fix(cloudrun): align snapshot payload with server's snapshot-examples doc (#4986)

Three changes brings the payload into line with the conventions
documented in the server repo's out-snapshot-examples.txt:

- Added the top-level "type": "cloud-run" literal that every other
  env-type report ships explicitly. Without it, the (still-to-come)
  CloudRunReport model on the server would only accept the URL
  default; with it, the request is unambiguous.
- Renamed the per-artifact "service_name" to "serviceName" (camelCase)
  matching the doc's K8S/ECS examples. The existing CLI's ECS code
  uses snake_case, but a new type is better off following the doc.
- Dropped the per-artifact "project" and "region" fields. The doc
  notes extra="forbid" on every Pydantic model, so unilaterally
  picking custom field names risks 422 once the server defines its
  CloudRunReport. Project + region are already in the URL and flags,
  mirroring how ECS reports don't carry account/region per artifact.

Verified end-to-end against the hello-world-cli-demo project; payload
now matches the doc shape exactly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ToreMerkely

cmd/kosli/snapshotCloudRun.go

@@ -106,7 +106,7 @@ func (o *snapshotCloudRunOptions) run(args []string) error {
 		}
 	}
 
-	payload := cloudrun.ToEnvRequest(filtered, o.project, o.region)
+	payload := cloudrun.ToEnvRequest(filtered)
 
 	reqParams := &requests.RequestParams{
 		Method:  http.MethodPut,

cmd/kosli/snapshotCloudRun_test.go

@@ -106,7 +106,7 @@ func (suite *SnapshotCloudRunTestSuite) TestSnapshotCloudRunCmd() {
 		{
 			name:        "snapshot cloud-run dry-runs the report URL and payload built from the GCP client",
 			cmd:         fmt.Sprintf(`snapshot cloud-run %s --project proj-x --region europe-west1 %s`, suite.envName, suite.defaultKosliArguments),
-			goldenRegex: `(?s)THIS IS A DRY-RUN.*report/cloud-run.*"service_name": "alpha".*"service_name": "beta"`,
+			goldenRegex: `(?s)THIS IS A DRY-RUN.*report/cloud-run.*"type": "cloud-run".*"serviceName": "alpha".*"serviceName": "beta"`,
 		},
 		{
 			wantError: true,
@@ -150,26 +150,26 @@ func (suite *SnapshotCloudRunTestSuite) runFilteredCmd(filterArgs string) string
 
 func (suite *SnapshotCloudRunTestSuite) TestSnapshotCloudRunFilter_Services() {
 	out := suite.runFilteredCmd("--services alpha")
-	require.Contains(suite.T(), out, `"service_name": "alpha"`)
-	require.NotContains(suite.T(), out, `"service_name": "beta"`)
+	require.Contains(suite.T(), out, `"serviceName": "alpha"`)
+	require.NotContains(suite.T(), out, `"serviceName": "beta"`)
 }
 
 func (suite *SnapshotCloudRunTestSuite) TestSnapshotCloudRunFilter_ServicesRegex() {
 	out := suite.runFilteredCmd(`--services-regex "^al"`)
-	require.Contains(suite.T(), out, `"service_name": "alpha"`)
-	require.NotContains(suite.T(), out, `"service_name": "beta"`)
+	require.Contains(suite.T(), out, `"serviceName": "alpha"`)
+	require.NotContains(suite.T(), out, `"serviceName": "beta"`)
 }
 
 func (suite *SnapshotCloudRunTestSuite) TestSnapshotCloudRunFilter_Exclude() {
 	out := suite.runFilteredCmd("--exclude alpha")
-	require.NotContains(suite.T(), out, `"service_name": "alpha"`)
-	require.Contains(suite.T(), out, `"service_name": "beta"`)
+	require.NotContains(suite.T(), out, `"serviceName": "alpha"`)
+	require.Contains(suite.T(), out, `"serviceName": "beta"`)
 }
 
 func (suite *SnapshotCloudRunTestSuite) TestSnapshotCloudRunFilter_ExcludeRegex() {
 	out := suite.runFilteredCmd(`--exclude-regex "^al"`)
-	require.NotContains(suite.T(), out, `"service_name": "alpha"`)
-	require.Contains(suite.T(), out, `"service_name": "beta"`)
+	require.NotContains(suite.T(), out, `"serviceName": "alpha"`)
+	require.Contains(suite.T(), out, `"serviceName": "beta"`)
 }
 
 // TestSnapshotCloudRunCmd_UnauthenticatedReturnsFriendlyError verifies that a

docs/handover/2026-04-28-4986-google-cloud-run-1.md

@@ -34,7 +34,7 @@ GCP test environment (provisioned, ADC already configured on this machine):
 - Package named `internal/cloudrun` (not `gcprun`) to mirror the user-facing command name `snapshot cloud-run`. If GCP integrations expand later we'll either rename or split into `internal/gcp/run`.
 - `internal/cloudrun` reports all revisions referenced in `service.traffic[]` regardless of percent (including 0%). Trade-off: matches the user's framing of "running or could run" without dragging in retired revisions that aren't currently configured for traffic; canary 90/10 splits surface both revisions naturally.
 - Digest extraction follows the ECS pattern (`internal/aws/aws.go:670-693`): use a `@sha256:` substring if present, else leave the digest empty rather than calling Artifact Registry. Registry-lookup mode (analogous to Azure's `--digests-source acr`) is deferred until customers ask for it.
-- Wire payload mirrors `EcsEnvRequest` plus `project` and `region` fields per artifact (so each row is self-describing). Endpoint name is `report/cloud-run` (kebab-case, parallels `report/azure-apps`). Server-side endpoint does not yet exist; the forced dry-run means no network call is made.
+- Wire payload follows the server's `out-snapshot-examples.txt` reference: top-level `{"type": "cloud-run", "artifacts": [...]}` with camelCase per-artifact fields (`revisionName`, `serviceName`, `digests`, `creationTimestamp`). Endpoint is `report/cloud-run` (kebab-case, parallels `report/azure-apps`). Server-side endpoint does not yet exist; the forced dry-run means no network call is made. Initial design (Slice 3) added `project`/`region` per artifact mirroring ECS's `cluster_name`; reverted in Slice 3.5 because the doc specifies `extra="forbid"` on every Pydantic model and project/region are derivable from the URL + flags.
 - Command depends on a local `cloudRunLister` interface and a package-level `newCloudRunClient` variable so tests can substitute a stub without touching ADC. The seam stays in `cmd/kosli/snapshotCloudRun.go` rather than being exposed from `internal/cloudrun` — keeps the public package surface minimal.
 - Error classification (`Classify`) lives in `internal/cloudrun` (GCP knowledge belongs to the package) but is *applied* at the command layer, not inside `Client.ListServices`. Why: applying it inside `ListServices` would double-wrap real-call errors when the command also classified them, and bypass the friendly path entirely for stub-driven tests. Calling it once at the command boundary covers both real and stub error sources.
 
@@ -46,7 +46,8 @@ Slice plan (each slice is a separate, independently-mergeable branch):
 
 - [x] **Slice 1 (this branch):** Skeleton command — `cmd/kosli/snapshotCloudRun.go` (Hidden, forced dry-run, stub `RunE`), register in `snapshot.go`, arg/flag validation tests. Done 2026-04-28: 5 cmdTestCase tests passing, `make lint` clean, hidden from `snapshot --help` but reachable directly.
 - [x] **Slice 2:** Internal `internal/cloudrun` package — wraps `cloud.google.com/go/run/apiv2` to list services in project+region; unit-tested with a fake. Done 2026-04-28: `Client.ListServices` returns `Service{Name, URI, Revisions}` with one `Revision{Name, Digests, CreatedAt}` per traffic-configured revision (any percent including 0%, with `LATEST` resolved via `LatestReadyRevision` and dupes removed). Digest extraction mirrors the ECS fallback (`@sha256:` parse, else empty string). 9 unit tests passing.
-- [x] **Slice 3:** End-to-end happy path — wire the package into `RunE`, build the snapshot payload, POST to the server `cloud-run` endpoint (still dry-run only). Done 2026-04-28: command now calls `cloudrun.New` + `ListServices`, builds an `EnvRequest` via `ToEnvRequest(services, project, region)`, and submits PUT `report/cloud-run` via `kosliClient.Do` (dry-run forced, so no network call leaves the client). Tested against the real `hello-world-cli-demo` GCP project — emits a digest-pinned artifact for the running `hello-world` service.
+- [x] **Slice 3:** End-to-end happy path — wire the package into `RunE`, build the snapshot payload, POST to the server `cloud-run` endpoint (still dry-run only). Done 2026-04-28: command now calls `cloudrun.New` + `ListServices`, builds an `EnvRequest` via `ToEnvRequest(services)`, and submits PUT `report/cloud-run` via `kosliClient.Do` (dry-run forced, so no network call leaves the client). Tested against the real `hello-world-cli-demo` GCP project — emits a digest-pinned artifact for the running `hello-world` service.
+- [x] **Slice 3.5:** Align payload with the server's snapshot-examples doc. Done 2026-04-28: added top-level `"type": "cloud-run"`; renamed `service_name` → `serviceName` (camelCase, matching the doc's K8S/ECS examples); dropped per-artifact `project` and `region` (would be rejected by `extra="forbid"` once the server defines a `CloudRunReport` model — they're identifiable from the URL + flags anyway, like ECS region).
 - [x] **Slice 4:** Filtering flags — `--services`, `--services-regex`, `--exclude`, `--exclude-regex`. Done 2026-04-28: backed by `filters.ResourceFilterOptions` (same struct ECS uses); 4 mutex pairs validated in `PreRunE`. Filter is applied in the command after `cloudrun.ListServices` returns — services excluded by name still cost their revision-fetch round-trips. If that becomes a bottleneck, push the filter into `cloudrun.ListServices` so excluded services skip the per-revision API calls.
 - [x] **Slice 5:** ~~Multi-revision / traffic splitting — handle services with multiple active revisions and services with no active revisions.~~ Dropped 2026-04-28: multi-revision (traffic splitting), `LATEST` resolution, and dedup were all completed in Slice 2; the only remaining edge case (services with no active revisions emitting a placeholder artifact) was deferred until the server-side wire contract is defined, since picking the format unilaterally now risks rework. Re-open as a small slice once the server contract lands.
 - [x] **Slice 6:** Auth error UX — clear messages for ADC / `GOOGLE_APPLICATION_CREDENTIALS` failures and for missing project/region. Done 2026-04-28: `cloudrun.Classify(err, project, region)` maps gRPC `Unauthenticated` → ADC advice, `PermissionDenied` → `roles/run.viewer` advice, `NotFound` → "project or region not found"; other codes pass through. Auth message names all three credential sources (env var, `gcloud auth application-default login`, GCE/GKE metadata server / Workload Identity) since the production deployment is a GKE cron job. `cloudrun.New(ctx)` errors get a generic "GCP client setup failed" prefix.

internal/cloudrun/payload.go

@@ -1,38 +1,41 @@
 package cloudrun
 
+// reportType is the literal sent in the top-level "type" field, mirroring the
+// "K8S", "ECS", "azure-apps", … values used by the other env-type reports.
+const reportType = "cloud-run"
+
 // EnvRequest is the PUT body sent to the Kosli "report/cloud-run" endpoint.
-// It mirrors the shape of EcsEnvRequest in internal/aws.
+// Field naming mirrors the conventions documented in the server's
+// out-snapshot-examples.txt (top-level "type" + "artifacts", camelCase
+// per-artifact fields).
 type EnvRequest struct {
+	Type      string          `json:"type"`
 	Artifacts []*RevisionData `json:"artifacts"`
 }
 
 // RevisionData represents one Cloud Run revision in the snapshot payload.
 // One artifact is emitted per revision in each service's traffic configuration.
 type RevisionData struct {
 	RevisionName string            `json:"revisionName"`
-	Service      string            `json:"service_name,omitempty"`
-	Project      string            `json:"project,omitempty"`
-	Region       string            `json:"region,omitempty"`
+	ServiceName  string            `json:"serviceName,omitempty"`
 	Digests      map[string]string `json:"digests"`
 	CreatedAt    int64             `json:"creationTimestamp"`
 }
 
 // ToEnvRequest flattens services into a list of revision artifacts. Services
 // with no revisions contribute nothing, mirroring the ECS behaviour of
 // services with no running tasks.
-func ToEnvRequest(services []Service, project, region string) *EnvRequest {
+func ToEnvRequest(services []Service) *EnvRequest {
 	artifacts := []*RevisionData{}
 	for _, svc := range services {
 		for _, rev := range svc.Revisions {
 			artifacts = append(artifacts, &RevisionData{
 				RevisionName: rev.Name,
-				Service:      svc.Name,
-				Project:      project,
-				Region:       region,
+				ServiceName:  svc.Name,
 				Digests:      rev.Digests,
 				CreatedAt:    rev.CreatedAt.Unix(),
 			})
 		}
 	}
-	return &EnvRequest{Artifacts: artifacts}
+	return &EnvRequest{Type: reportType, Artifacts: artifacts}
 }

internal/cloudrun/payload_test.go

@@ -7,8 +7,13 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestToEnvRequest_TypeIsCloudRun(t *testing.T) {
+	got := ToEnvRequest(nil)
+	require.Equal(t, "cloud-run", got.Type)
+}
+
 func TestToEnvRequest_EmptyInput(t *testing.T) {
-	got := ToEnvRequest(nil, "p", "r")
+	got := ToEnvRequest(nil)
 	require.NotNil(t, got)
 	require.Empty(t, got.Artifacts)
 }
@@ -29,14 +34,12 @@ func TestToEnvRequest_SingleServiceSingleRevision(t *testing.T) {
 		},
 	}
 
-	got := ToEnvRequest(services, "proj-1", "europe-west1")
+	got := ToEnvRequest(services)
 	require.Len(t, got.Artifacts, 1)
 
 	art := got.Artifacts[0]
 	require.Equal(t, "svc-a-rev1", art.RevisionName)
-	require.Equal(t, "svc-a", art.Service)
-	require.Equal(t, "proj-1", art.Project)
-	require.Equal(t, "europe-west1", art.Region)
+	require.Equal(t, "svc-a", art.ServiceName)
 	require.Equal(t, map[string]string{"img@sha256:aaa": "aaa"}, art.Digests)
 	require.Equal(t, created.Unix(), art.CreatedAt)
 }
@@ -58,15 +61,15 @@ func TestToEnvRequest_MultipleServicesMultipleRevisions(t *testing.T) {
 		},
 	}
 
-	got := ToEnvRequest(services, "proj-1", "europe-west1")
+	got := ToEnvRequest(services)
 	require.Len(t, got.Artifacts, 3)
 
 	revisionNames := []string{got.Artifacts[0].RevisionName, got.Artifacts[1].RevisionName, got.Artifacts[2].RevisionName}
 	require.Equal(t, []string{"a-rev1", "a-rev2", "b-rev1"}, revisionNames)
 
-	require.Equal(t, "svc-a", got.Artifacts[0].Service)
-	require.Equal(t, "svc-a", got.Artifacts[1].Service)
-	require.Equal(t, "svc-b", got.Artifacts[2].Service)
+	require.Equal(t, "svc-a", got.Artifacts[0].ServiceName)
+	require.Equal(t, "svc-a", got.Artifacts[1].ServiceName)
+	require.Equal(t, "svc-b", got.Artifacts[2].ServiceName)
 }
 
 func TestToEnvRequest_ServiceWithNoRevisionsContributesNothing(t *testing.T) {
@@ -80,31 +83,17 @@ func TestToEnvRequest_ServiceWithNoRevisionsContributesNothing(t *testing.T) {
 		},
 	}
 
-	got := ToEnvRequest(services, "p", "r")
+	got := ToEnvRequest(services)
 	require.Len(t, got.Artifacts, 1)
-	require.Equal(t, "svc-a", got.Artifacts[0].Service)
-}
-
-func TestToEnvRequest_ProjectAndRegionOnEveryArtifact(t *testing.T) {
-	services := []Service{
-		{Name: "a", Revisions: []Revision{{Name: "a1"}}},
-		{Name: "b", Revisions: []Revision{{Name: "b1"}}},
-	}
-
-	got := ToEnvRequest(services, "proj-x", "us-central1")
-
-	for _, art := range got.Artifacts {
-		require.Equal(t, "proj-x", art.Project)
-		require.Equal(t, "us-central1", art.Region)
-	}
+	require.Equal(t, "svc-a", got.Artifacts[0].ServiceName)
 }
 
 func TestToEnvRequest_ZeroCreatedAtSerialisesAsZero(t *testing.T) {
 	services := []Service{
 		{Name: "svc", Revisions: []Revision{{Name: "rev"}}},
 	}
 
-	got := ToEnvRequest(services, "p", "r")
+	got := ToEnvRequest(services)
 	require.Len(t, got.Artifacts, 1)
 	require.Equal(t, time.Time{}.Unix(), got.Artifacts[0].CreatedAt)
 }