Enforce the Cloud Run minimum-instance floor

README.md

@@ -8,6 +8,22 @@ This is a React web application that runs Descope's login flows according to the
 
 [![Deploy with Vercel](https://vercel.com/button)](https://vercel.com/new/clone?repository-url=https%3A%2F%2Fgithub.com%2Fdescope%2Fauth-hosting&env=DESCOPE_PROJECT_ID&demo-title=Descope%20Hosted%20Auth%20Page&demo-description=https%3A%2F%2Fgithub.com%2Fdescope%2Fauth-hosting%2F%23readme&demo-url=https%3A%2F%2Fauth.descope.io%2F)
 
+#### Pieces Cloud Run minimum-instance invariant
+
+The configured service-level minimum must equal `1` in every Pieces-hosted
+environment. This is an autoscaling floor, not a cap or a guarantee that exactly
+one instance is running. `cloudbuild.yaml` enforces it with
+`gcloud run services update --min=1 --min-instances=default` on every
+deployment. The first flag owns the floor across traffic-serving revisions;
+the second ensures the newly created revision has no additional revision-level
+floor.
+
+The post-deploy step verifies the service value is `1` and every revision
+referenced by traffic or a tag has no revision-level minimum. Dormant immutable
+revisions created before this invariant may retain their historical annotation;
+they must remain untagged and receive no traffic. Changing a trigger, service,
+or deployment path must retain this assertion.
+
 By default, the app is deployed to the Descope hosting page in [https://auth.descope.io](https://auth.descope.io).  
 The main purpose is to allow easy integration for descopers implementing authentication with Descope (such as OIDC [use case](#open-id-connect-oidc-use-cases-in-descope)).
 

cloudbuild.yaml

@@ -30,11 +30,50 @@ steps:
       - update
       - $_SERVICE_NAME
       - --platform=managed
+      - --project=$PROJECT_ID
+      # Configure a service-level floor of one across traffic-serving revisions.
+      - --min=1
+      # Ensure the newly created revision has no additional revision-level floor.
+      - --min-instances=default
       - --image=$_AR_HOSTNAME/$PROJECT_ID/cloud-run-source-deploy/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
       - --labels=managed-by=gcp-cloud-build-deploy-cloud-run,commit-sha=$COMMIT_SHA,gcb-build-id=$BUILD_ID,gcb-trigger-id=$_TRIGGER_ID
       - --region=$_DEPLOY_REGION
       - --quiet
 
+  - id: Verify minimum instance invariant
+    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+    entrypoint: bash
+    args:
+      - -ceu
+      - |
+        service_min="$$(gcloud run services describe $_SERVICE_NAME \
+          --project=$PROJECT_ID \
+          --region=$_DEPLOY_REGION \
+          --platform=managed \
+          --format="value(metadata.annotations.'run.googleapis.com/minScale')")"
+        traffic_revisions="$$(gcloud run services describe $_SERVICE_NAME \
+          --project=$PROJECT_ID \
+          --region=$_DEPLOY_REGION \
+          --platform=managed \
+          --format="value(status.traffic.revisionName)" | tr ';,' '  ')"
+
+        if [[ "$$service_min" != "1" || -z "$$traffic_revisions" ]]; then
+          echo "Cloud Run minimum invariant failed: service=$$service_min traffic=$$traffic_revisions" >&2
+          exit 1
+        fi
+
+        for revision in $$traffic_revisions; do
+          revision_min="$$(gcloud run revisions describe "$$revision" \
+            --project=$PROJECT_ID \
+            --region=$_DEPLOY_REGION \
+            --platform=managed \
+            --format="value(metadata.annotations.'autoscaling.knative.dev/minScale')")"
+          if [[ -n "$$revision_min" ]]; then
+            echo "Cloud Run revision minimum must be absent: revision=$$revision value=$$revision_min" >&2
+            exit 1
+          fi
+        done
+
 images:
   - $_AR_HOSTNAME/$PROJECT_ID/cloud-run-source-deploy/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA