No separate CD system. A push to main runs the full pipeline in Cloud Build and lands live, with a guard that stops a subtle failure mode where new code builds but never takes traffic.
npm ci + jest. Fail fast before building.
Docker image on Debian-slim + Playwright Chromium.
Image to the container registry.
gcloud run deploy with 2Gi for the renderer.
update-traffic --to-latest.
gcloud run deploy
creates the new revision but does not route to it - Cloud Run marks it Retired within seconds
and keeps serving the old code. The build is green, the site is stale, and it is easy to miss.The explicit update-traffic --to-latest step
re-establishes auto-promote on every merge, so a one-off rollback that pinned traffic by name cannot
silently freeze future deploys. Belt and suspenders alongside the service-level
latestRevision: true.
Scales to zero when idle; cost follows traffic.
Bounded autoscale.
Headroom for a Chromium subprocess per render.
/health probed every 30s.
../cloudbuild.yaml.