fix: harden cloud run runtime guard

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

scripts/cloud_run_runtime_guard.py

@@ -87,6 +87,17 @@ def _load_services() -> list[str]:
     return unique
 
 
+def _cloud_run_log_filter(service: str, since_text: str, region: str = "") -> str:
+    parts = [
+        'resource.type="cloud_run_revision"',
+        f'resource.labels.service_name="{service}"',
+        f'timestamp >= "{since_text}"',
+    ]
+    if region:
+        parts.append(f'resource.labels.location="{region}"')
+    return " AND ".join(parts)
+
+
 def _service_job_aliases(service: str) -> list[str]:
     service_name = str(service or "").strip()
     if not service_name:
@@ -510,11 +521,7 @@ def main() -> int:
         service_since = _cloud_run_log_since(project, service, since) if ignore_pre_ready_logs else since
         service_since_by_name[service] = service_since
         service_since_text = _format_timestamp(service_since)
-        log_filter = (
-            'resource.type="cloud_run_revision" '
-            f'AND resource.labels.service_name="{service}" '
-            f'AND timestamp >= "{service_since_text}"'
-        )
+        log_filter = _cloud_run_log_filter(service, service_since_text, _region_for_service(service))
         try:
             entries = _run_gcloud_logging(project, log_filter, limit)
         except RuntimeError as exc:

tests/test_cloud_run_runtime_guard.py

@@ -8,6 +8,18 @@
 from scripts import cloud_run_runtime_guard as guard
 
 
+def test_cloud_run_log_filter_includes_region_when_available():
+    log_filter = guard._cloud_run_log_filter(
+        "interactive-brokers-live-u1599-tqqq-service",
+        "2026-07-01T12:00:00Z",
+        "asia-east1",
+    )
+
+    assert 'resource.labels.service_name="interactive-brokers-live-u1599-tqqq-service"' in log_filter
+    assert 'resource.labels.location="asia-east1"' in log_filter
+    assert 'timestamp >= "2026-07-01T12:00:00Z"' in log_filter
+
+
 def test_scheduler_job_pattern_includes_service_alias():
     pattern = guard._scheduler_job_pattern_for_services(
         ["interactive-brokers-live-u1599-tqqq-service"]