Google Cloud Logging

When a pull request changes files that appear in the stack traces of the last day’s errors from the Google Cloud services or logs you map to its repository, MergeHarbor gives those errors to the reviewer and notes it in the summary.

How it works

• In the background, at most once an hour, MergeHarbor reads the log entries of the last 24 hours with severity ERROR or higher from each mapped service or log.
• It groups similar entries by their first line, parses their stack traces into file and line frames, and removes secrets and personal data before storing anything.
• A review uses only the groups from its repository’s services whose frames are in files the pull request changes. Reviews never wait for Google Cloud, and no extra model call is made.

What is read and what is never read

• Read: error entries of the last 24 hours from the services and logs you map, in the project the key belongs to. Only the first line (redacted) and stack frames of each group are kept, with an entry count and the time it was last seen.
• Never read: unmapped services and logs, entries below ERROR, metrics, traces, and any other Google Cloud API. MergeHarbor asks Google only for the logging.read scope.

The snapshot is kept until the next refresh and never written to logs. The key is encrypted at rest and never shown again.

Connect

1. In Google Cloud, open IAM & Admin → Service accounts in the project that holds the logs and create a service account for MergeHarbor.
2. Grant it only the Logs Viewer role (roles/logging.viewer) on the project.
3. Open the service account → Keys → Add key → Create new key → JSON. A key file downloads.
4. In the console, open Integrations and choose Connect on Google Cloud Logging (under Observability & incidents). You need the settings.manage permission.
5. Paste the whole key file and choose Connect. MergeHarbor reads one log entry to check the key.

For logs in several projects, connect once per project.

Map services to repositories

Open Settings on the connection and add, for each repository, up to 10 names. A name matches a Cloud Run service, a Cloud Functions function, an App Engine service, a GKE container, or a log ID (for example checkout-api or stderr). Choose All repositories to map names to every repository the connection is allowed for. Nothing is read until you map at least one name.

Limits

• The last 24 hours, one page of results and at most 100 entries per mapped name per refresh.
• At most 20 mapped names are read per connection, and up to 10 per repository.
• Only mapped services and logs are read.

Disconnect

Open the integration in Integrations and choose Disconnect. MergeHarbor deletes the key and the snapshot. Then delete the key (or the service account) in IAM & Admin → Service accounts, since MergeHarbor cannot revoke it.

Self-hosted installations

Google Cloud Logging needs no OAuth application: customers paste their own service account keys.