompt and click Next.