Docs · Deploy

Cloud Run deployment

Reference GCP deployment using Cloud Run — managed infrastructure, automatic scaling.

What you need

Cloud Run runs the same container as any other deployment. For a managed GCP stack, pair it with Cloud SQL (Postgres) for DATABASE_URL and Memorystore (Redis) for REDIS_URL, and keep every secret in Secret Manager.

1. Build the image

build.sh

# Build and push the API image to Artifact Registry
gcloud builds submit apps/api \
  --tag europe-west1-docker.pkg.dev/PROJECT/driftguard/api:latest

2. Deploy

Mount secrets from Secret Manager rather than passing them inline:

deploy.sh

gcloud run deploy driftguard-api \
  --image europe-west1-docker.pkg.dev/PROJECT/driftguard/api:latest \
  --region europe-west1 \
  --port 8000 \
  --no-allow-unauthenticated=false \
  --set-env-vars ENVIRONMENT=production \
  --set-secrets \
    SECRET_KEY=driftguard-secret-key:latest,\
    DATABASE_URL=driftguard-database-url:latest,\
    REDIS_URL=driftguard-redis-url:latest,\
    GITHUB_APP_PRIVATE_KEY=driftguard-gh-key:latest,\
    GITHUB_WEBHOOK_SECRET=driftguard-gh-webhook:latest,\
    ANTHROPIC_API_KEY=driftguard-anthropic:latest \
  --set-env-vars GITHUB_APP_ID=123456

Point the service URL at your GitHub App webhook (/api/v1/webhooks/github). Because Cloud Run scales to zero, cold starts add latency to the first webhook after idle — keep a minimum instance warm for production. See the full environment variable reference. DriftGuard is in early access; this is a reference deployment, not a managed offering.