--- title: Deploy What Changed: Nx affected + Cloud Run + Workload... description: A detailed walkthrough of a production CI/CD pipeline that deploys only the services affected by a given merge, using Nx's affected graph, Google Cloud Run,... canonical: https://daily.dev/posts/deploy-what-changed-nx-affected-cloud-run-workload-identity-federation-dzrfmtp3s twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Deploy What Changed: Nx affected + Cloud Run + Workload Identity Federation | daily.dev og:description: A detailed walkthrough of a production CI/CD pipeline that deploys only the services affected by a given merge, using Nx's affected graph, Google Cloud Run,... og:url: https://daily.dev/posts/deploy-what-changed-nx-affected-cloud-run-workload-identity-federation-dzrfmtp3s og:image: https://api.daily.dev/og/posts/dZRfmTp3S.png og:image:alt: Deploy What Changed: Nx affected + Cloud Run + Workload Identity Federation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Deploy What Changed: Nx affected + Cloud Run + Workload Identity Federation **[ITNEXT](https://daily.dev/sources/itnext)** · 17 min read · 0 upvotes · 0 comments ## Summary A detailed walkthrough of a production CI/CD pipeline that deploys only the services affected by a given merge, using Nx's affected graph, Google Cloud Run, and Workload Identity Federation for keyless authentication. Covers setting up WIF to replace stored service account keys, the specific IAM roles needed (including undocumented ones like project-level storage.admin and roles/viewer for build log streaming), gaps in Nx's dependency graph (vendored Python packages, shared Dockerfiles outside project roots) that silently cause missed deploys, and techniques to narrow blast radius using namedInputs filtering and splitting shared libraries. Also documents a Google Cloud Container Registry deprecation (write access ended March 18, 2025) that requires creating an Artifact Registry mirror for new projects. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When did Google Container Registry (gcr.io) stop accepting new writes? Google Container Registry stopped accepting writes on March 18, 2025. Its gcr.io hostnames now proxy to Artifact Registry, but only for repositories that already exist; a brand-new project without that mirror will get a 404 on docker push. New projects should create the Artifact Registry mirror manually or push directly to a *-docker.pkg.dev path instead of relying on the gcr.io proxy. _daily.dev helps developers track infrastructure deprecations like the gcr.io write cutoff before they break a deploy._ ### What IAM role do I need for gcloud builds submit to stream build logs successfully in CI? roles/viewer at the project level is required to stream build logs back to the CLI, separate from any Cloud Build- or Storage-specific permission. Without it, gcloud builds submit exits non-zero and reports failure even though the underlying Cloud Build job actually finished and pushed the image successfully. roles/logging.viewer does not fix this because the CLI's error check specifically looks for a primitive Viewer or Owner role, not a fine-grained permission. _engineers debugging misleading gcloud CLI failures compare IAM setups like this one on daily.dev._ ### Why would Nx's affected command fail to detect that a shared Python package changed and skip deploying dependent services? Nx's affected graph is built from parsing TypeScript imports, so it cannot see a Python path dependency declared in pyproject.toml (like py-shared = { path = "../packages" }) even though every Dockerfile copies that package in. The fix is declaring an explicit implicitDependencies entry per consumer project.json naming the shared package, otherwise a real code change there marks nothing as affected and CI silently deploys nothing. _teams wiring monorepo deploy pipelines swap fixes for graph blind spots like this one on daily.dev._ ## Similar posts on daily.dev - [Eliminating Long-Lived Credentials in GCP with Workload Identity Federation](https://daily.dev/posts/eliminating-long-lived-credentials-in-gcp-with-workload-identity-federation-1cwaxayl4) · InfoQ · 0 upvotes · 0 comments - [Deploying a PNPM Monorepo to Cloudflare Pages](https://daily.dev/posts/deploying-a-pnpm-monorepo-to-cloudflare-pages-vwrbbcc3c) · Nx · 0 upvotes · 0 comments - [Migrating to Workspaces and Nx](https://daily.dev/posts/migrating-to-workspaces-and-nx-vjmaj8bgs) · Kent C. Dodds · 20 upvotes · 0 comments --- Tags: [#webdev](https://daily.dev/tags/webdev), [#general-programming](https://daily.dev/tags/general-programming), [#cicd](https://daily.dev/tags/cicd), [#gcp](https://daily.dev/tags/gcp) [View this post on daily.dev](https://daily.dev/posts/deploy-what-changed-nx-affected-cloud-run-workload-identity-federation-dzrfmtp3s) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Deploy What Changed: Nx affected + Cloud Run + Workload Identity Federation","url":"https://daily.dev/posts/deploy-what-changed-nx-affected-cloud-run-workload-identity-federation-dzrfmtp3s","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/deploy-what-changed-nx-affected-cloud-run-workload-identity-federation-dzrfmtp3s"},"datePublished":"2026-08-31T15:59:32.911Z","dateModified":"2026-08-31T16:00:03.087Z","description":"A detailed walkthrough of a production CI/CD pipeline that deploys only the services affected by a given merge, using Nx's affected graph, Google Cloud Run,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6f6e72c3bfd5307f879e182f167e887d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6f6e72c3bfd5307f879e182f167e887d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ITNEXT","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ITNEXT","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/itnext2","url":"https://daily.dev/sources/itnext"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/deploy-what-changed-nx-affected-cloud-run-workload-identity-federation-dzrfmtp3s","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"webdev,general-programming,cicd,gcp","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ITNEXT","item":"https://daily.dev/sources/itnext"},{"@type":"ListItem","position":3,"name":"Deploy What Changed: Nx affected + Cloud Run + Workload Identity Federation"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/deploy-what-changed-nx-affected-cloud-run-workload-identity-federation-dzrfmtp3s#faq","mainEntity":[{"@type":"Question","name":"When did Google Container Registry (gcr.io) stop accepting new writes?","acceptedAnswer":{"@type":"Answer","text":"Google Container Registry stopped accepting writes on March 18, 2025. Its gcr.io hostnames now proxy to Artifact Registry, but only for repositories that already exist; a brand-new project without that mirror will get a 404 on docker push. New projects should create the Artifact Registry mirror manually or push directly to a *-docker.pkg.dev path instead of relying on the gcr.io proxy. daily.dev helps developers track infrastructure deprecations like the gcr.io write cutoff before they break a deploy."}},{"@type":"Question","name":"What IAM role do I need for gcloud builds submit to stream build logs successfully in CI?","acceptedAnswer":{"@type":"Answer","text":"roles/viewer at the project level is required to stream build logs back to the CLI, separate from any Cloud Build- or Storage-specific permission. Without it, gcloud builds submit exits non-zero and reports failure even though the underlying Cloud Build job actually finished and pushed the image successfully. roles/logging.viewer does not fix this because the CLI's error check specifically looks for a primitive Viewer or Owner role, not a fine-grained permission. engineers debugging misleading gcloud CLI failures compare IAM setups like this one on daily.dev."}},{"@type":"Question","name":"Why would Nx's affected command fail to detect that a shared Python package changed and skip deploying dependent services?","acceptedAnswer":{"@type":"Answer","text":"Nx's affected graph is built from parsing TypeScript imports, so it cannot see a Python path dependency declared in pyproject.toml (like py-shared = { path = \"../packages\" }) even though every Dockerfile copies that package in. The fix is declaring an explicit implicitDependencies entry per consumer project.json naming the shared package, otherwise a real code change there marks nothing as affected and CI silently deploys nothing. teams wiring monorepo deploy pipelines swap fixes for graph blind spots like this one on daily.dev."}}]} ```