The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →To deploy only what changed from an Nx monorepo to Cloud Run, make the pipeline do four separate jobs: calculate a trustworthy Git range, run Nx affected targets, build and publish only the resulting deployable projects, then authenticate to Google Cloud with GitHub’s OIDC token through Workload Identity Federation (WIF). Deploy each selected image to its Cloud Run service and verify the immutable revision and image digest. A shared library change can legitimately select several services, so “affected” means dependency-aware, not necessarily small.
The end-to-end shape
The safe design separates selection, validation, artifact publication, identity, and deployment. Nx decides which projects and tasks need attention; it does not deploy containers or authenticate to Google Cloud. Cloud Run receives a specific image reference and creates an immutable revision.
As an Amazon Associate I earn from qualifying purchases.
- Establish the comparison range. Check out enough history for Nx to identify the base and head commits.
- Select and validate work. Run the affected lint, test, build, and any repository-specific targets.
- Build and publish artifacts. Turn deployable projects into container images and push them to Artifact Registry.
- Federate the CI identity. Exchange GitHub’s OIDC assertion for short-lived Google Cloud credentials, restricted by repository and branch claims.
- Deploy and verify. Call
gcloud run deployfor each selected service, then record the resulting revision and digest and run smoke checks.
This ordering prevents a failed test from publishing or deploying an unvalidated image, and keeps the CI deployer separate from the identity used by the running application.
Make Nx’s affected set trustworthy
Give Nx a real Git base and head
Nx uses Git to find changed files, then uses the project graph to map those files to projects and their dependencies. A shallow checkout can omit the base commit or enough merge history, producing an empty, oversized, or unusable affected set. Nx’s GitHub Actions guidance uses a full checkout with fetch-depth: 0 and the nrwl/nx-set-shas@v5 action to establish the comparison SHAs. Follow that pattern, or set equivalent NX_BASE and NX_HEAD values yourself. See Nx’s GitHub integration guidance and its affected-task documentation.
#1 Best Overall
For pull requests, the base should represent the target branch’s merge point; for a release or main-branch deployment, use the last deployed commit or the previous successful range that your release policy defines. Do not silently compare every run with the current tip of the default branch: that changes the meaning of “changed” and can redeploy unrelated services.
Run the targets that gate deployment
A common starting command is:
npx nx affected -t lint test buildThose target names are an example, not a universal contract. Include the targets that your workspace requires before an image is published, such as integration tests or a production bundle. A project can be affected even when its own source file was untouched because it depends on a changed library or configuration file.
Understand project-based and task-based selection
Project-based affected selection is the usual choice when the project graph and target definitions describe your dependencies accurately. Nx also documents task-based selection when task inputs are modeled precisely; the legacy behavior can be disabled with NX_LEGACY_AFFECTED=false. Choose the mode that matches your workspace’s input declarations and validate it with representative dependency changes. A shared package change may correctly fan out to many applications, so do not add an unsafe “deploy only one” filter merely to shorten a run.
Do not confuse affected selection with Nx Cloud
Affected calculation works without Nx Cloud. Remote caching and distributed task execution can reduce runtime after selection, but they are optional layers. Treat cache configuration and deployment eligibility as separate decisions: a cache hit can satisfy a task while the pipeline still needs to publish the correct image for the selected project.
Map Nx projects to Cloud Run services deliberately
Nx can tell you which projects are affected; your repository must define which of those projects produce deployable containers and which Cloud Run service each image belongs to. Keep that mapping explicit in project configuration or a small, versioned manifest. Do not assume every affected library has an image, and do not deploy a service merely because a test project ran.
- Mark application projects that own a Dockerfile or another approved container build target.
- Associate each deployable project with one Artifact Registry image path and one Cloud Run service name.
- Decide whether a shared-library change should rebuild all dependent images; Nx’s graph normally says yes.
- Define environment-specific service names, regions, runtime service accounts, and invocation policy outside the change detector.
The exact project-to-image mapping, region, and release strategy are repository decisions. Verify them in the workspace and Google Cloud configuration before enabling an automatic deployment.
Build and publish traceable images
Google recommends Artifact Registry for Cloud Run container images. Build only the deployable projects selected by Nx, then push each image to the repository permitted for the deployment job. Use a unique, traceable tag such as a commit SHA for publishing convenience, and capture the digest returned by the registry. A mutable tag may later point elsewhere; the digest identifies the content that Cloud Run actually serves.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCloud Run resolves an image tag to a digest when you deploy. Google Cloud’s deployment documentation emphasizes that “revisions are immutable”: a revision continues serving the resolved image content even if the tag is moved later. Record the service, revision name, image URL, and digest in the workflow summary or release metadata. See Cloud Run deployment documentation.
Check image size as part of your build design. Cloud Run does not support container image layers larger than 9.9 GB for images deployed from Docker Hub or Artifact Registry remote repositories backed by an external registry. This is a product limit, not a performance benchmark; split oversized layers or publish from a supported Artifact Registry setup.
Configure Workload Identity Federation for GitHub Actions
Use OIDC instead of a long-lived key
GitHub Actions can issue an OIDC token for a job. A Google Cloud Workload Identity Pool provider validates that assertion and exchanges it for short-lived credentials, so the repository does not need a stored JSON service-account key. The Google Cloud deployment-pipeline guide describes the pool, provider, claim mapping, and IAM steps.
Grant id-token: write only to the job that performs the Google Cloud operation. A build-only job should not receive that permission. Configure the provider to map the claims you need, then add an attribute condition that admits only the intended GitHub identities. An organization and default-branch restriction can look like:
assertion.repository_owner=='ORG' && assertion.ref=='refs/heads/main'Replace the organization and branch with your values, and design separate conditions for pull-request validation, release tags, or production deployments. Restricting only the organization while allowing every branch may let an untrusted branch obtain deployment credentials; restricting only the branch may block the workflow that actually performs releases.
Choose direct federation or service-account impersonation
The Google authentication action documentation describes two authorization models:
| Model | Use it when | Important property |
|---|---|---|
| Direct federation | The target resource accepts federated principals and the action can obtain the required access directly. | No intermediate service account is required; the resulting token has a maximum 10-minute lifetime. |
| WIF with service-account impersonation | A service account is needed for OAuth access, ID tokens, or compatibility with a resource or tool. | Grant the federated principal permission to impersonate a dedicated service account, then use that identity for deployment. |
Provider setup and IAM grants can take up to five minutes to propagate. If a newly created provider fails briefly, wait for propagation and inspect the condition and bindings; do not weaken the trust rule to make an initial error disappear.
Grant the deployer only the permissions it needs
For a normal Cloud Run container deployment, Google identifies three distinct permissions areas. Apply them to the CI deployer identity at the narrowest practical resource scope:
| Permission area | Typical role | Where it applies |
|---|---|---|
| Deploy and update the service | roles/run.developer (Cloud Run Developer) |
The target Cloud Run service or project, according to your resource layout |
| Pull the image during deployment | roles/artifactregistry.reader (Artifact Registry Reader) |
The Artifact Registry repository containing the image |
| Attach the runtime identity | roles/iam.serviceAccountUser (Service Account User) |
The user-managed service account configured as the Cloud Run service identity |
Cross-project service accounts can require additional bindings. Check the Cloud Run IAM roles reference and the deployment project’s resource boundaries rather than granting broad project-owner access.
Keep runtime and deployer identities separate
The deployer identity calls Cloud Run and Artifact Registry APIs and is allowed to attach the runtime service account. The runtime identity is used by application code after the revision starts. Give that service account only the Google Cloud permissions the application needs, such as access to a particular data store or secret; it should not inherit CI deployment privileges. Google’s guidance on securing a Cloud Run service identity and configuring the identity explains this separation.
Deploy and verify the Cloud Run revision
Use an explicit image and service configuration
After authentication and image publication, deploy each selected service with the image reference and intended region. The core command is:
gcloud run deploy "$SERVICE"
--image "$IMAGE_URL"
--region "$REGION"
--service-account "$RUNTIME_SERVICE_ACCOUNT"Set the service, image URL, region, and runtime account from trusted workflow configuration, not from unreviewed pull-request input. If your release requires a specific project, provide it explicitly or set the authenticated CLI project in a controlled step.
Recommended Free Tools
Make invocation access an explicit decision
A public service grants the Cloud Run Invoker role to allUsers; an authenticated service requires callers to present an identity with the Invoker permission. Public versus authenticated invocation is a product and security decision, not a harmless deployment default. Select it intentionally in the service configuration and test the expected request path after deployment.
Best Value
Verify what Cloud Run actually serves
- Read the deployment result and record the new revision name.
- Inspect the revision’s resolved image digest, not only the mutable tag used by the build.
- Confirm the region, runtime service account, environment settings, and ingress or invocation policy.
- Run application-level smoke checks appropriate to the service, such as an authenticated health request or a representative endpoint call.
- Keep the commit SHA, image digest, and revision together so a rollback points to a known artifact.
Reference GitHub Actions flow
The following skeleton shows the order and trust boundaries. Adapt project names, image construction, and deployment fan-out to the repository; it is not a complete mapping for an unknown monorepo.
permissions:
contents: read
jobs:
affected-and-deploy:
permissions:
contents: read
id-token: write
steps:
- name: Check out full history
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set Nx SHAs
uses: nrwl/nx-set-shas@v5
- name: Install dependencies
run: npm ci
- name: Validate affected projects
run: npx nx affected -t lint test build
- name: Build and push selected images
run: ./ci/build-and-push-affected.sh
- name: Authenticate with Google Cloud
uses: google-github-actions/auth
with:
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
- name: Deploy selected services
run: ./ci/deploy-affected-services.shPin action versions according to your organization’s review policy, and ensure the provider condition matches the event that is allowed to deploy. The build and deploy scripts should derive their project list from the same validated Nx range rather than rerunning an unbounded “all projects” build.
Decisions that change the implementation
| Decision | Option A | Option B | What to check |
|---|---|---|---|
| Nx selection | Project-based affected graph | Task-based selection with NX_LEGACY_AFFECTED=false |
Whether project dependencies and target inputs are accurately declared |
| Google authentication | Direct WIF | WIF plus service-account impersonation | Whether the target resource and tooling support federated principals directly |
| Image reference | Unique commit tag for publishing | Digest recorded and used for traceability | Whether release records preserve the exact content behind the revision |
| Invocation | Public with allUsers Invoker |
IAM-authenticated callers | Who should be able to reach the service and how clients obtain credentials |
Troubleshoot the common failure modes
Nx reports no base commit or selects everything
Inspect the checkout depth and the values of NX_BASE and NX_HEAD. Fetch the required merge-base history, confirm that the base belongs to the intended target branch, and rerun the affected command. An incorrect range is a selection error, not a reason to bypass Nx.
Free tools Windows power users keep installed
One-click scans. No signup required.
A shared-library edit deploys many services
That is expected when the project graph shows those services depend on the library. Review the graph and target inputs. If the fan-out is unjustified, correct dependency or input declarations and add tests; do not hide the dependency with a manual service allow-list.
Authentication is denied
Check that the job has id-token: write, the provider resource name is correct, the claim mapping matches GitHub’s token, and the attribute condition admits the event’s repository owner and ref. For service-account impersonation, verify the federated principal has Service Account User access. Allow several minutes for new IAM and provider changes to propagate.
Deployment cannot read the image or attach the runtime account
Confirm Artifact Registry Reader on the image repository, Cloud Run Developer on the target service, and Service Account User on the runtime service account. If the image, service, and account are in different projects, inspect each project’s IAM policy and API enablement.
The service runs an unexpected version
Compare the Cloud Run revision’s resolved digest with the digest produced by the build. A reused tag can move after publication, while the existing revision remains immutable. Promote or roll back by selecting a known digest and record the resulting revision.
Quick Recap
Release checklist
- Full Git history or an equivalent fetch contains the intended Nx base and head commits.
NX_BASEandNX_HEADdescribe the event and release policy.- Affected lint, test, build, and any required integration targets pass before publication.
- Only deployable affected projects are mapped to Cloud Run services.
- Images are pushed to the permitted Artifact Registry repository and their digests are recorded.
- The WIF provider restricts repository and event identities; only the deployment job can mint an OIDC token.
- The CI deployer and Cloud Run runtime service account are separate and minimally privileged.
- Cloud Run region, invocation policy, runtime identity, revision, and digest are verified after deployment.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
