feat(snapshot): add service filtering flags to cloud-run command (#4986)

Slice 4 of the snapshot cloud-run feature. Adds --services,
--services-regex, --exclude, and --exclude-regex, mirroring the ECS
service filtering shape and reusing the existing
filters.ResourceFilterOptions struct. PreRunE rejects the four
include/exclude mutex pairs.

Filtering is applied in the command after cloudrun.ListServices
returns. Services excluded by name still incur their per-revision
API round-trips; pushing the filter into the GCP wrapper to skip
those calls is a tractable follow-up if the round-trip cost becomes
a bottleneck.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ToreMerkely

cmd/kosli/root.go

@@ -176,6 +176,10 @@ The ^.kosli_ignore^ will be treated as part of the artifact like any other file,
 	ecsServicesRegexFlag            = "[optional] The comma-separated list of ECS service name regex patterns to snapshot. Can't be used together with --exclude-services or --exclude-services-regex."
 	ecsExcludeServicesFlag          = "[optional] The comma-separated list of ECS service names to exclude. Can't be used together with --services or --services-regex."
 	ecsExcludeServicesRegexFlag     = "[optional] The comma-separated list of ECS service name regex patterns to exclude. Can't be used together with --services or --services-regex."
+	cloudRunServicesFlag            = "[optional] The comma-separated list of Cloud Run service names to snapshot. Can't be used together with --exclude or --exclude-regex."
+	cloudRunServicesRegexFlag       = "[optional] The comma-separated list of Cloud Run service name regex patterns to snapshot. Can't be used together with --exclude or --exclude-regex."
+	cloudRunExcludeFlag             = "[optional] The comma-separated list of Cloud Run service names to exclude. Can't be used together with --services or --services-regex."
+	cloudRunExcludeRegexFlag        = "[optional] The comma-separated list of Cloud Run service name regex patterns to exclude. Can't be used together with --services or --services-regex."
 	kubeconfigFlag                  = "[defaulted] The kubeconfig path for the target cluster."
 	namespacesFlag                  = "[optional] The comma separated list of namespaces names to report artifacts info from. Can't be used together with --exclude-namespaces or --exclude-namespaces-regex."
 	excludeNamespacesFlag           = "[optional] The comma separated list of namespaces names to exclude from reporting artifacts info from. Requires cluster-wide read permissions for pods and namespaces. Can't be used together with --namespaces or --namespaces-regex."

cmd/kosli/snapshotCloudRun.go

@@ -7,6 +7,7 @@ import (
 	"net/url"
 
 	"github.com/kosli-dev/cli/internal/cloudrun"
+	"github.com/kosli-dev/cli/internal/filters"
 	"github.com/kosli-dev/cli/internal/requests"
 	"github.com/spf13/cobra"
 )
@@ -26,12 +27,14 @@ var newCloudRunClient = func(ctx context.Context) (cloudRunLister, error) {
 }
 
 type snapshotCloudRunOptions struct {
-	project string
-	region  string
+	project       string
+	region        string
+	serviceFilter *filters.ResourceFilterOptions
 }
 
 func newSnapshotCloudRunCmd(out io.Writer) *cobra.Command {
 	o := new(snapshotCloudRunOptions)
+	o.serviceFilter = new(filters.ResourceFilterOptions)
 	cmd := &cobra.Command{
 		Use:    "cloud-run ENVIRONMENT-NAME",
 		Short:  snapshotCloudRunShortDesc,
@@ -42,6 +45,16 @@ func newSnapshotCloudRunCmd(out io.Writer) *cobra.Command {
 			if err := RequireGlobalFlags(global, []string{"Org", "ApiToken"}); err != nil {
 				return ErrorBeforePrintingUsage(cmd, err.Error())
 			}
+			for _, pair := range [][]string{
+				{"services", "exclude"},
+				{"services", "exclude-regex"},
+				{"services-regex", "exclude"},
+				{"services-regex", "exclude-regex"},
+			} {
+				if err := MuXRequiredFlags(cmd, pair, false); err != nil {
+					return err
+				}
+			}
 			global.DryRun = true
 			return nil
 		},
@@ -52,6 +65,10 @@ func newSnapshotCloudRunCmd(out io.Writer) *cobra.Command {
 
 	cmd.Flags().StringVar(&o.project, "project", "", "[required] GCP project ID.")
 	cmd.Flags().StringVar(&o.region, "region", "", "[required] GCP region (e.g. europe-west1).")
+	cmd.Flags().StringSliceVar(&o.serviceFilter.IncludeNames, "services", []string{}, cloudRunServicesFlag)
+	cmd.Flags().StringSliceVar(&o.serviceFilter.IncludeNamesRegex, "services-regex", []string{}, cloudRunServicesRegexFlag)
+	cmd.Flags().StringSliceVar(&o.serviceFilter.ExcludeNames, "exclude", []string{}, cloudRunExcludeFlag)
+	cmd.Flags().StringSliceVar(&o.serviceFilter.ExcludeNamesRegex, "exclude-regex", []string{}, cloudRunExcludeRegexFlag)
 	addDryRunFlag(cmd)
 
 	if err := RequireFlags(cmd, []string{"project", "region"}); err != nil {
@@ -78,7 +95,18 @@ func (o *snapshotCloudRunOptions) run(args []string) error {
 		return err
 	}
 
-	payload := cloudrun.ToEnvRequest(services, o.project, o.region)
+	filtered := services[:0]
+	for _, svc := range services {
+		include, err := o.serviceFilter.ShouldInclude(svc.Name)
+		if err != nil {
+			return err
+		}
+		if include {
+			filtered = append(filtered, svc)
+		}
+	}
+
+	payload := cloudrun.ToEnvRequest(filtered, o.project, o.region)
 
 	reqParams := &requests.RequestParams{
 		Method:  http.MethodPut,

cmd/kosli/snapshotCloudRun_test.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/kosli-dev/cli/internal/cloudrun"
+	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
 )
 
@@ -27,6 +28,35 @@ type SnapshotCloudRunTestSuite struct {
 	envName               string
 }
 
+// stubServices returns two Cloud Run services so filter tests can verify
+// inclusion and exclusion in a single run.
+func stubServices() []cloudrun.Service {
+	return []cloudrun.Service{
+		{
+			Name: "alpha",
+			URI:  "https://alpha.run.app",
+			Revisions: []cloudrun.Revision{
+				{
+					Name:      "alpha-rev1",
+					Digests:   map[string]string{"gcr.io/x/alpha@sha256:aaa": "aaa"},
+					CreatedAt: time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC),
+				},
+			},
+		},
+		{
+			Name: "beta",
+			URI:  "https://beta.run.app",
+			Revisions: []cloudrun.Revision{
+				{
+					Name:      "beta-rev1",
+					Digests:   map[string]string{"gcr.io/x/beta@sha256:bbb": "bbb"},
+					CreatedAt: time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC),
+				},
+			},
+		},
+	}
+}
+
 func (suite *SnapshotCloudRunTestSuite) SetupTest() {
 	suite.envName = "snapshot-cloud-run-env"
 	global = &GlobalOpts{
@@ -37,21 +67,7 @@ func (suite *SnapshotCloudRunTestSuite) SetupTest() {
 	suite.defaultKosliArguments = fmt.Sprintf(" --host %s --org %s --api-token %s", global.Host, global.Org, global.ApiToken)
 
 	newCloudRunClient = func(_ context.Context) (cloudRunLister, error) {
-		return stubCloudRunLister{
-			services: []cloudrun.Service{
-				{
-					Name: "hello-world",
-					URI:  "https://hello-world.run.app",
-					Revisions: []cloudrun.Revision{
-						{
-							Name:      "hello-world-rev1",
-							Digests:   map[string]string{"gcr.io/x/hello@sha256:abc": "abc"},
-							CreatedAt: time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC),
-						},
-					},
-				},
-			},
-		}, nil
+		return stubCloudRunLister{services: stubServices()}, nil
 	}
 }
 
@@ -88,13 +104,72 @@ func (suite *SnapshotCloudRunTestSuite) TestSnapshotCloudRunCmd() {
 		{
 			name:        "snapshot cloud-run dry-runs the report URL and payload built from the GCP client",
 			cmd:         fmt.Sprintf(`snapshot cloud-run %s --project proj-x --region europe-west1 %s`, suite.envName, suite.defaultKosliArguments),
-			goldenRegex: `(?s)THIS IS A DRY-RUN.*report/cloud-run.*"revisionName": "hello-world-rev1".*"service_name": "hello-world".*"project": "proj-x".*"region": "europe-west1".*"gcr.io/x/hello@sha256:abc": "abc"`,
+			goldenRegex: `(?s)THIS IS A DRY-RUN.*report/cloud-run.*"service_name": "alpha".*"service_name": "beta"`,
+		},
+		{
+			wantError: true,
+			name:      "snapshot cloud-run fails if --services and --exclude are set",
+			cmd:       fmt.Sprintf(`snapshot cloud-run %s --project p --region r --services alpha --exclude beta %s`, suite.envName, suite.defaultKosliArguments),
+			golden:    "Error: only one of --services, --exclude is allowed\n",
+		},
+		{
+			wantError: true,
+			name:      "snapshot cloud-run fails if --services and --exclude-regex are set",
+			cmd:       fmt.Sprintf(`snapshot cloud-run %s --project p --region r --services alpha --exclude-regex "^b" %s`, suite.envName, suite.defaultKosliArguments),
+			golden:    "Error: only one of --services, --exclude-regex is allowed\n",
+		},
+		{
+			wantError: true,
+			name:      "snapshot cloud-run fails if --services-regex and --exclude are set",
+			cmd:       fmt.Sprintf(`snapshot cloud-run %s --project p --region r --services-regex "^a" --exclude beta %s`, suite.envName, suite.defaultKosliArguments),
+			golden:    "Error: only one of --services-regex, --exclude is allowed\n",
+		},
+		{
+			wantError: true,
+			name:      "snapshot cloud-run fails if --services-regex and --exclude-regex are set",
+			cmd:       fmt.Sprintf(`snapshot cloud-run %s --project p --region r --services-regex "^a" --exclude-regex "^b" %s`, suite.envName, suite.defaultKosliArguments),
+			golden:    "Error: only one of --services-regex, --exclude-regex is allowed\n",
 		},
 	}
 
 	runTestCmd(suite.T(), tests)
 }
 
+// runFilteredCmd executes the command and returns the combined output for
+// substring assertions. Filter tests need to assert both presence (kept
+// service appears) and absence (excluded service does not appear), so they
+// cannot use the single-assertion cmdTestCase table.
+func (suite *SnapshotCloudRunTestSuite) runFilteredCmd(filterArgs string) string {
+	cmd := fmt.Sprintf(`snapshot cloud-run %s --project p --region r %s %s`, suite.envName, filterArgs, suite.defaultKosliArguments)
+	_, combined, _, _, err := executeCommandC(cmd)
+	require.NoError(suite.T(), err, "command failed: %s", combined)
+	return combined
+}
+
+func (suite *SnapshotCloudRunTestSuite) TestSnapshotCloudRunFilter_Services() {
+	out := suite.runFilteredCmd("--services alpha")
+	require.Contains(suite.T(), out, `"service_name": "alpha"`)
+	require.NotContains(suite.T(), out, `"service_name": "beta"`)
+}
+
+func (suite *SnapshotCloudRunTestSuite) TestSnapshotCloudRunFilter_ServicesRegex() {
+	out := suite.runFilteredCmd(`--services-regex "^al"`)
+	require.Contains(suite.T(), out, `"service_name": "alpha"`)
+	require.NotContains(suite.T(), out, `"service_name": "beta"`)
+}
+
+func (suite *SnapshotCloudRunTestSuite) TestSnapshotCloudRunFilter_Exclude() {
+	out := suite.runFilteredCmd("--exclude alpha")
+	require.NotContains(suite.T(), out, `"service_name": "alpha"`)
+	require.Contains(suite.T(), out, `"service_name": "beta"`)
+}
+
+func (suite *SnapshotCloudRunTestSuite) TestSnapshotCloudRunFilter_ExcludeRegex() {
+	out := suite.runFilteredCmd(`--exclude-regex "^al"`)
+	require.NotContains(suite.T(), out, `"service_name": "alpha"`)
+	require.Contains(suite.T(), out, `"service_name": "beta"`)
+}
+
 func TestSnapshotCloudRunCommandTestSuite(t *testing.T) {
 	suite.Run(t, new(SnapshotCloudRunTestSuite))
 }

docs/handover/2026-04-28-4986-google-cloud-run-1.md

@@ -46,7 +46,7 @@ Slice plan (each slice is a separate, independently-mergeable branch):
 - [x] **Slice 1 (this branch):** Skeleton command — `cmd/kosli/snapshotCloudRun.go` (Hidden, forced dry-run, stub `RunE`), register in `snapshot.go`, arg/flag validation tests. Done 2026-04-28: 5 cmdTestCase tests passing, `make lint` clean, hidden from `snapshot --help` but reachable directly.
 - [x] **Slice 2:** Internal `internal/cloudrun` package — wraps `cloud.google.com/go/run/apiv2` to list services in project+region; unit-tested with a fake. Done 2026-04-28: `Client.ListServices` returns `Service{Name, URI, Revisions}` with one `Revision{Name, Digests, CreatedAt}` per traffic-configured revision (any percent including 0%, with `LATEST` resolved via `LatestReadyRevision` and dupes removed). Digest extraction mirrors the ECS fallback (`@sha256:` parse, else empty string). 9 unit tests passing.
 - [x] **Slice 3:** End-to-end happy path — wire the package into `RunE`, build the snapshot payload, POST to the server `cloud-run` endpoint (still dry-run only). Done 2026-04-28: command now calls `cloudrun.New` + `ListServices`, builds an `EnvRequest` via `ToEnvRequest(services, project, region)`, and submits PUT `report/cloud-run` via `kosliClient.Do` (dry-run forced, so no network call leaves the client). Tested against the real `hello-world-cli-demo` GCP project — emits a digest-pinned artifact for the running `hello-world` service.
-- [ ] **Slice 4:** Filtering flags — `--services`, `--services-regex`, `--exclude`, `--exclude-regex`.
+- [x] **Slice 4:** Filtering flags — `--services`, `--services-regex`, `--exclude`, `--exclude-regex`. Done 2026-04-28: backed by `filters.ResourceFilterOptions` (same struct ECS uses); 4 mutex pairs validated in `PreRunE`. Filter is applied in the command after `cloudrun.ListServices` returns — services excluded by name still cost their revision-fetch round-trips. If that becomes a bottleneck, push the filter into `cloudrun.ListServices` so excluded services skip the per-revision API calls.
 - [ ] **Slice 5:** Multi-revision / traffic splitting — handle services with multiple active revisions and services with no active revisions.
 - [ ] **Slice 6:** Auth error UX — clear messages for ADC / `GOOGLE_APPLICATION_CREDENTIALS` failures and for missing project/region.
 - [ ] **Slice 7:** Unhide the command, lift the forced dry-run, update CLI reference docs and examples.