[souravC01]

Backend changes merged to main currently leave Cloud Run on its previous image, while the CI workflow can still call the obsolete Render deployment hook. This change replaces that hook with keyless, CI-gated deployment to the existing Cloud Run service. Vercel and the Render legacy redirect keep their current roles.

• Deploy only for main push events touching backend code, requirements, Dockerfile.cloudrun, or this workflow. Images use the commit SHA.
• Preserve existing CI jobs and add a Cloud Run Dockerfile build check. Queue main runs so later pushes do not cancel deployment work.
• Use a dedicated deployer with resource-scoped Artifact Registry Writer, Cloud Run Developer, and runtime Service Account User grants. Federation requires the exact numeric repository and owner IDs, repository name, main ref, push event, workflow path, and OIDC subject.
• Update only the Cloud Run image and verify production health through Vercel. Exclude generated credentials from Git and Docker contexts.

Validation completed locally: YAML parsing; actionlint 1.7.12 with only its unsupported concurrency queue key filtered, which is documented by current GitHub syntax; Bash syntax; 13 native Git change-detector scenarios; deployment-gate and permission assertions; zero-dash scan; git diff --check. Current production health returns ok, postgresql, and cloudflare_r2.

Both feature-push and PR GitHub CI runs passed, including 205 backend tests, frontend tests and production build, the existing Docker build, and the added Cloud Run Docker build. GitHub accepted the concurrency queue syntax. Deployment was correctly skipped on these non-main events.

The reviewed setup script has been applied in Cloud Shell. The provider is ACTIVE, all resource-scoped grants are present, and no user-managed service-account keys exist. The Cloud Run runtime specification is identical to its pre-setup snapshot. A private pre-deployment service configuration and IAM snapshot is saved in Cloud Shell for comparison after the first production run. No Render changes have been made.

The separate Vercel preview check failed with vite: command not found. Read-only inspection confirmed the project's Root Directory setting is empty, so the Git integration installs the repository-root Python dependencies instead of the frontend package. No frontend files changed in this PR. Root Directory has now been corrected to frontend. The replacement preview deployment CgfXQBD1nC3ZAe7t9mYukLKirVYY is Ready and the GitHub Vercel check passes. Production frontend and API health remain healthy.

After merge, verify the successful main deployment, expected image SHA and ready revision, unchanged runtime configuration and public access, and production health. The runbook in docs/cloud-run-cicd.md documents setup and image rollback.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
jobhelperguru	Ready	Preview	Sep 12, 2026 8:06am UTC