Codex skills for Google Cloud
Google Cloud work in Codex covers Cloud Run, Cloud Functions, GKE Autopilot, IAM, BigQuery and the Firebase stack. With these skills Codex deploys with dedicated service accounts and images pinned by digest, replaces JSON keys with Workload Identity Federation, checks BigQuery cost with dry runs, and tests Firestore security rules in the emulator before anything ships.
Start with these 3
- Google Cloud Run Private by default, scaled on purpose Codex deploys to Cloud Run with a dedicated runtime service account, private ingress and pinned image digests, then sizes concurrency and instance limits against the real downstream connection budget. Rollouts go through tagged no-traffic revisions with a one-line rollback, and batch work moves to sharded, idempotent Cloud Run jobs.
- Google Cloud IAM Least privilege without JSON key files Codex audits the exported project policy with a bundled script, then replaces basic roles with resource-level predefined roles, one service account per workload, and keyless auth through impersonation or Workload Identity Federation. CI pools always get an attribute condition, and Terraform changes use additive member resources so nobody gets locked out.
- Google Cloud Functions Event handlers that survive at-least-once delivery Codex writes HTTP and CloudEvent handlers with the Functions Framework, runs them locally with a curl'd CloudEvent, and deploys with separate runtime and trigger service accounts. Event handlers deduplicate on a domain key and split transient from permanent errors, so turning on retries never creates an endless loop or a double charge.
7 more Google Cloud skills
-
Firebase Firestore
Predictable reads, tested rules, versioned indexes -
BigQuery Optimization
Scan gigabytes, not terabytes -
Google Kubernetes Engine
Autopilot clusters that upgrade without drama -
Firebase Hosting
Static sites, API rewrites and preview channels -
Firebase Auth
Verified tokens, claims-based roles, emulator-tested -
Mobile Push Notifications
Pushes that arrive, tokens that stay clean -
SQL for Analytics
Funnels, cohorts and retention you can defend
General skills with Google Cloud guidance
Not built around Google Cloud, but they include steps or tools for it. Not part of the install-all command.
-
Mobile Deep Links
Links that open the app, not the browser -
GitHub Actions Security
Read-only tokens, SHA pins, no injected titles -
Mobile Offline Sync
Edits survive tunnels, crashes and two devices -
SQL Window Functions
Rankings and running totals that are actually right -
Dimensional Modeling
Star schemas with one grain and honest totals -
Text to Speech
Natural narration with names pronounced right -
Secrets Management
No plaintext keys, rotation you have rehearsed -
Cloud FinOps
Give every cloud dollar an owner and a trend -
Cloud Security Posture
Rank by exposure, fix the top ten -
SSRF Prevention
Check the IP you connect to, not the URL -
GA4 Analytics
Events that fire once and match your backend
Every Google Cloud skill in one command
Installs these 10 into ~/.agents/skills/. Add --project after -- to install into the current repository instead.
The installer is a 104-line POSIX shell script. It fetches the skills you name from codexskills.dev and unpacks each into its own folder in your skills directory. No sudo, no telemetry, and every skill page shows the full SKILL.md first. Read install.sh
curl -fsSL codexskills.dev/install.sh | sh -s -- gcp-cloud-run gcp-iam gcp-cloud-functions firebase-firestore bigquery-optimization gcp-gke firebase-hosting firebase-auth mobile-push-notifications sql-for-analytics Google Cloud FAQ
Is there a Codex skill for deploying to Cloud Run?
Yes. Google Cloud Run deploys services and jobs with gcloud, a dedicated runtime service account and images pinned by digest rather than :latest. It always sets --max-instances on anything that talks to a database, so instances times pool size stays under the connection limit, and rolls out canaries as --no-traffic --tag revisions with a one-line rollback. For a single event handler, Google Cloud Functions is the better fit.
How do I deploy to GCP from GitHub Actions without a service account key?
Google Cloud IAM sets up Workload Identity Federation for GitHub Actions and always adds an attribute condition to the provider, because a provider without one lets workflows from any repository authenticate to the pool. It audits the exported policy with a bundled audit_iam_policy.py script that flags basic roles, allUsers and escalation roles, and never grants roles/owner or roles/editor to a workload.
Can Codex write and test Firestore security rules?
Firebase Firestore writes firestore.rules that deny by default and validate document shape and changed keys, then tests every allowed and denied case with the Emulator Suite and @firebase/rules-unit-testing. Composite indexes live in firestore.indexes.json under version control instead of console clicks. Firebase Auth complements it by keeping roles in custom claims set by server code rather than trusting the client.
How do I install all 10 Google Cloud skills at once?
Pass every name to the installer in one command: curl -fsSL https://codexskills.dev/install.sh | sh -s -- gcp-cloud-run gcp-iam gcp-cloud-functions firebase-firestore bigquery-optimization gcp-gke firebase-hosting firebase-auth mobile-push-notifications sql-for-analytics. Add --project right after -- to put them in the current repository's .agents/skills/ so your team gets them too.
Which Google Cloud skill should I try first?
Google Cloud Run is the closest fit for most Google Cloud work. Mention it with $gcp-cloud-run in a prompt to load it on purpose; after that, Codex picks it up on its own whenever a task matches.