Google Cloud Run Functions 2026-08-30

Apply the Google Cloud Run 2026-08-30 prompt first. These rules cover Cloud Run functions, formerly Cloud Functions (2nd gen), created through the Cloud Run Admin API or Cloud Functions v2 API. Apply first-generation guidance separately for Cloud Run functions (1st gen).

Deployment model and runtimes

• Declare the deployment API and generation explicitly; use --gen2 with gcloud functions deploy. Treat the underlying Cloud Run service definition as authoritative when reviewing deployed function configuration.
• Select an explicit supported GA runtime ID with --runtime, or a supported runtime base image with gcloud run deploy --base-image; check that runtime's deprecation and decommission dates before rollout. A deprecated runtime remaining deployable is not evidence of continuing runtime support.
• Keep automatic runtime security updates enabled; for Cloud Functions v2 deployments, set --runtime-update-policy=automatic. If using on-deploy, establish a timely rebuild and redeployment process for runtime fixes.
• Preserve automatic base-image patching when applying the baseline's immutable-artifact rules: record the application image and managed base image separately. Automatic base-image updates do not create a new revision or update application dependencies; rebuild affected dependencies and compiled language code when fixes require it.
• Scan both the application image and corresponding Google-provided base image when automatic updates build the application on scratch; scanning only the stored application image does not cover the running operating system